Privacy Policy

1. Controller

Lockcast is the data controller for personal data processed through this Service. To contact us about this policy, use the feedback button at the bottom-left of any page. It is available whether or not you are signed in.

2. Data We Collect

• Account data: email address, username, display name, avatar.
• Activity data: predictions, votes, challenges.
• Usage data: IP address, browser type, pages visited, session duration.
• Media: images and other files you upload.
• Feedback data: the name, email address and message you enter in the in-app feedback box, together with the page context attached to it (page URL, browser user agent, viewport size, app version, IP address, and your account ID where you are signed in). Name and email are optional.
• Feedback attachments: images you choose to attach to a feedback submission, such as screenshots. These are optional, are stored privately and are never shown publicly or to other users; they are readable only by Lockcast staff handling the report. A screenshot may capture whatever was on screen at the time, so please do not attach images containing data you do not want to share with us.

3. Data That Is Published Publicly

Some of the data you provide is published by design. Your username, display name, avatar, bio, predictions, challenges, votes, and accuracy statistics are visible to anyone who visits Lockcast, including visitors who are not signed in, and may be indexed by search engines. We publish this data to operate the Service under Art. 6(1)(b) GDPR. Your email address, notification settings, feedback submissions and feedback attachments are never published. There is no private or followers-only posting mode; if you do not want something to be public, do not post it.

4. Lawful Bases (Art. 6 GDPR)

• Contract (Art. 6(1)(b)): to provide the Service and maintain your account.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a)): non-essential cookies and analytics where consent is given.

5. How We Use Your Data

• To operate and improve the Service.
• To send transactional notifications.
• To detect and prevent abuse.
• To comply with legal obligations.

6. Retention

Account data is retained for the life of your account. On deletion, personal data is removed within 30 days, except where retention is required by law.

• Inactive accounts: accounts with no sign-in for 24 months receive an email warning. If the account remains inactive for a further 30 days, it is permanently deleted and personal data removed.
• IP addresses, submitter names and browser identifiers in consent and feedback records: nullified after 90 days.
• Feedback attachments: deleted after 90 days, on the same cycle as the other feedback identifiers.
• Failed sign-in attempt logs: deleted after 30 days.
• Consent records: retained indefinitely as proof of consent under Art. 7(1) GDPR; IP and browser identifiers within them are removed after 90 days.
• Draft compositions: stored locally in your browser only and never transmitted to or retained by Lockcast.

7. Recipients and Processors

• Supabase — database and authentication (EU region).
• Vercel — hosting and edge functions.
• Tenor — GIF search.
• Resend — transactional email.
• Cloudflare — Turnstile bot protection on the feedback form, shown only to signed-out visitors.

All processors are bound by data processing agreements.

8. International Transfers

Where data is transferred outside the EEA, we rely on Standard Contractual Clauses or equivalent safeguards.

9. Your Rights

Under GDPR you have the right to: access your personal data; rectify inaccurate data; request erasure; restrict processing; receive your data in a portable format; and object to processing based on legitimate interests.

You can export your data, correct your account details and request erasure yourself from Privacy & data in your account settings. For any other request, use the feedback button at the bottom-left of any page.

10. Supervisory Authority

You may lodge a complaint with your local data protection authority. In Ireland, this is the Data Protection Commission.

11. Contact

Use the feedback button at the bottom-left of any page. It is available whether or not you are signed in.