Privacy Policy
This Privacy Policy explains what personal information Bibsplit collects about you, how we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to the Bibsplit web application and any related emails or services we operate.
Contents
- Who we are
- Scope of this policy
- Information we collect
- How we use your information and our lawful bases
- Special-category and sensitive data
- Cookies and similar technologies
- Who we share your information with
- International data transfers
- How long we keep your information
- How we protect your information
- Your data protection rights
- How to exercise your rights
- Automated decision-making and profiling
- Children
- Third-party links
- California and other US state privacy rights
- Complaints and supervisory authorities
- Changes to this policy
- Contact us
1. Who we are
Bibsplit (“Bibsplit”, “we”, “us”, “our”) is provided by the operator of Bibsplit, based in England and Wales. For the purposes of the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“GDPR”), and the UK Data Protection Act 2018, we act as the data controller for the personal data described in this policy.
Postal address available on request via the contact email below. You can reach us by email at nicholaicorbie1@gmail.com for any question about this policy or how we handle your data. We have not appointed a formal Data Protection Officer as our processing does not meet the mandatory thresholds under Article 37 UK GDPR; the contact email above is the point of contact for all privacy matters.
2. Scope of this policy
This policy covers the personal data we process when you:
- Visit our website or use the Bibsplit application;
- Create, activate, use or delete a Bibsplit account;
- Add players, create matches, or record match results within your account;
- Reset your password or request a new activation email;
- Send us feedback or contact us for support;
- Receive service emails from us (such as activation, password reset, or support acknowledgement emails).
It does not cover personal data you may enter into other websites or services we do not operate.
3. Information we collect
We collect only the information we need to run Bibsplit safely and provide the features you use. The categories are:
3.1 Account information
- Email address — used to activate your account, verify identity for password reset, and send you service messages. Also used as an alternative login identifier.
- Username — chosen by you and displayed within the application.
- Password hash — we never store your password. What we store is a one-way Argon2id cryptographic hash (with per-user salt and current OWASP parameters). This value cannot be reversed to recover your password.
- Account activation flag, activation timestamp, account creation and last-update timestamps, and an internal session version counter used to invalidate old sessions after a password reset.
3.2 Content you create
- Players you add (name and rating you provide) and their aggregated statistics (wins, draws, losses, points, win-rate, points per game).
- Matches you create (team names, teams as lists of player names, team ratings, scores, outcome, match date, location, referee).
- Match log entries tying player names to specific matches.
Important: third-party data. Player names you add may relate to other identifiable individuals. When you enter such data you act as its data controller for GDPR/UK GDPR purposes and you are responsible for having a lawful basis to do so and, where required, for informing those individuals. Please only enter minimum data (typically a first name or nickname) and do not add special-category data (see section 5). See our Terms of Service for the related warranties.
3.3 Authentication and security tokens
- Account activation tokens (random 256-bit tokens tied to your email until used or expired).
- Password-reset tokens — stored only as a SHA-256 hash so that a leak of our database would not expose reusable tokens.
- Session cookie — a cryptographically-signed cookie set by our servers to keep you logged in. See our Cookie Policy for details.
3.4 Support, feedback and contact messages
- The email address, subject, category and message body you provide when you send feedback or a support request, and the ticket ID we generate in response.
3.5 Technical and diagnostic information
- Your IP address, used transiently by our anti-abuse rate limiter (login, account creation, password reset, resend activation) and included in web-server access logs.
- Request metadata such as HTTP method, path, user-agent, timestamps and error traces, collected by our hosting infrastructure (AWS CloudWatch) for security, debugging and service-reliability purposes.
- Consent records — if you sign up we record which version of these terms and this policy you accepted, when, and the IP address / user-agent recorded at that moment, so we can prove your consent later if asked.
3.6 What we do not collect
- We do not use analytics cookies, advertising cookies, tracking pixels or fingerprinting.
- We do not collect payment information (Bibsplit is free at the time of writing).
