en.campusclash.lol
Privacy & Data Protection
The short version: voting asks nothing personal of you, and we do not want anything personal from you. This page sets out the longer version required by the UK GDPR and the Data Protection Act 2018.
Who is responsible
The operator of en.campusclash.lol is the data controller for everything described here. For any question about your data, or to exercise the rights listed below, write to hello@tryq.io.
What we process, and why
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Salted hash of your IP address sha256(IP + secret salt) | To stop one person voting over and over. Without it the table would mean nothing at all. | Legitimate interests — keeping the standings honest (Art. 6(1)(f)) | As long as the vote stands |
| Email address | Taken from sponsors only, at the point of payment: to tell you when your slot is taken over, and to match the credit that makes taking it back cheaper. | Performance of a contract (Art. 6(1)(b)) | Until you ask us to erase it |
| Payment record amount, date, provider reference | To prove a sponsorship is valid, and to meet the record-keeping rules that apply to a sale. | Legal obligation (Art. 6(1)(c)) | Six years, as UK tax record-keeping requires |
What we never collect
- Your raw IP address is never written down. It reaches the server, is hashed with a secret salt, and only that hash is stored. The hash cannot be turned back into an address, and the address is kept in no log.
- No name, no date of birth, no location, no device fingerprint, and no special category data of any kind.
- There are no accounts. Neither voting nor sponsoring asks you to register, and there is no password to lose.
- Card details never reach our servers. Payment happens entirely on the payment provider's own pages.
Your browser
We set no advertising or tracking cookies. The only thing kept in your browser is a note of which campus you voted for, so the page can show it back to you — the server remains the source of truth either way. Our bot protection, Cloudflare Turnstile, may set its own cookie in the course of checking that you are a person.
Analytics are cookieless and count page views only, with no profile built and no identifier stored.
Who else sees it
Hosting, database and server code run on Google Cloud (Firebase). Bot protection is Cloudflare. Payments are handled by our payment provider, who is the merchant of record and receives the details you enter at checkout. Nothing is shared with anyone else, and nothing is ever sold.
Where it is stored
This project's database region is in the United States, so the data described above is transferred outside the UK. Google Cloud provides the safeguards required for such transfers under Article 46 of the UK GDPR. Payment records are additionally held by the payment provider under their own terms.
Your rights
Under the UK GDPR you have the right to:
- ask what we hold about you, and get a copy of it;
- have anything inaccurate corrected;
- have it erased;
- restrict or object to how we use it;
- receive it in a portable form;
- complain to the Information Commissioner's Office at ico.org.uk if you think we have got this wrong.
Write to hello@tryq.io and we will answer within one month.
One practical limit on erasure: a vote is stored only as a hash, so we cannot match it to you from an email. To have a vote removed, send the request from the same connection you voted on and say which campus it was.