Privacy Policy

Last updated:

1. Introduction & Data Controller

TopTipper ("we", "us", "our") values your privacy and is dedicated to safeguarding your personal data in full compliance with the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and applicable data privacy standards.

Data Controller: TopTipper Data Protection Officer.
Contact Email: privacy@top-tipper.com

2. Information We Collect

We collect only the minimum necessary information to provide tipping competition services:

  • Account Data: Username, display name, email address, password hash, and optional favourite team.
  • Competition Activity: Tips submitted, Banker/Joker power-up selections, pool memberships, badges earned, and trivia quiz responses.
  • Technical & Log Data: IP address, browser user-agent, session timestamps, and security audit logs to protect against fraudulent multiple accounts and bot attacks.
  • Notification Preferences: Your explicit opt-in preferences for tip deadline reminders, pool notifications, and sports digests.

3. Lawful Basis and Purpose of Processing

We process your data under the following lawful bases:

  • Contractual Necessity: To deliver tipping game mechanics, calculate scores, maintain leaderboards, and authenticate account sessions.
  • Legitimate Interests: To secure the platform, prevent fraudulent multi-accounting, and resolve disputed tips.
  • Consent: For sending optional email reminder alerts and newsletter digests, which can be modified at any time in your Profile Settings.

4. Cookies and Local Storage

TopTipper uses transparent, minimal cookies and storage items:

  • laravel_session (Essential): Ephemeral session token to keep you authenticated while navigating the platform.
  • XSRF-TOKEN (Essential): Security token to protect forms against Cross-Site Request Forgery attacks.
  • remember_web_* (Optional): Encrypted token generated only when you check "Remember me" on login, valid for 30 days.
  • top_tipper_theme (Local Storage): Saves your dark or light theme preference without transmitting personal data.

We do not use invasive third-party tracking cookies or sell your browsing data to ad networks.

5. Data Retention & Deletion

We retain your account data as long as your account is active. If you choose to close your account, you can request full erasure under GDPR Article 17 by emailing privacy@top-tipper.com. Upon verified request, all personal identifying records will be permanently purged within 30 days.

6. Your Data Protection Rights

Under applicable privacy laws, you possess the right to:

  • Access: Request a copy of your personal data held by TopTipper.
  • Rectification: Update inaccurate or incomplete details via your Profile page.
  • Erasure: Request the deletion of your account and personal records.
  • Data Portability: Export your pool tipping history and performance records in standard CSV format.
  • Withdraw Consent: Opt out of optional communication channels at any time.

7. Security Safeguards

We use security measures including cryptographic password hashing (bcrypt/argon2), strict Content Security Policies (CSP), encrypted transport layer security (HTTPS/TLS), and rate limiting to prevent unauthorized access.