CalledItMate

Legal

Privacy Policy

Last updated: 8 September 2026

Who is responsible for your data

CalledItMate is operated by Denver, trading as CalledItMate, based in England and Wales. We are the data controller for the personal data described here.

For anything about your data, email hello@calleditmate.com.

1. What we collect

When you create an account

  • Email address - authentication, account recovery, and contacting you if you win.
  • Username, display name and avatar - your username is shown publicly on leaderboards and in chat.
  • Password - stored only as a one-way hash. We never see or store the password itself.
  • Sign-in provider details - if you use Google, X or Apple to sign in, we store the account identifier that provider gives us, plus the email, name and avatar they share. We never receive your password for that account.

When you play

  • Predictions, points and results - every prediction you make, so points can be calculated and the leaderboard built.
  • Chat messages and support messages - including any images you attach to a support thread.
  • Streaks, bonuses and prize history.

Technical and security data

  • IP address and country - recorded at signup, on each sign-in session, and on requests. Used for security, and to know which country a player is in for prize eligibility.
  • Browser or app user-agent - the browser and device type you use.
  • A device identifier - a token stored on your device on the web, and an install identifier in the app.
  • A browser fingerprint - calculated after you sign in. See section 5.

Only if you opt in

  • Page views and live presence - the pages visited, the page you arrived on, the referring site, your country and an anonymous browser identifier. On the website an approximate city and coordinates derived from your IP may be shown on our internal live-visitors panel. None of this runs unless you accept it when asked.
  • Where your signup came from - the referring site or campaign that first brought you here, and the page you landed on. Recorded on your first visit for everyone, so a signup can be credited to where it came from.

Notifications

If you turn notifications on, we store a push token for your browser or device so we can send match and result alerts. This is controlled by the notification permission your browser or phone asks you for, and by the notification settings in your account - it has nothing to do with the cookie choice above. Turning notifications off removes the token.

Email engagement

When we send you an email, we record whether it was delivered, bounced, opened and whether a link in it was clicked. This is done with a small tracking image and links that pass through our own server. We use it to keep emails working and out of spam folders, not to build a profile of you. You can stop marketing emails at any time using the unsubscribe link, and doing so does not affect essential account emails such as password resets.

We do not ask for your real name, date of birth, home address or phone number to play, and there are no billing details because the game is free.

2. Why we use it, and our legal basis

  • To provide the game - running your account, recording predictions, calculating points, building leaderboards, running chat and support. Basis: performance of our contract with you.
  • To keep the competition honest - detecting duplicate accounts, collusion and automated play, so prize money goes to the people who actually earned it. This is what the device identifier, fingerprint, IP and user-agent are for. Basis: our legitimate interest in preventing fraud in a competition with real cash prizes.
  • To keep the service secure and available - blocking abuse, scraping and attacks. Basis: our legitimate interest in security.
  • To send essential emails - confirmation, password reset, prize notification. Basis: performance of our contract with you.
  • To measure how the site is used, and where signups come from. Basis: your consent, which you can withdraw at any time.
  • To send notifications and any marketing email. Basis: your consent.
  • To pay prizes and keep the records that go with that - including any checks we are required to make before sending money. Basis: performance of our contract, and compliance with our legal obligations.

We do not sell your data, we do not share it for anyone else’s marketing, we do not run behavioural advertising, and we do not make any decision about you by automated means that has a legal or similarly significant effect on you.

3. Prize payment data

If you finish in a prize-winning position we will contact you to arrange payment, and ask for the payment details you prefer - for example a PayPal address, bank details, or a cryptocurrency wallet address. We may also need to confirm your age and identity before releasing a prize. This is used solely to pay you and to keep the record of that payment, and it is not shared with anyone beyond the provider used to send the funds.

4. Who else processes your data

We use a small number of external providers to run the platform. They act on our instructions only, under contract, and none of them are permitted to use your data for their own purposes. By category, they are:

  • Website and application hosting.
  • Database hosting.
  • Content delivery, security and bot protection - including Cloudflare Turnstile, which runs at signup to tell people apart from automated scripts and may read limited technical signals from your browser to do so.
  • Transactional email delivery.
  • Push notification delivery, if you have turned notifications on. On mobile this necessarily involves Apple and Google, who operate the notification networks.
  • File and image storage, for avatars and support attachments.

We do not name individual suppliers here, which UK GDPR permits, because that list is commercially sensitive. If you have a specific concern about a provider, contact us and we will deal with it.

Transfers outside the UK and EEA. Some of these providers are based in, or store data in, the United States. Where personal data is transferred outside the UK or EEA we rely on the UK International Data Transfer Addendum, the European Commission’s Standard Contractual Clauses, or a finding of adequacy, so your data keeps essentially the same protection it has here. You can ask us for details of the safeguard used.

