2.1 Account data

• What: email address; password (stored only as a hash by our login provider, so nobody can read it); when you signed up, confirmed your email and last logged in; the page you signed up from (for example an invite link, so we can take you to the right competition after you confirm your email, and remind you with a banner until you have joined); and the date and time you confirmed you are 18 or older and accepted the Terms of Use.
• Why: to create and protect your account, log you in, send you service emails (such as the sign-up confirmation and password reset), and be able to show that you confirmed your age and accepted the terms.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); for the acceptance record, our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR).

2.2 Profile data

• What: first name, last name, optional nickname, and avatar. Your avatar is either one of the ready-made characters, your initial, or your own photo. From your names we create your display name: “First name + initial of last name” (for example “John D.”), or your nickname if you set one.
• Why: so your group can see who is playing.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Your own photo is cropped and made smaller on your device, and then processed again on our server (see section 2.9).

2.3 Competition and game data

• What:
  • competitions you create: title word, tagline, the exact start and end time, your time zone (taken from your device; it sets when the competition starts and ends), chosen pack, challenge list, photo rules, rules text, pinned announcement and settings (for example the secret final 24 hours);
  • memberships: your role (Owner, co-admin or participant), when you joined, and whether you left or were removed, when and by whom (we keep removals so that a removed person can’t rejoin through the invite link);
  • completions: which challenge, when, the points, and the number you entered for per-unit challenges;
  • tags: whom you tagged as having done a challenge with you and who tagged you, including “Not me” when someone removes themselves;
  • undos and hidden posts: who undid or hid a post, when, and the optional reason;
  • standard challenges with automatic points: every new competition contains “Idea Machine” (points for each of your suggestions an admin approves) and “Spread the Chaos” (points once a new competition you started has been joined by at least 2 people who aren’t in the earlier competition). For “Spread the Chaos”, the database checks this without showing anyone the other competition. Members of your earlier competition will see that you received these points, and so can infer that you started another board;
  • badges and badge points: badges (for example “First blood”, “Night owl”, a streak of days in a row) are calculated automatically from your completions and add points to your score;
  • suggested challenges: what you suggest (title, description, points, category and other details), whether it was approved or rejected, and by whom;
  • reactions: which emoji you gave to which post;
  • invite links.
• Why: to run the game: challenge board, points, leaderboard, badges, feed and results.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

2.4 Content you post

• What: proof photos, comments, custom and suggested challenges, and your reactions.
• Why: to show them to the members of the competition.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Please don’t post sensitive information (for example about health, religion, political views or sex life) about yourself or others. [REVIEW: legal basis if photos reveal sensitive data.]

2.5 Reports and moderation

• What: when you report a photo or comment: what you reported, your reason, that you made the report, and when. When content is hidden, or an account suspended or a competition frozen: who did it, when, and the reason. We keep a log of our own moderation actions.
• Why: to keep ToniChallenge safe, handle reports quickly, enforce our Terms of Use, and defend or pursue legal claims.
• Legal basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR); where the law requires us to act, a legal obligation (Art. 6(1)(c) GDPR).
• Email to the operator: for every report, the operator gets an email with the competition’s name and the reason you gave, and a link to the operator area. The email contains no email addresses and no names of the people involved.

2.6 Messages to us: feedback and the contact form

• Feedback (logged in): your message, the page you sent it from, when, and your account. The operator also gets it by email, with your display name and the page, never your email address.
• Contact form (public, no account needed): your message, the topic you chose (optional), the email address you give for a reply (optional), and when. To stop abuse, we also store a salted hash of your IP address: your IP address is turned into a scrambled code together with a secret value, so we can count how many messages come from the same connection (at most 5 per hour), but the code is hard to turn back into your IP address (we never try to). We never store the IP address itself. The operator gets your message by email, including the reply address if you gave one. The reply address is only used to answer you and is never shown on the site.
• Why: to answer you, handle your request (for example a privacy request or a photo you want removed), and prevent spam and abuse of the form.
• Legal basis: our legitimate interest in answering and in preventing abuse (Art. 6(1)(f) GDPR), or our contract with you where your message is about your account (Art. 6(1)(b) GDPR); where you exercise a data protection right, our legal obligation to answer (Art. 6(1)(c) GDPR).
• Retention: see section 6. [REVIEW: retention period for contact messages and the IP hash, proposed 12 months.]

2.7 Technical data

• What: when you visit the site, our hosting and database providers automatically process technical data needed to deliver it and keep it secure: IP address, date and time, the page or request, browser and device type, and error information. Our login provider also keeps security logs of sign-ins [CONFIRM contents, e.g. IP address].
• Why: to deliver the website, find errors, and detect and stop attacks.
• Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

2.8 Bot check (Cloudflare Turnstile, when switched on)

• What: when the bot check is switched on, it runs when you sign up, log in, reset your password or use the contact form, to make sure you are a human. Cloudflare processes your IP address and technical information about your browser and device for this, as our processor.
• Why: to prevent fake accounts, spam and abuse.
• Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

2.9 Photo processing and automatic clean-up

• Processing on our server: every proof photo and own avatar photo is processed on our server before it can be used: it is turned the right way up, made smaller and saved again as a new image. This removes the metadata stored in the file, such as location (GPS), camera model and time taken. Photos that haven’t been processed can’t be posted.
• Daily clean-up: once a day, an automatic job deletes the proof photos of every competition that ended more than 30 days ago (the feed then shows “photo expired”), and deletes uploaded files that no post or profile uses (for example a photo you picked but never posted) after one day.
• Why: to protect your privacy and keep only what the game needs.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in data minimisation and security (Art. 6(1)(f) GDPR).

2.10 Download my data

In your profile, “Download my data” gives you a file with your account details (email, sign-up and last login), your profile, your memberships, your posts and comments, your points, your reactions, your suggestions and your reports.

2.11 Deleting your account

• You can delete your account yourself in your profile (you type DELETE to confirm). An Owner should hand over ownership first; otherwise the competitions they still own close and become view-only for everyone.
• What is deleted straight away: your login (email address and password), your profile (names, nickname, avatar), all photos you uploaded (proof photos and avatar photos), your memberships, your completions and points (you disappear from every leaderboard), your badges and your reactions.
• What stays, without your name: posts in which you tagged friends stay as empty entries (no name, comment or photo), so your friends keep their points. Custom challenges and rules texts you wrote, and suggestions of yours that were approved, stay in their competitions. Reports and feedback you sent, and moderation records, stay without the link to your account. [CONFIRM what the feed shows for such entries.]
• Backup copies are overwritten within [BACKUP RETENTION].

2.12 What you must provide

You need to give us your email address, a password and your first and last name to create an account. Without them, you can’t use ToniChallenge. Everything else (nickname, own avatar photo, proof photos, comments, suggestions, reactions) is up to you, unless a challenge requires a photo, in which case you can simply skip that challenge. On the contact form, only the message is required.

2.13 What we don’t do

• No advertising, no analytics, no tracking, and no profiling.
• We don’t sell or rent your data.
• We don’t send marketing emails, only emails needed for the service.
• We don’t make automated decisions about you that have legal or similarly significant effects. (Automatic points and badges are part of the game only.)