- We do not knowingly collect any special-category (“sensitive”) personal data.
- We do not sell or rent personal data to anyone. Ever.
4. How we use your information and our lawful bases
We only process your personal data where UK GDPR / GDPR gives us a lawful basis to do so. The table below sets out each processing purpose and its basis.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Creating and administering your Bibsplit account | Email, username, password hash, timestamps | Article 6(1)(b) — performance of a contract with you (our Terms of Service) |
| Sending account activation, password-reset and other transactional emails | Email, activation / reset tokens | Article 6(1)(b) — performance of a contract |
| Storing the players, matches and match logs you create | Content you provide | Article 6(1)(b) — performance of a contract |
| Rate-limiting sign-ups, logins and password-reset requests to prevent abuse | IP address | Article 6(1)(f) — our legitimate interest in protecting the service, and the interests of our users, from brute-force and credential-stuffing attacks |
| Server logs used for security monitoring, debugging and reliability | IP, request metadata, error traces | Article 6(1)(f) — legitimate interest in operating a secure and reliable service; also Article 6(1)(c) where required by law |
| Responding to feedback and support requests | Email, message content, ticket metadata | Article 6(1)(b) — performance of a contract, and Article 6(1)(f) — legitimate interest in improving the service |
| Checking whether your chosen password appears in known data breaches | The first 5 characters of the SHA-1 hash of your password (never the password itself) | Article 6(1)(f) — legitimate interest in protecting your account. See the “Sharing” section for details on HaveIBeenPwned’s k-anonymity API. |
| Recording your acceptance of our Terms and this Policy at signup | Timestamp, IP, user-agent, policy versions | Article 6(1)(c) — compliance with our accountability obligations under Article 7 UK GDPR |
| Enforcing our Terms and detecting or preventing fraud, abuse or misuse | Any of the categories above | Article 6(1)(f) — legitimate interest, and Article 6(1)(c) where required by law |
Where we rely on legitimate interests we have carried out a balancing test to make sure our interests are not outweighed by your rights and freedoms. You can ask us for details of that balancing test at any time via the contact email at the end of this policy.
5. Special-category and sensitive data
Bibsplit is not designed to collect special-category (“sensitive”) personal data such as racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation, and we ask you not to enter such data (whether about yourself or about any player you add). If you do so, you are solely responsible for the lawful basis for that processing.
6. Cookies and similar technologies
We use one strictly-necessary session cookie to keep you logged in and to protect against
cross-site request forgery. We do not set analytics, advertising or third-party tracking cookies.
We also use a small amount of browser storage (localStorage) to remember your theme
preference, whether you have seen the tutorial, and whether you have dismissed the cookie notice
— none of this is transmitted to us. Full details are in our
Cookie Policy.
7. Who we share your information with
We only share personal data with third parties where we need to in order to provide the service, where we are legally required to, or where you have asked us to. We do not sell personal data.
Our current processors and sub-processors are:
| Recipient | Role | Data | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting: application compute (Lambda), database (RDS PostgreSQL), object storage, content delivery (CloudFront), logging (CloudWatch), secrets management, and email delivery via Amazon SES | All personal data listed in this policy | eu-west-2 (London), UK / EEA |
| Have I Been Pwned (Superlative Enterprises Pty Ltd) | Detecting whether a password you choose has appeared in known data breaches. We use its k-anonymity API so only the first 5 characters of the SHA-1 hash of your password are ever sent — the password itself is never transmitted or stored by HIBP. | SHA-1 hash prefix of the candidate password; source IP address for the API call | Global CDN; the operator is based in Australia |
| Google Fonts (Google LLC / Google Ireland Ltd) | Serving web fonts on some pages. Google may log the IP address that requests a font. | IP address, user-agent, HTTP referrer | Global CDN |
Each of the recipients above acts as a processor that processes personal data only on our documented instructions and under written contract, except HIBP and Google Fonts which act as independent controllers for the limited data they receive as a result of your browser or our servers making a request to them.
