Privacy Policy

Who we are

92 Away Days is the data controller for the personal data described here. The service is operated from the United Kingdom and processes personal data under the UK GDPR and the Data Protection Act 2018. To contact us about privacy, use the data request form.

What we collect and why

• Account data — email address, display name, optional username, profile picture and favourite club. Needed to give you an account (contract).
• Away Day Passport data — grounds ticked off, favourited fixtures and matchday check-ins. Used to run the passport features you asked for (contract).
• Location, once — a matchday check-in reads your device location at the moment you tap check in, with your permission (consent). We store the calculated distance from the ground and the verification result, not a location history. You can decline and still self-declare a visit.
• Community content — pub reviews, away-day reviews and pub suggestions, shown publicly with your display name (contract / legitimate interests in running a community).
• Issues & improvements reports — what you typed, the area of the app, an optional email address and an optional screenshot. Used to fix and improve the app (legitimate interests). The email address is optional; leave it blank to report anonymously.
• Anti-spam data — when a form is submitted we store a one-way hash derived from the network address, never the address itself, and delete it after 24 hours (legitimate interests in preventing abuse).

What we do not do

We do not sell your data, we do not use advertising or analytics tracking cookies, and we do not profile you or make automated decisions with legal effects. Storage on your device is limited to what the app needs to work: your sign-in session and your light/dark theme choice.

Who we share it with

Our hosting and database provider stores the data on our behalf under a processor agreement. Map pages load Google Maps, which receives your IP address and the map area you view in order to render the map. Community reviews and pub suggestions you post are visible publicly. We disclose data otherwise only where the law requires it.

How long we keep it

• Account, passport and review data: while your account exists, then deleted or anonymised.
• Issue reports: kept for the retention period set by the team (2 years by default), then the email address, name and screenshot are permanently removed and only the anonymised report text remains.
• Data requests and the record of how we handled them: 3 years, as our compliance record.
• Administrator activity logs: 12 months.
• Anti-spam hashes: 24 hours.

How we protect it

Data is encrypted in transit, access to reports and requests is limited to administrators, every sensitive administrator action is logged, screenshots live in a private store reachable only through short-lived links, and forms are rate limited. We collect the minimum needed for each feature.

Your rights

You can ask for access to your data, correction, erasure, restriction, portability, or object to processing, and withdraw consent at any time. Use the data request form — we respond within one month. Signed-in supporters can also download everything we hold from the profile page, edit their profile, remove ground visits and delete their own reviews at any time.

Complaints

If you're unhappy with how we handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.