Privacy policy

This policy explains what personal data Lexica collects when you use the tournament features at vowelmovement.fun/lexica, why we collect it, and what rights you have over it. Lexica is part of Vowel Movement and is run by the same team. The free game at the root of the site is covered by the main privacy policy — this page only covers the paid Lexica features.

Who is the data controller

Vowel Movement is the controller for the personal data described here. You can reach us at support@vowelmovement.fun.

What we collect and why

We split users into two groups, because the data flow is different:

Organisers (people who subscribe)

• Account details — your email address and first name, provided when you sign in via Clerk. Used to identify you as the organiser of any tournaments you create.
• Billing data — handled by Stripe. We store the Stripe customer ID against your account; we do not store your card details. Stripe is the payment processor and sends us subscription status updates by webhook.
• Tournaments you create — name, optional end date, status, configuration, and the rosters and game results that build up over time.

Lawful basis: performance of a contract (your subscription) and our legitimate interest in operating the service.

Players (people who join a tournament)

• Username — visible on the leaderboard. Choose something you're happy for the rest of the team to see.
• Cookie identifier — a random ID we set in your browser (vm-lexica-client-id) so we recognise you on return visits. It is not linked to anything outside this service.
• Game scores — your scores and finishing positions in tournament games, attached to your username.
• Email address (optional) — only if you choose to add one when joining, so we can email you a magic link if you lose access. We never use it for marketing.

Lawful basis: legitimate interest in running the leaderboard, plus your consent for the optional email.

Cookies and similar technologies

See the cookies page for the full list. In short: we use a small number of strictly necessary cookies and browser storage to keep you signed in, identify you on the roster, and keep your username between visits. Optional analytics cookies are only set after you consent to them.

Who we share your data with

We do not sell your data. We use the following processors to run the service:

Each of these processors has its own published privacy notice. Where data leaves the UK or EEA, the transfer is covered by Standard Contractual Clauses or an adequacy decision.

How long we keep data

• Active organiser accounts: for as long as the subscription is active, plus 30 days after cancellation so you can resume without losing the data.
• Tournaments: kept until the organiser deletes them, or until 12 months after the organiser's account is closed, whichever comes first.
• Roster + scores: tied to the tournament. Deleted with it.
• Recovery emails / tokens: tokens expire after 30 minutes; the email address itself is removed when the player's row is deleted.
• Stripe records: kept by Stripe according to their retention policy. We can't delete them on demand because we're legally required to retain payment records for tax and accounting purposes (typically 6 years in the UK).

Your rights under UK GDPR

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct anything that's wrong
• ask us to delete data we hold about you
• ask us to restrict or stop using it
• object to processing based on legitimate interest
• port your data to another service
• withdraw consent at any time (where consent was the basis)

To exercise any of these, email support@vowelmovement.fun. If you joined a tournament anonymously, include the tournament link and the username you used so we can find your record. We'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Children

Lexica is not aimed at children under 13. If you become aware that a child has provided personal data without consent, please contact us and we'll remove it.

Security

Data in transit is encrypted with TLS. Stored data is encrypted at rest by our processors. We use access controls and limit who on the team can read production data.

Changes

If we change this policy in a way that materially affects how your data is handled, we'll update the date at the top and, where relevant, contact organisers by email.