1. Who we are
ScoreCircle is a free Premier League predictions and fantasy football game, available at sc.nokih.com. It is operated by nokih.com, a company based in Leeds, England, UK.
For the purposes of UK GDPR and the Data Protection Act 2018, nokih.com is the data controller. If you have any questions about how we handle your data, contact us at hello@nokih.com.
2. What personal data we collect
We only collect data that is necessary to run ScoreCircle. Here is a full list of every category we collect and the specific data points within it.
| Category | Data points |
|---|---|
| Account data | Email address, display name, hashed password (we never store plain-text passwords), optional profile picture |
| Prediction data | Score predictions you submit, competition entries, points history, gameweek scores |
| Circle / league data | Circle name, your membership of Circles, invitation links you have created or used |
| Usage data | Pages visited, features used, time on site, device type, browser type (collected via analytics, only with consent) |
| Analytics data | Anonymised IP address (truncated by GA4 before storage), session data, referring URL — only if you accept analytics cookies |
| Communications | Emails sent to you: welcome email, score results, prediction reminders, account notifications |
We do not collect any special category data under UK GDPR Article 9 (no health, racial, political, religious, or biometric data). We do not process payment data — ScoreCircle is entirely free to use.
3. How and why we use your data
Every use of your data has a lawful basis under UK GDPR Article 6.
| Purpose | Lawful basis |
|---|---|
| Providing the service — creating your account, storing predictions, running Circles and leaderboards | Contract (Art. 6(1)(b)) — necessary to deliver the service you signed up for |
| Sending service emails — welcome messages, score results, prediction reminders | Contract (Art. 6(1)(b)) |
| Improving the app — understanding which features are used and how to make ScoreCircle better | Legitimate interests (Art. 6(1)(f)) — we have a genuine interest in a good product; this does not override your rights |
| Analytics via Google Analytics 4 / GTM | Consent (Art. 6(1)(a)) — only loaded after you accept analytics cookies via our cookie banner |
| Marketing emails (if introduced in future) | Consent (Art. 6(1)(a)) — we will ask separately before sending any marketing |
| Legal compliance and fraud prevention | Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f)) |
4. Cookies and tracking
We use cookies and similar browser-storage technologies (such as localStorage). A cookie consent banner is shown on your first visit so you can choose which categories to allow.
- Essential cookies — keep your session active and store your cookie choice. These run regardless of consent because they are technically necessary.
- Functional cookies — remember in-app display preferences (e.g. pitch orientation). Only stored if you accept functional cookies.
- Analytics cookies — Google Analytics 4 via GTM (
GTM-TG4ZRX2P). Only loaded after you accept analytics cookies.
Full details — including a cookie-by-cookie table — are in the Cookie Policy section below. You can update your choices at any time:
5. Who we share your data with
We do not sell personal data. We do not share data with advertisers. We share data only with the processors required to run the service.
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | App hosting, database (DynamoDB), serverless compute (Lambda), storage | eu-west-2 — London, UK | UK GDPR-compliant data processing agreement; data stays in the UK |
| Google LLC (GA4 / GTM) | Website analytics — only with your consent | United States | UK-US Data Bridge (adequacy decision, October 2023) — see section 6 |
| AWS Simple Email Service (SES) | Transactional emails — results notifications, account emails | eu-west-2 — London, UK | UK GDPR-compliant data processing agreement |
6. International transfers
Your account data, predictions, and Circle data are stored on AWS in the eu-west-2 (London) region — this is within the UK and involves no international transfer.
If you accept analytics cookies, anonymised usage data is processed by Google Analytics, which may transfer data to the United States. This is covered by the UK-US Data Bridge — an adequacy decision made by the UK government in October 2023, meaning the ICO has confirmed that the US provides an adequate level of data protection for transfers under this framework. In plain English: we have a lawful basis to send analytics data to Google in the US.
