Privacy Policy
This is the privacy policy for the URC Playoff Predictor at urc.socialreferee.com — a small, free fan-built tool. It describes what we collect, why, and how to remove it. Plain language only; no hidden gotchas.
What we collect
You can use the entire site without an account — fixture picks, scoreline edits, try counts and form toggles all live in your browser's localStorage, never sent anywhere.
If you choose to sign in with Google, we receive these from Google:
- Your Google subject identifier (a stable opaque ID)
- Your email address
- Your display name
- Your profile picture URL
And we store, on our side:
- The four items above, linked to a randomly-generated user ID
- Your prediction settings as a single JSON record — form overrides, fixture-winner picks, score overrides, try-count overrides — so you can use the site across devices
- Timestamps of when your account was created and last seen
Cookies
While signed in, we set one HTTP-only session cookie (urc_session, signed, 30-day expiry) so the site recognises you. During the sign-in flow, two short-lived cookies are set for CSRF protection and to remember where to return to after sign-in. None are used for tracking; none are read by third parties.
What we don't do
- No third-party analytics, ad networks, or tracking pixels.
- No selling, sharing, or trading of your data.
- No payment information (the site is free).
- We don't track your activity outside this site.
Where it's stored
All user data lives in Cloudflare D1 (a SQLite-backed database) hosted in the EU (Frankfurt region). The site itself is served by Cloudflare Pages. Cloudflare receives standard request metadata (IP address, timestamp, request path) for delivery and abuse prevention, governed by Cloudflare's privacy policy.
Third parties
- Google — for sign-in via OAuth. Subject to Google's privacy policy.
- unitedrugby.com — standings, fixtures, and team logos are fetched at site-build time. We don't pass user data to URC.
Retention & deletion
We keep your data until you ask us to delete it. Signing out only clears the session cookie — your stored settings remain so you can sign back in later. To delete your account and settings entirely, email us (see Contact below); deletion is permanent and processed within a few days.
Your rights
You can ask us to provide, correct, or delete your data at any time. If you're in the EU/UK, the GDPR/UK GDPR applies to this processing.
Changes
We may update this policy as the site evolves. The "last updated" date at the top tracks revisions; significant changes will be flagged in-app.
Contact
For privacy questions or data requests, email [email protected].