Privacy Policy

Last updated: 8 August 2026

Operator note (delete before launch): this policy is drafted to match how tugofwar.day actually processes data, but the [BRACKETED] fields must be completed and the whole document reviewed by a solicitor before you rely on it — you take real payments, which raises the stakes.

This policy explains what personal data The Daily Tug ("we", "us") collects when you use tugofwar.day, why we collect it, and the rights you have over it. It is written to meet the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), as updated by the Data (Use and Access) Act 2025.

1. Who we are

The Daily Tug is operated by [OPERATOR LEGAL NAME] [trading as The Daily Tug, if applicable], based in the United Kingdom.

For any privacy question or to exercise your rights, contact us at [privacy@tugofwar.day][ and postal address, if you choose to publish one].

[If you are registered with the ICO as a data controller, state your registration number here. Most UK organisations that process personal data must pay the ICO data protection fee — check ico.org.uk.]

2. The data we collect and why

a) When you play

To run the game and stop one person counting many times, we store a random session identifier (tug_sid) in your browser's local storage and read it back on each visit. Under the Data (Use and Access) Act 2025 this browser storage is in scope of PECR; we rely on it as strictly necessary to deliver the game you asked for (session management), so it is set without consent. It is a random value, not your name.

b) Approximate location

Our network provider (Cloudflare) derives an approximate country and continent from your IP address so we can show where a battle's pulls came from. We use the country/continent; we do not store your full IP address for analytics. Your IP address is briefly processed by our hosting providers to deliver and secure the site.

c) When you pay

Paid pulls and battle purchases are handled by Stripe. Stripe collects your card details directly — we never see or store your card number. We keep a record of the transaction (amount, what it was for, a payment reference, and the session it related to) so we can provide the service, prevent fraud, and meet our accounting obligations.

d) When you create an account [once accounts launch]

If you register, we store your email address and a securely hashed password (we never store your password in readable form), plus account activity such as your credit balance, purchases, and battles you submit. We use your email to verify your account, let you reset your password, and send service messages about your account.

e) Cookies and similar technologies

We use a small number of strictly necessary storage items to run the site and remember your cookie choices. We do not run analytics, advertising, or tracking technologies unless you opt in through our cookie banner. See our Cookie Policy for the full list and your controls.

3. Lawful bases

What	Why	Lawful basis (UK GDPR)
Session id, running the game	Deliver the service you requested	Legitimate interests / performance of a contract
Country/continent for battle stats	Show aggregate engagement	Legitimate interests
Payments & records	Provide paid features; prevent fraud; keep accounts	Contract; legal obligation
Account & email [when live]	Create and secure your account	Performance of a contract
Optional analytics/marketing	Understand and improve the site	Consent (you can withdraw any time)

4. Who we share it with

We do not sell your data. We share it only with the providers that make the service work, acting as our processors under contract:

Cloudflare — hosting, content delivery, and security.
Neon — the database that stores battle and account records.
Stripe — payment processing.
[Your email provider, e.g. Resend/Postmark — add once chosen] — sending verification and password-reset emails.

Some of these providers may process data outside the UK. Where they do, transfers are covered by appropriate safeguards such as the UK International Data Transfer Agreement or an adequacy decision.

5. How long we keep it

We keep data only as long as we need it: session identifiers are short-lived; battle statistics are kept in aggregate; payment and accounting records are kept for [6 years] to meet UK tax law; account data is kept until you delete your account, after which it is removed or anonymised within [30 days], except where we must keep transaction records.

6. Your rights

Under the UK GDPR you have the right to access your data; to have it corrected; to have it erased; to restrict or object to processing; to data portability; and, where we rely on consent, to withdraw that consent at any time. You can object to processing based on our legitimate interests — we will bring this to your attention clearly and separately. To exercise any right, contact us at [privacy@tugofwar.day]. We will respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to put things right first.

7. Children

The Daily Tug is not directed at children under [13/16 — decide] and we do not knowingly collect their data. [If you knowingly serve minors, additional protections and parental-consent rules apply — take advice.]

8. Changes

We may update this policy. We will change the "last updated" date above and, for significant changes, tell you on the site.