Privacy Notice
Effective July 18, 2026 · Last updated July 18, 2026
This notice explains how WhoWins ("we", "us", "our"), operator of whowins.dev, handles information when you use our fan-vote website (the "Service"). We designed the Service to work without accounts, names, or email addresses.
Information we collect
- Your selected team when you cast a vote.
- A country code derived from your network (edge-provider header or a fallback IP lookup). We do not store your precise location.
- A one-way cryptographic hash of your IP address and a hash of your browser's user-agent string. We never store the raw IP or full user-agent.
- A signed session cookie used to link your vote to your browser session.
- If you use the contact form: your name, email, subject, and message — only to reply to your request.
What we do not collect
- Accounts, passwords, or user profiles — voting is anonymous.
- Precise geolocation, GPS, or device sensors.
- Advertising-profile identifiers by default. Optional advertising cookies only load after you choose "Accept all" in the consent banner.
- Payment information — we do not process payments.
How we use information
- To count your vote and show global and country-level totals.
- To detect and reduce automated or duplicate voting (anti-abuse).
- To reply to contact-form messages you send us.
- To keep the Service available, secure, and performant.
Cookies
We use two categories of cookies:
- Essential — a signed session cookie for voting and a consent-state cookie. Always on; the site does not work without them.
- Optional — advertising cookies set by third- party ad providers, only if you click "Accept all". You can revoke consent at any time by clearing site data in your browser.
Legal basis (EEA/UK)
- Legitimate interests (GDPR Art. 6(1)(f)) — anti-abuse and Service security.
- Consent (GDPR Art. 6(1)(a)) — optional advertising cookies.
- Legitimate interests — to reply to contact-form messages you send.
Sharing
We do not sell your data. We use a small number of processors to operate the Service: our hosting/edge provider, our database provider, and — if you opt in — an advertising network. Each processes data only to provide their service to us.
Retention
- Aggregate vote data (team, country code, hashed signals) is kept indefinitely to preserve historical results.
- Contact-form messages: up to 24 months, then deleted.
- Session cookies: expire when your browser session ends.
Your rights
Depending on your location (including EEA, UK, and California), you may have rights to access, correct, delete, restrict, or object to processing of personal data, and to data portability. Because votes are anonymous and cannot be tied back to a specific person, these rights primarily apply to contact-form messages. To exercise any right, use our contact form with subject Privacy / data request.
Children
The Service is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children.
International transfers
The Service runs on a global edge network. Non-personal request metadata may be processed in the region closest to you. No personal identifiers are persisted at the edge.
Changes to this notice
We may update this notice as the Service evolves. Material changes will be reflected by updating the "Last updated" date at the top of this page.
Contact
Questions about this notice or your data? Reach us through the contact form. We do not publish a direct email address to reduce spam and to route requests consistently.