Privacy Policy

This policy explains what personal information GOATWOAT collects, why we collect it, and what rights you have over it. We’ve kept it in plain English. In short: we collect as little as we can, we never sell it, and we protect what we hold with strong encryption.

1. Who we are

GOATWOAT (“we”, “us”) runs the website at www.goatwoat.com. For data-protection law we are the data controller for the personal information described here.

• Controller: GoatWoat Services
• Contact for any privacy question or request: privacy@goatwoat.com

2. The information we collect

• Account details you give us: your handle (a public display name), your email address and a password.
• Content you create: the lists, entries, descriptions and images you add, and the votes and head-to-head verdicts you cast. Anything you choose to make public, including your handle, is visible to everyone.
• Technical information: your IP address and basic request details, which our systems use briefly to keep the site secure and prevent abuse. As with any website, our hosting provider also keeps standard server logs.
• A single sign-in cookie so we can remember you’re logged in (see section 4).

We do not use analytics, advertising, tracking pixels or social-media trackers, and the site makes no third-party requests when it loads.

3. Why we use it, and our legal basis

• To provide your account and the service (create lists, vote, sign in): our contract with you.
• To email you a one-time sign-in code: part of delivering the service you asked for.
• To keep the site secure, prevent abuse and rate-limit requests (using your IP address): our legitimate interest in running a safe, working service.
• To meet a legal obligation if we ever must (for example, responding to a lawful request): compliance with the law.

We don’t use your data for marketing, and we make no automated decisions that have a legal or similarly significant effect on you.

4. Cookies and local storage

We use one strictly necessary cookie, ra_session, to keep you signed in. It isn’t used for tracking and is only set once you log in. Because it’s essential to a service you’ve asked for, it doesn’t require a consent banner.

Your browser also keeps a little information on your device (in “local storage”) to remember you and to cache lists so pages load faster. This is functional only, never advertising or cross-site tracking, and clearing your browser storage removes it.

5. Who we share it with

We don’t sell or rent your personal information to anyone. We share it only with the service providers (“processors”) that make GOATWOAT work, and only as far as needed:

• Bunny.net — our hosting, database and content-delivery provider (based in the EU). Stores the site and its data.
• Resend — our email provider (based in the USA). Delivers your sign-in codes. This means your email address is processed in the USA; that transfer is covered by the provider’s standard safeguards (Standard Contractual Clauses / the EU–US Data Privacy Framework).

Each provider is bound by a data-processing agreement to protect your data and use it only on our instructions.

6. How long we keep it

• Your account: for as long as it’s open. When you delete it (Profile → Account → Delete account) we erase your personal details (your email and password). As set out in our Terms, the lists you created and the votes on them are kept but re-attributed to “Anonymous”, so they can no longer be linked to you.
• Sign-in codes: they expire within minutes and are then useless.
• Security / rate-limit records tied to your IP: kept only for a short rolling window, then automatically discarded.
• Hosting server logs: retained by our provider for a limited period under their standard practice.

7. How we protect it

Security is built in, not bolted on:

• Your password is stored only as a strong, one-way “hash” (PBKDF2, 600,000 iterations). It can never be turned back into your password, by an attacker or by us.
• Your email address is encrypted at rest (AES-GCM), with a key kept outside the database. If our records were ever stolen, your address would be unreadable.
• The whole site runs over HTTPS.
• We collect as little personal data as we can in the first place.

8. Your rights

Under UK and EU data-protection law you can: get a copy of your data; correct it; delete it (the “right to be forgotten”); restrict or object to certain uses; and ask for a portable copy. You can delete your account yourself at any time from your Account page, or email privacy@goatwoat.com for any of the above and we’ll respond within one month.

If you’re unhappy with how we handle your data, you can complain to your data-protection authority. In the UK that’s the Information Commissioner’s Office (ico.org.uk).

9. Children

GOATWOAT isn’t intended for children under 13, and we don’t knowingly collect their data. If you believe a child has given us personal information, contact us and we’ll remove it.

10. Changes to this policy

If we change this policy we’ll update the date above and, for significant changes, let you know in the app.