Privacy policy
How Hoardsy uses your information, the choices you have, and how to contact us.
Jump to a section
1. Who is responsible
Hoardsy Competitions Ltd operates www.hoardsy.com. The operator’s contact details appear above. You can also raise a privacy request through Account → Support.
2. Information we use
We collect your chosen username, a protected password hash and sign-in records. If you add a name, email address or phone number later, we collect those details and their verification records. We also record the versions of the terms and privacy policy acknowledged at registration. When you use the service, we record entries, saved results, wallet transactions, payment references, prize requests, referral relationships, account limits, consent choices and support messages. Eligibility and payment providers may supply verification results and transaction statuses. Security records may include network addresses, device or browser information and the time of an action.
3. Age check
Before your first deposit we check once that you are 18 or over. You give your name, date of birth and address; they go to our age-check provider, Yoti Ltd, which compares them with credit and electoral records and tells us only whether you passed. No documents are uploaded. We keep your first and last name if you pass, to check that deposit cards are in your own name. We do not keep your date of birth or address: we keep a scrambled (keyed hash) code made from your surname, date of birth and postcode, so the same person cannot pass again on another account. If the check cannot confirm your age, our team reviews the account before any deposit. We do this to meet our legal and good-practice obligations to keep under-18s out and to prevent fraud.
4. Support and Pip
Support messages, attachments and chat messages are kept with your account. Pip, our AI helper, may answer everyday questions first and is labelled as an AI helper. Pip runs on Claude, provided by Anthropic PBC in the United States, and sees your message, the help pages and the details of your own account needed to answer it. Pip cannot move money, change your account or decide a complaint: those, and anything about money, prizes or your wellbeing, or any request for a person, go to our team. Our team receives support messages, and drafts of replies, through a private Telegram chat (Telegram Messenger Inc.).
5. Safer play
From the day your account opens we use your deposits, entries, limits and play times to spot signs of harm, such as repeat deposits, depositing after losing or heavy play overnight. Our team looks at these signs and decides whether to contact you or restrict the account; no decision with legal or similarly significant effect is made by a computer alone. We do this in our legitimate interest and to meet the prize draw code we follow.
6. Why we use it
We use account, entry, payment and prize information to provide the service and perform our agreement with you. We use security, fraud-prevention and service-diagnostic information for our legitimate interests in protecting customers, preventing abuse, resolving disputes and operating a reliable service. We use information where needed to comply with applicable legal obligations. Optional analytics rely on your separate consent. Marketing email goes to you if you opt in, or, once you have bought tickets, about similar Hoardsy competitions unless you said no when you gave us your email (PECR soft opt-in); you can stop it at any time in Communication preferences or from any marketing email. Registration does not give marketing consent.
7. Payments and verification
Payment and identity providers process the information required for their checks under their own privacy notices. Payment-card entry is handled by the payment provider. Hoardsy records payment references, amounts and status, rather than a complete card number or card security code. Eligibility checks can prevent participation. Contact Support if you believe a decision or verification result is incorrect and want it reviewed.
8. Who receives information
Information is shared as needed with our providers: hosting (Railway) and network security (Cloudflare); account email (Resend); phone sign-in and text messages (Twilio); payments and bank payouts (our payment provider, named at checkout); age checks (Yoti); our AI support helper (Anthropic); team messaging for support (Telegram); and couriers or suppliers that deliver item prizes. Authorised staff can access records needed to provide support, process requests and investigate problems. Information may be disclosed to professional advisers or authorities where required by law or necessary for legitimate legal claims. Our public record lists every real-money competition, entry, result and draw using opaque ticket references, never your name, username or contact details; checkpoints of it are published in Sigstore’s public Rekor log. Draw proofs use opaque ticket receipts, with account-only links to your own entries. Beside your chat messages, and where a win is shown publicly in chat, results or Winners, only the start of your username shows to other players (for example Luck***), and nobody else can see your tickets or results. Contact details and your full name are private. Winner stories and quotes require separate permission; sharing features show the details you choose to publish. Advertising rules require us to show that major prizes were really awarded: if someone asks, we give the surname and county of a major prize winner, unless the winner objects. If you object, we may still give them to the Advertising Standards Authority if it asks.
9. Advertising and Meta
We advertise on Facebook and Instagram. Recipient: Meta Platforms Ireland Limited, which also uses what it receives under its own privacy policy. We run no Meta pixel or other Meta code in your browser. Conversions API (consent): the Analytics banner has an optional Meta box, unticked until you tick it. If you tick it, our servers tell Meta when an account made from your browser signs up and when it makes its first deposit, so we can measure our ads. We send a scrambled (hashed) copy of your account number, the click ID from the ad you clicked, your browser type and IP address, and the amount of the first deposit. We never send your name, email address or phone number, and we send nothing if you leave the box unticked. Untick it or choose No thanks in Analytics preferences at any time: we stop sending and delete what we held for it. Meta may process data outside the UK under its own safeguards. Hashed-email audiences (consent): if you have opted in to Hoardsy marketing email, we may upload a scrambled (hashed) copy of your email address to Meta to leave you out of sign-up ads or to find people with similar interests (a lookalike audience). Meta matches it to its own accounts and discards the rest. Opt out in Communication preferences and we remove you from the next upload; you can also hide our ads in Meta’s ad settings. Nothing in this section is needed to use Hoardsy.
10. International processing
Some providers process information outside the United Kingdom, including in the United States (for example Anthropic, Railway, Resend, Twilio and Meta). We rely on UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or Addendum. Contact us for details of the providers, locations and safeguards relevant to your information.
11. How long information is kept
Information is kept for as long as needed to operate your account, maintain accurate entry and financial records, fulfil prizes, handle disputes, prevent fraud and meet applicable legal obligations. Verification and recovery links expire; financial and audit records may need to remain after an account closes (usually six years, for tax and dispute purposes). Analytics records are deleted 90 days after your last visit. Screenshots sent with a lost-entry claim are deleted after 30 days. The age-check code is kept while needed to stop repeat accounts. Retention depends on the record and purpose. You can ask us for the retention criteria applying to a particular record or request erasure; we will explain any information we must retain.
12. Cookies and local storage
Essential cookies and browser storage support sign-in, security, saved interface choices and recovery of an interrupted checkout. Optional analytics, and the optional Meta box that goes with them, are controlled through Analytics preferences. You can change those choices at any time. Browser controls can remove stored data, although disabling essential storage may prevent sign-in or interrupt a checkout.
13. Your choices and rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Change marketing choices in Communication preferences and analytics choices in Analytics preferences. Essential security, purchase and account-service messages are separate from marketing. We may need to verify your identity before responding to a rights request.
14. Concerns and changes
Contact us through Support or the contact details above if you have a privacy concern. You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We will publish an updated version here when this policy changes and provide additional notice where appropriate.