1. Who we are
Onlast ("Onlast", "we", "us") provides football survival games: Daily Last, a daily survival game played against the same worldwide slate with no league and no pot, and Last One Standing, a Premier League survivor game run by private groups. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), the data controller is Onlast, contactable at support@onlast.football.
2. What this policy covers
How we collect, use, store and protect your personal data when you use Onlast at onlast.football (and any installed/app version), and your rights over that data.
3. The data we collect
- Account data: your email address and display name. Your password is handled by our authentication provider (Supabase) and stored only as a secure hash — we never see or store your plain password.
- Guest play (temporary accounts): you can start playing without signing up. When you do, we create a temporary, anonymous account with no email, name or password. The games you play — across Daily Last, Gauntlet and any future Onlast mini-game — are saved to that one temporary account, so your progress is only reachable from the browser you played on until you save it. When you choose Save my progress and add an email and password, that same temporary account becomes your full account in place: nothing is copied or re-created, so you keep everything you have played, and it is then available on any device you sign in on. An unconverted temporary account is deleted automatically — see “How long we keep it”.
- Gameplay data: the leagues you join, your gameweek picks, results, standings, and the pot/ledger figures your organiser records. (Onlast only tracks pot figures — see our Terms; we do not process payments.)
- Chat & content: messages, reactions and any league/display names you create.
- Usage & technical data: first-party analytics events (e.g. pages viewed, actions taken), approximate device/browser information (user-agent), and error diagnostics, used to keep the app working and improve it. We use our own analytics — we do not use third-party advertising trackers.
- Communications: emails we send you, including account confirmation, password reset and pick reminders, together with delivery status. If you choose to receive marketing emails, we also keep your marketing-email preference, when and where you made that choice, the wording you agreed to, and any unsubscribe, complaint, bounce or block needed to honour your preference.
We do not collect payment card details, and we do not knowingly collect data from anyone under 18 (see §9).
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Create and run your account and leagues; deliver core gameplay | Performance of a contract (our Terms) |
| Send service emails (confirmation, reset, reminders) | Performance of a contract / legitimate interests |
| Send optional emails about new Onlast games, features and launches | Consent |
| Keep the app secure, prevent abuse, debug errors | Legitimate interests |
| Understand usage to improve Onlast (first-party analytics) | Legitimate interests |
| Comply with legal obligations | Legal obligation |
Marketing emails are optional and separate from account, security and deadline-reminder messages. Choosing not to receive marketing does not affect your Onlast account or gameplay. You can withdraw your consent at any time in Account Preferences or through the unsubscribe link in any marketing email.
Where we rely on legitimate interests, we've balanced them against your rights; you can object at any time (§7).
5. Who we share it with (processors)
We don't sell your data or share it for advertising. We use a small set of trusted service providers who process data on our behalf under contract:
- Supabase — database, authentication and hosting of your account and gameplay data.
- Netlify — hosting/serving of the web app.
- Cloudflare — DNS and network security for onlast.football.
- Brevo — sends Onlast's transactional emails and, only where you have chosen to receive them, marketing emails. We share the minimum information required to deliver the message. Brevo also reports delivery, unsubscribe, complaint, bounce and block events so we can honour your choices and protect our sender reputation.
- TheSportsDB — provides match results only; we send it no personal data.
We do not send Brevo your league name, picks, supported clubs, results or Daily Last run history for marketing-email delivery.
Some providers may process data outside the UK/EEA; where they do, transfers are protected by appropriate safeguards (e.g. UK/EU adequacy or Standard Contractual Clauses).
We may also disclose data if required by law, or to establish/defend legal claims.
6. Cookies & local storage
Onlast uses your browser's local storage to keep you signed in and remember preferences (e.g. theme, current league). These are essential to the app functioning and are not used for cross-site advertising.
Onlast already records the limited first-party usage data described under “Usage & technical data” above, regardless of any choice made here. Beyond that and the essential storage above, Onlast does not currently use optional analytics or advertising services, and nothing from one of those loads before you choose. If this changes, you will be asked first. You can review and change that choice at any time in Cookie preferences, in the footer of every page.
At launch, Onlast does not use individual email-open or link-click activity to profile you, target future marketing or automate follow-up messages. If this changes, we will explain the tracking clearly and obtain any consent required before enabling it.
7. Your rights
Under UK GDPR you have the right to: access your data; correct it; erase it ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent where processing is based on consent. To exercise any right, email support@onlast.football — we'll respond within one month. You can delete your account (and associated personal data) from within the app / by contacting us.
You have an absolute right to object to the use of your personal data for direct marketing. You can stop marketing email through Account Preferences or the unsubscribe link in any marketing message, without signing in. We will action that choice without affecting deadline reminders or service messages you still need.
You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
8. How long we keep it
We keep your account and gameplay data while your account is active. If you delete your account or ask us to erase your data, we remove or anonymise your personal data within 30 days, except where we must retain limited information to comply with legal obligations or resolve disputes. Aggregated/anonymised analytics that can't identify you may be kept longer.
A temporary guest account (see “Guest play” above) that is never saved is deleted automatically after 30 days without a genuine play — a submitted pick or entry in any Onlast game — and the progress tied to it is deleted with it. Saving the account (adding an email and password) turns off this automatic deletion; from then on it is an ordinary account, kept while it is active and removed only when you ask. This 30-day inactivity window is separate from the erasure window above, which applies after you ask us to delete an account.
We retain marketing-consent evidence while we rely on it and keep the minimum suppression record needed to ensure we do not email an address that has unsubscribed, complained, hard-bounced or been blocked. A suppression record is not used to send marketing or rebuild an audience.
9. Age restriction
Onlast is for adults aged 18 or over. It is not intended for and must not be used by anyone under 18. If we learn we hold data on someone under 18, we will delete it.
10. Security
We protect your data with database row-level security (so members only ever see their own league's data), encrypted connections (HTTPS), hashed passwords, and access controls. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
11. Changes to this policy
We may update this policy; we'll post the new version here and update the "last updated" date, and notify you of material changes where appropriate.
12. Contact
Questions or requests: support@onlast.football. Data controller: Onlast.