Privacy Policy

DRAFT — awaiting product-owner approval. This page has not been reviewed by a lawyer, does not constitute legal advice, and must not be treated as approved legal documentation.

This policy explains how Hockey Uncut CIC (“we”) handles personal data when you use The Hockey Board. It is written around what the service actually does: publishing notices, protecting contact details, and notifying users inside the app.

This document is a draft. The lawful bases and retention periods marked below require confirmation by the product owner before this policy can be treated as final.

Version control

Document version: Draft 2.0.
Last updated: 14 October 2026.
Effective date: to be set when the product owner approves this policy. No approval or effective date has been recorded yet.

Who we are

The Hockey Board is operated by Hockey Uncut CIC, company number 17506388. For UK data protection law, we are the controller of the personal data processed through the service.
Questions or requests about your data can be sent to hockeyuncut@gmail.com, the plain-text address shown on our Contact page.

What information we process

Account information: your email address and display name. Passwords are handled by the hosting platform's authentication service and we never see them.
Profile information you choose to add: a short bio, a broad location and search preferences.
Notice content: titles, descriptions, structured details, dates, broad locations and organisation names you publish.
Protected contact records: the contact details you enter for a notice, stored separately from the notice together with the visibility level you chose for each field.
Reports and moderation records: reports filed about notices, moderation cases and decisions, and audit log entries for administrative actions.
In-app notifications generated about your notices.
Website analytics records held by the hosting platform, and the aggregate Visit Counter described below.

Why we process information, and our lawful bases

This section sets out the activity and the proposed lawful basis under UK GDPR for each one. These are proposals for owner review: they are not final until confirmed, and every basis shown as legitimate interests requires a documented legitimate-interests assessment before approval.
Account creation and authentication — performance of a contract: we need an account to let you post, save and manage notices, and to keep notices attributed to you.
User profiles — performance of a contract: your display name, bio, broad location and search preferences support your use of the service.
Notice publishing and management — performance of a contract: we process notice content, dates and broad locations to publish and manage your listings.
Protected contact information — performance of a contract: you supply contact details so the people you authorise can contact you; the server stores them separately and shows them only at the visibility level you chose.
Safeguarding reports — legitimate interests: safeguarding children and adults at risk who use the service. Where a report indicates an immediate risk to life, vital interests may also apply. Assessment required.
Moderation and account restrictions — legitimate interests: keeping the service safe, lawful and trustworthy, and preventing abuse. Assessment required.
In-app notifications — performance of a contract: notifications about your notices are stored in the app.
Website analytics — legitimate interests: understanding how the service is used so we can maintain and improve it. Analytics are provided by the hosting platform; they are not used to build advertising profiles. Assessment required, including whether consent is required under the UK rules on electronic communications.
Visit Counter — legitimate interests: showing a genuine measure of community engagement and preventing automated inflation of the counter. Assessment required.
Security, fraud prevention and audit logging — legitimate interests: protecting the service, the community and our ability to defend legal claims. Where processing is required by law, the basis is a legal obligation.

Contact information: public and protected details

Public visitors can see notice titles, descriptions, structured details, broad locations, dates and organisation names. They do not need an account to browse.
Registered users can see contact information that the publisher specifically authorised them to see.
For each contact field (name, email, telephone, website, application link) the publisher chooses whether it is hidden, visible to registered users only, or visible to everyone.
These visibility choices are enforced on the server, not just in the screen: hidden and registered-only details are not sent to logged-out visitors, and registered-only details are not sent to users who are not signed in. This has been implemented and inspected in the application, but it has not been independently penetration-tested, and we make no security claim beyond what is described here.
For transparency: every contact field starts as hidden, and the publisher can currently set any field, including a personal email address or telephone number, to fully public. The product owner is considering whether personal email addresses and telephone numbers should be limited to registered-user visibility. No change has been made; the policy will be updated if the rule changes.
Personal contact information must not appear in public notice titles or descriptions. The publishing engine checks this automatically and blocks submissions that include contact details, including disguised versions.
Administrators can view contact details in the course of moderating reports and safeguarding concerns. This access is limited to moderation purposes.

Moderation, reports and restrictions

Registered users can report notices. A report records the notice, the reporting user, the reason and any details provided. Reports are visible to administrators.
Administrators keep moderation cases and an audit log of moderation and account actions. If publishing restrictions are placed on an account, the reason is recorded.
When a decision is made about your notice (approval, rejection, a request for changes, hiding, removal or restoration), we create an in-app notification for you.

In-app notifications

Notifications about your notices are stored inside the application and shown in your notification bell. We do not send operational emails, text messages or push notifications from the service.
System emails required by the platform itself (such as account verification and password resets) are the only emails connected to your account.