We may also disclose personal data:
- Where we are required to by law, court order, regulator request or other legal process;
- Where necessary to establish, exercise or defend a legal claim, or to protect the rights, property or safety of Bibsplit, our users, or others;
- To a successor entity in the event of a merger, acquisition, insolvency, sale of assets or similar transaction, in which case we will notify affected users where practicable.
8. International data transfers
Our primary hosting is in the AWS eu-west-2 (London) region, which keeps the bulk of your data within the UK.
Some of our sub-processors and CDNs are global and personal data may transit to, or be processed in, countries outside the UK/EEA. Where that happens, we rely on one of the transfer mechanisms permitted by UK GDPR / GDPR, including:
- UK “adequacy” regulations or European Commission adequacy decisions (for example, the UK–US Data Bridge and the EU–US Data Privacy Framework where the recipient is certified);
- Standard Contractual Clauses (Commission-approved SCCs, or the UK Addendum / International Data Transfer Agreement);
- Your explicit consent, where an appropriate safeguard is not available and no derogation applies.
You can ask us for a copy of the transfer safeguards we rely on for any specific processor.
9. How long we keep your information
We keep personal data only for as long as we need it for the purpose we collected it, plus any period required by law. The main retention periods are:
| Category | Retention |
|---|---|
| Account records, players, matches, match logs | Until you delete your account, at which point we delete or irreversibly anonymise them within 30 days. Backup copies are overwritten within 35 days. |
| Activation tokens | Until used or 24 hours after issue, whichever is sooner. |
| Password-reset tokens (hashed) | Until used or 1 hour after issue, whichever is sooner. Used-token records are kept for 30 days for audit. |
| Session cookies | Deleted when you log out or when the session expires (see Cookie Policy). |
| Support tickets and feedback | Up to 2 years from the last correspondence. |
| Rate-limit counters (IP-based) | In-memory only; cleared automatically as the counters expire (typically within an hour). |
| Application and access logs | Up to 90 days in CloudWatch. |
| Consent records at signup | For the life of the account plus 6 years after account deletion, in line with UK contract-law limitation periods, so we can defend or evidence consent claims. |
Where we anonymise data (for example, removing your username from an aggregated statistic) it is no longer “personal data” and this policy does not apply to it.
10. How we protect your information
We take security seriously and apply organisational and technical measures appropriate to the risk, including:
- Passwords are hashed with Argon2id (OWASP 2025 baseline, per-user salt); legacy bcrypt hashes are transparently upgraded on next login.
- Constant-time verification and dummy hashing to defeat account-enumeration timing attacks.
- Rate limiting on account creation, login, password reset and re-send-activation endpoints.
- All traffic between you and our servers is protected by HTTPS with HSTS (in production).
- Session cookies are cryptographically signed with a server-side secret; sessions are invalidated on password reset.
- Content Security Policy and standard HTTP hardening headers (X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin).
- Password-reset tokens are stored only as SHA-256 hashes.
- Data at rest is encrypted using AWS-managed keys; database backups are encrypted.
- Least-privilege IAM roles between application components.
- Passwords are checked against the HaveIBeenPwned breach corpus (k-anonymity API — your password itself never leaves our servers).
Despite these measures, no system is perfectly secure. If we discover a personal-data breach that is likely to result in a risk to your rights and freedoms, we will report it to the UK Information Commissioner’s Office (ICO) within 72 hours and, where the risk is high, notify affected users without undue delay, in each case as required by Articles 33 and 34 UK GDPR.
11. Your data protection rights
Under UK GDPR / GDPR you have the following rights over your personal data. These rights are free of charge in most cases and we will respond to any valid request within one calendar month (extendable by two further months for complex or numerous requests, with notice).
- Right of access — get a copy of the personal data we hold about you and supplementary information about how we process it (Article 15).
- Right to rectification — ask us to correct inaccurate or incomplete personal data (Article 16). You can update most account details in the app itself.
