Privacy

Last updated 17 October 2026

Spot On is a free prediction game. You do not need an account to play. We keep as little as we can, and never sell or share it.

On your device

Your display name, a random player ID, a session token that signs this device in, the list of pools you are in, your rival choices and settings are kept in your browser's local storage. Clearing site data removes them.
If you install Spot On to your home screen, a small service worker is installed. It only handles reminder notifications and does not cache or read your data.

Sent to our server

Display name. The name you type. Other members of your pools see it on the table and, after kick-off, next to your picks.
Pools and predictions. Which pools you are in, your predictions and points, and, if you organise a pool, its name, points settings, any entry fee and prize amounts you enter and who you mark as paid. Your picks for a game are shown to your pool only after that game kicks off.
Session tokens. Each device you sign in on gets its own random token. We store only a one-way hash of it, with when it was created and last used, so we can tell your device is you. Restore codes and sign-in links are also stored only as hashes and expire (60 and 30 minutes) after one use.
Email sign-in (optional). If you add an email, it is stored with your account so you can sign in on another device and use the same login in our other games (Cluster, Rankle and Letterly). The sign-in email, with a link and a 6-digit code, is sent through Brevo. Skip it and no email is ever collected. Other players never see your email.
Reminders (optional). If you turn on reminders, your browser's push address and its browser name and version are stored so the notification can be sent. Turning reminders off ends the subscription in your browser, and we delete the stored address as soon as the push service reports it has ended.
Where you came from. Spot On does not record which website sent you. If you also play Cluster or Rankle with the same sign-in, those games store the site name that first sent you there (for example listdle.com), never full links or IP addresses.

Your IP address is used briefly in memory to rate-limit abuse and is not stored by Spot On. We get private notifications (for example when a pool is created or a result is in) that can include pool names, display names and the country a sign-in came from (read from the connection, not stored); they never include emails.

Analytics

Google Analytics runs only if you press Accept on the cookie banner. It counts visits with IP addresses masked. Decline and it never loads.

Removing your data

A pool organiser can remove a member, which deletes that member's picks in the pool, and can archive the pool.
To delete your whole account (name, email, pools you are in, predictions, tokens and reminder subscriptions), email [email protected] with your display name and, if you added one, your sign-in email. We will confirm once it is done.

Who runs Spot On

Spot On is made by cyber-jack, a small UK studio. Data is held on our own server in the UK. Questions: [email protected].