1. Who we are
Onlast ("Onlast", "we", "us") provides football survival games: Daily Last, a daily survival game played against the same worldwide slate with no league and no pot, and Last One Standing, a Premier League survivor game run by private groups. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), the data controller is Onlast, contactable at support@onlast.football.
2. What this policy covers
How we collect, use, store and protect your personal data when you use Onlast at onlast.football (and any installed/app version), and your rights over that data.
3. The data we collect
- Account data: your email address and display name. Your password is handled by our authentication provider (Supabase) and stored only as a secure hash — we never see or store your plain password.
- Gameplay data: the leagues you join, your gameweek picks, results, standings, and the pot/ledger figures your organiser records. (Onlast only tracks pot figures — see our Terms; we do not process payments.)
- Chat & content: messages, reactions and any league/display names you create.
- Usage & technical data: first-party analytics events (e.g. pages viewed, actions taken), approximate device/browser information (user-agent), and error diagnostics, used to keep the app working and improve it. We use our own analytics — we do not use third-party advertising trackers.
- Communications: emails we send you (e.g. sign-up confirmation, password reset, pick reminders) and delivery status.
We do not collect payment card details, and we do not knowingly collect data from anyone under 18 (see §9).
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Create and run your account and leagues; deliver core gameplay | Performance of a contract (our Terms) |
| Send service emails (confirmation, reset, reminders) | Performance of a contract / legitimate interests |
| Keep the app secure, prevent abuse, debug errors | Legitimate interests |
| Understand usage to improve Onlast (first-party analytics) | Legitimate interests |
| Comply with legal obligations | Legal obligation |
Where we rely on legitimate interests, we've balanced them against your rights; you can object at any time (§7).
5. Who we share it with (processors)
We don't sell your data or share it for advertising. We use a small set of trusted service providers who process data on our behalf under contract:
- Supabase — database, authentication and hosting of your account and gameplay data.
- Netlify — hosting/serving of the web app.
- Cloudflare — DNS and network security for onlast.football.
- Brevo — sending transactional emails.
- TheSportsDB — provides match results only; we send it no personal data.
Some providers may process data outside the UK/EEA; where they do, transfers are protected by appropriate safeguards (e.g. UK/EU adequacy or Standard Contractual Clauses).
We may also disclose data if required by law, or to establish/defend legal claims.
6. Cookies & local storage
Onlast uses your browser's local storage to keep you signed in and remember preferences (e.g. theme, current league). These are essential to the app functioning and are not used for cross-site advertising.
7. Your rights
Under UK GDPR you have the right to: access your data; correct it; erase it ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent where processing is based on consent. To exercise any right, email support@onlast.football — we'll respond within one month. You can delete your account (and associated personal data) from within the app / by contacting us. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
8. How long we keep it
We keep your account and gameplay data while your account is active. If you delete your account or ask us to erase your data, we remove or anonymise your personal data within 30 days, except where we must retain limited information to comply with legal obligations or resolve disputes. Aggregated/anonymised analytics that can't identify you may be kept longer.
9. Age restriction
Onlast is for adults aged 18 or over. It is not intended for and must not be used by anyone under 18. If we learn we hold data on someone under 18, we will delete it.
10. Security
We protect your data with database row-level security (so members only ever see their own league's data), encrypted connections (HTTPS), hashed passwords, and access controls. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
11. Changes to this policy
We may update this policy; we'll post the new version here and update the "last updated" date, and notify you of material changes where appropriate.
12. Contact
Questions or requests: support@onlast.football. Data controller: Onlast.