- Right to erasure (“right to be forgotten”) — ask us to delete your personal data where one of the Article 17 grounds applies. In the app you can delete your entire account (and all associated players, matches and logs) at any time via the “Delete account” button.
- Right to restriction of processing — ask us to limit how we use your data in specific circumstances (Article 18).
- Right to data portability — receive your personal data in a structured, commonly-used, machine-readable format and transmit it to another controller (Article 20). We provide this in JSON on request.
- Right to object — object to processing that relies on legitimate interests (Article 21). Where you object, we will stop unless we have compelling legitimate grounds that override your interests, or the processing is needed for legal claims.
- Right to withdraw consent — where we rely on your consent (Article 7), withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Rights in relation to automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22). We do not carry out such processing.
12. How to exercise your rights
To exercise any right above, email us at nicholaicorbie1@gmail.com from the address associated with your account, or use the “Get help” form in the app. We may need to verify your identity before we can act on your request — for example, by asking you to prove control of your account email or asking additional questions if the request comes from a different address.
13. Automated decision-making and profiling
Bibsplit’s team-balancing feature is an automated algorithm that suggests two teams of similar overall rating. It does not make decisions about you as an individual, does not produce legal or similarly significant effects, and is only run when you explicitly ask for it. You are free to accept, adjust or ignore the suggestion. We do not use your data for profiling or automated decision-making of the kind restricted by Article 22 UK GDPR.
14. Children
Bibsplit is not directed to children. We do not knowingly collect personal data from anyone under 16, and you must not create an account or provide us with personal data if you are under 16. If you believe that we may have collected personal data from a child under 16 without a guardian’s consent, please contact us and we will delete it without undue delay.
15. Third-party links
The application may occasionally link to third-party websites (such as documentation or service-status pages). We are not responsible for the content or privacy practices of those sites, and this policy does not apply to them. We recommend you read the privacy policies of any third-party site you visit.
16. California and other US state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, Utah or another US state with a comprehensive consumer privacy law, you may have additional rights, including:
- The right to know what personal information we collect, use, disclose and (if applicable) sell or share, and to receive a copy of the personal information we hold about you.
- The right to correct inaccurate personal information.
- The right to delete personal information that we have collected from you, subject to certain exceptions.
- The right to opt out of the sale or sharing of your personal information for cross-context behavioural advertising. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not have “actual knowledge” of processing personal information of anyone under 16 without consent.
- The right not to be discriminated against for exercising these rights.
- The right, where applicable, to limit the use or disclosure of “sensitive personal information”. We do not process sensitive personal information for purposes that would require an opt-out.
You can exercise these rights by contacting us using the details in section 19. If we deny your request, you may appeal by replying to our response with the word “Appeal” in the subject line.
We honour recognised global privacy signals (such as the Global Privacy Control browser signal) as an opt-out request where we would otherwise engage in the sale or sharing of personal information. Because we do not engage in such activities, no additional processing needs to be suppressed on receipt of such a signal.
17. Complaints and supervisory authorities
If you are unhappy with how we have handled your personal data we would like the chance to put it right — please email us first at nicholaicorbie1@gmail.com.
You also have the right to lodge a complaint with a data protection supervisory authority. In the UK that is the Information Commissioner’s Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113 (from within the UK).
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
If you are in the EEA, you may complain to the supervisory authority in your Member State of residence, place of work, or the place of the alleged infringement.
18. Changes to this policy
We may update this policy from time to time to reflect changes to the service, to the technologies we use, or to legal or regulatory requirements. When we make material changes we will update the version number and effective date at the top of the page and, where required by law or where the change is significant, notify you by email or by an in-app notice before the change takes effect. Continued use of Bibsplit after the effective date constitutes acceptance of the updated policy.
19. Contact us
If you have any question about this policy, any concern about how we handle your data, or you wish to exercise any of your rights, please contact us at:
Email: nicholaicorbie1@gmail.com
Postal: Postal address available on request via the contact email below.