If you reject analytics cookies, no data is transferred to Google.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Active account data (email, name, profile) | While your account is active |
| Prediction history and points | While account is active, plus 12 months after a deletion request (in case of dispute) |
| Analytics data (GA4) | 14 months — GA4 default. After this period Google automatically purges user-level data. |
| Email logs (sent messages) | 90 days, then deleted |
| Deleted accounts | Fully purged within 30 days of receiving a verified deletion request |
8. Your rights under UK GDPR
You have eight data protection rights. To exercise any of them, email hello@nokih.com. We will respond within 30 days at no charge for reasonable requests.
Right of access (Subject Access Request)
You can ask us for a copy of all personal data we hold about you.
Right to rectification
You can ask us to correct any inaccurate or incomplete data we hold about you.
Right to erasure ("right to be forgotten")
You can ask us to delete your personal data. We will comply unless we have a legal obligation to retain it.
Right to restriction of processing
You can ask us to pause processing your data — for example, while you contest its accuracy — without deleting it.
Right to data portability
Where we process your data by automated means on the basis of contract or consent, you can ask us to provide it in a machine-readable format.
Right to object
You can object to processing based on legitimate interests. We must stop unless we can demonstrate compelling grounds that override your rights.
Rights related to automated decision-making
You have the right not to be subject to decisions made solely by automated means that have a significant effect on you. ScoreCircle does not use automated decision-making of this kind.
Right to withdraw consent
Where processing is based on consent (e.g. analytics cookies), you can withdraw that consent at any time — use the cookie settings button above, or in the footer. Withdrawal does not affect the lawfulness of processing before the withdrawal.
9. Right to complain to the ICO
If you believe we have not handled your personal data correctly, please contact us first at hello@nokih.com — we will do our best to resolve any concern quickly.
If you remain unhappy, you have the right to lodge a complaint with the UK's supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Complaint form: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
10. Children
ScoreCircle is intended for users aged 13 and over. We do not knowingly collect or process personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately at hello@nokih.com and we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. We will notify you of material changes by email or by an in-app notice before they take effect. The “Last updated” date at the top of this page will always reflect the most recent revision.
Continuing to use ScoreCircle after a material change takes effect constitutes acceptance of the revised policy.
12. Contact us
For any questions about this policy or your personal data:
- Operator: nokih.com
- Email: hello@nokih.com
- Response time: within 30 days
Cookie Policy
This section explains exactly which cookies and similar technologies ScoreCircle uses, why, and how to control them. It forms part of the Privacy Policy above.
What are cookies?
Cookies are small text files that a website places on your device when you visit. They are widely used to make websites work, remember your preferences, and provide information to site owners about how their site is used. ScoreCircle also uses browser localStorage (a similar technology) for some purposes — these are treated the same as cookies for PECR purposes.
Cookies we use
| Name / key | Category | Purpose | Duration | Set by |
|---|---|---|---|---|
sc_consent | Essential | Stores your cookie consent choices so the banner does not reappear on every visit | 1 year | ScoreCircle |
sc_auth_token | Essential | Keeps you signed in to your account during a session | Session / until sign out | ScoreCircle |
sc_pitch_view | Functional | Remembers your preferred pitch orientation (vertical or horizontal) | Until cleared | ScoreCircle (with consent) |
sc_match_view | Functional | Remembers your preferred match display mode | Until cleared | ScoreCircle (with consent) |
_ga | Analytics | Google Analytics — distinguishes unique visitors using an anonymous client ID | 2 years | Google (with consent only) |
_ga_* | Analytics | Google Analytics 4 — maintains session state | 2 years | Google (with consent only) |
| GTM cookies | Analytics | Google Tag Manager (GTM-TG4ZRX2P) — manages tag loading | Various | Google (with consent only) |
How to manage cookies
You have several ways to control cookies:
- Cookie settings panel— update your choices at any time using the button below, or via the “Cookie Settings” link in the footer.
- Browser settings— most browsers let you block or delete cookies. See your browser's help: Chrome, Firefox, Safari, Edge.
- Google Analytics opt-out — install the Google Analytics opt-out browser add-on.