5. Cookies, storage and device identification

Strictly necessary - always on

A session cookie and a companion marker keep you signed in. A device token, and a browser fingerprint calculated after you sign in, exist to stop one person running several accounts and taking prize money that belongs to other players. Because this is a competition paying real cash, that check is part of the service itself rather than an optional extra, so it runs for everyone who signs in and cannot be switched off while you hold an account. It is never used for advertising, profiling, or tracking you across other websites.

The fingerprint is calculated in your browser and only the resulting value is sent to us, along with your user-agent. We do not receive the underlying measurements it is derived from.

Set on your first visit

A first-party cookie, kept for 30 days, recording the site or campaign that first brought you here and the page you landed on. It is only used to credit a signup to where it came from, it is never shared, and it is never used for advertising. It is set for every visitor, whatever you choose on the cookie notice.

Optional - only with your consent

  • An anonymous browser identifier used to count visits and show who is on the site right now.
  • Google Analytics, which measures how the site is used and sets its own cookies.

None of this loads or runs until you accept it - the script is not placed on the page at all, and no request is made to Google, until you say yes. Choosing “No thanks” keeps it off and removes anything a previous acceptance left behind. You can change your mind at any time by clearing this site’s cookies in your browser, which makes the choice appear again.

We do not run advertising cookies or advertising pixels. We previously used the Meta (Facebook) pixel and have removed it, so nothing on this site reports your visit or your signup to an advertising network, and we share nothing about you for advertising.

6. How long we keep it

  • Account data - for as long as your account exists, then deleted when you delete the account.
  • Predictions, points and leaderboard history - kept while the account exists, because they are the record of the competition.
  • IP addresses attached to page views - removed after 30 days.
  • Page view records - deleted after 12 months.
  • Live presence records - deleted after 7 days.
  • Email delivery and engagement records - deleted after 12 months.
  • Logged-out visitor chat - deleted after 12 months.
  • Expired sign-in sessions - deleted 30 days after expiry.
  • Prize payment details - deleted once payment is confirmed, apart from the minimum record of the payment itself that we are required to keep.

7. Your rights

Wherever you live, you can ask us to:

  • Access the personal data we hold about you, and get a copy.
  • Correct anything inaccurate.
  • Delete your account and data.
  • Restrict or object to how we use it, including objecting to anything we do on the basis of legitimate interests.
  • Receive it in a portable format, or have it sent to another provider.
  • Withdraw consent at any time, for anything we do on the basis of consent. That does not affect anything done before you withdrew it.

You can delete your account yourself at any time from the account screen in the app, which removes it immediately. Otherwise email us and we will action any request within 30 days. We do not charge for this.

Complaints. If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner’s Office at ico.org.uk. In the EU it is the supervisory authority in the country where you live.

If you are in the United States. We do not sell or share personal information as those terms are used in state privacy laws, and we do not use it for cross-context behavioural advertising. The rights above are available to you on the same basis, and we will not treat you differently for using them.

8. Security and breaches

Passwords are stored only as one-way hashes, traffic is encrypted in transit, and access to the production database is restricted. No system is perfectly secure, but if a breach happens that is likely to put your rights at risk we will tell the relevant regulator within 72 hours of becoming aware of it, and tell you directly where the law requires it.

9. Under-18s

The minimum age to hold an account depends on where you live and is set out in section 2 of our Terms. We know some of our players are teenagers, so this section says plainly what that means rather than pretending the service is adults-only.

  • We ask for as little as possible. An email address and a username. No real name, date of birth, address, phone number or payment details are needed to play.
  • We do not profile you or sell anything to you. There is no behavioural advertising, no ad networks, no tracking across other websites, and your data is never sold or shared for marketing. The device information in section 5 is used only to stop one person running multiple accounts.
  • Your username is public. It appears on leaderboards and in chat, so choose one that does not identify you in real life. Nothing else about your account is public.
  • Chat is moderated. Messages are filtered automatically and can be reported in-app. You can block another player at any time. Never share personal details, contact information or photographs of yourself with anyone you meet here.
  • Cash prizes are 18+. Under-18s can play and appear on the leaderboard, but cannot receive a cash prize. We may ask for proof of age before paying one.
  • Notifications are optional and can be turned off at any time in your account settings or your device settings.

If you are a parent or guardian and want to see what we hold about your child, have it corrected, or have the account and all its data deleted, email us and we will action it within 30 days. You do not need to give a reason. If you believe a child below the minimum age has created an account, tell us and we will remove it.

10. Changes to this policy

We may update this policy from time to time. The date at the top reflects the most recent revision, and we will tell account holders by email before any change that materially affects how we use their data.

11. Contact

Questions about your privacy? Email hello@calleditmate.com.