Website analytics and cookies

The service is hosted on the Base44 platform. The platform uses essential technologies to keep you signed in and keep the application working, and may collect limited analytics about traffic and in-app events. The application itself adds no analytics code of its own beyond what the platform provides.
These records are not used to build advertising profiles. We do not set advertising or social-media tracking cookies.
Whether the platform's essential technologies and analytics require consent under the UK rules on electronic communications (PECR) is being assessed as part of this review. We do not claim an exemption. If consent is found to be required, a consent interface would need to be added before launch, and nothing will be introduced without the product owner's approval.

Visit Counter

There are three separate things to understand about the counter. First, visits are counted: every qualifying site visit, signed in or not, adds to one cumulative total. Second, an optional welcome pop-up may display your visit number when you arrive. Third, a registered user's preference controls only whether that pop-up is displayed; it does not switch counting off or on.
A qualifying visit is a new browsing session: for a signed-in user, one recorded after a break of 30 minutes or more since their previous visit; for a visitor who is not signed in, one per browsing session. The total is a count of qualifying sessions, not a count of unique people.
The counter uses no cookies. Its only browser storage is a temporary flag for the current browsing session, which stops the same visit being counted twice and stops the welcome message reappearing during the same visit. It holds no personal data or identifiers and is cleared when the browsing session ends.
To stop automated traffic inflating the counter and sponsor click totals, the server keeps a short-lived cooldown key made from a salted one-way hash of the connection address. The hash cannot be reversed, is never linked to an account, and expires within 30 minutes for visit counting and one hour for sponsor clicks.
A hash derived from a connection address is not automatically anonymous: it is still personal data, and we treat it that way. It is never used to identify a person and is not stored beyond the short cooldown window.
What is stored is the single cumulative total and the date counting began. No per-person visit records exist, and nothing links a count to a person.
Whether the counter's processing requires consent under PECR is being assessed as part of this review. Administrators can also switch the counter off platform-wide; if it is unavailable, the welcome message is simply not shown and the rest of the service is unaffected.

Data retention

No fixed retention periods have been configured yet. The periods below describe current behaviour; where a period is not yet decided, it is marked as an outstanding decision for the product owner. We have not invented periods to fill the gaps.
Removing a notice from public visibility is not the same as deleting it. An expired, archived or removed notice stops appearing in public search results, but the underlying record remains so that the publisher can manage and renew it, and so that moderation decisions remain accountable. Deletion removes the record itself.
User accounts: retained while the account exists. You can delete your own account from My Account, which removes your profile, notices, saved notices and notifications. Account deletion can also be requested through the Contact page.
Published notices: retained through their lifecycle (published, fulfilled, expired, archived or removed). Period for deleting expired records: outstanding decision.
Personal contact records: retained with their notice, protected by the visibility settings described above, and removed when the account or notice is deleted.
In-app notifications: retained with the account.
Moderation reports and cases: retained for accountability. Period: outstanding decision.
Safeguarding reports: retained for accountability. Period: outstanding decision, and likely to need specialist advice.
Audit logs: retained for accountability. Period: outstanding decision.
Analytics records: held and managed by the hosting platform. Retention is governed by the platform, whose published retention schedule sits in its Trust Center. Period: outstanding decision.
Visit Counter data: the aggregate total and start date are kept while the counter feature operates. Individual visits are not linked to people. Cooldown keys expire automatically within 30 minutes to one hour.

Hosting, processors and international transfers

The service is hosted on the Base44 platform, which provides the application infrastructure, database, authentication and file storage, and processes data on our behalf under its data processing agreement, which is available for review.
Base44's own documentation states that its servers are currently located in the United States and that app data is stored there; media files and platform account details also remain in the US. On the current arrangement this app's data is therefore stored in, and processed in, the United States.
Where personal information is transferred internationally, Base44's documentation describes vendors as bound by data processing agreements with approved transfer mechanisms such as adequacy, standard contractual clauses or the Data Privacy Framework, where applicable. Base44 publishes its subprocessor list in its Trust Center.
We have not independently audited Base44's subprocessors or safeguards; we rely on and reference Base44's published documentation. This should be confirmed against the Trust Center and the data processing agreement before this policy is approved.
Whether UK or EU data residency should be arranged is an owner decision; Base44 documents residency options on some plans, but this app currently uses the default arrangement.
We do not sell personal data, we do not send marketing communications, and we have not engaged any marketing, advertising or email-sending processors of our own.

Your rights

Under UK data protection law you have rights of access (a copy of your personal data), rectification (correcting inaccurate data), erasure (deleting your data), restriction (limiting how we use it), objection (objecting to processing based on legitimate interests), and data portability where processing is based on consent or contract and is carried out electronically.
Where processing is based on consent, you can withdraw that consent at any time. Withdrawing consent does not affect processing already carried out.
To exercise any right, email hockeyuncut@gmail.com, the plain-text address shown on our Contact page. Please describe what you are asking for; we will respond within the timescales required by law.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Changes to this policy

We will publish any changes to this policy on this page, with the version and date shown at the top. The version history above records when the document was last updated.

The Hockey Board is operated by Hockey Uncut CIC. Company number 17506388.