Privacy Policy

Last updated August 30, 2026

dwwt (“Did we win today?”, the “Service”, “we,” “us,” “our”) is an independently run site. This policy explains what the site stores, why, and what leaves it. It is written to describe what the software actually does.

1. Using dwwt without an account

Scores, schedules and team pages are public. Signed out, we keep a few things in your browser:

• A time zone value, so kickoff times and “today” mean your today rather than ours.
• A theme preference (light or dark), stored in your browser and never sent to us.
• The last few team pages you viewed (up to eight), so the team picker can suggest them when you create an account. The picker sends that list to us to look the teams up; we do not store it.

Our servers keep ordinary web server logs, which include IP addresses, for operating and securing the site.

2. What an account stores

2.1 Account and sign-in

• Email address, whether you have confirmed it, display name, an optional username, and a password hash if you set a password. We never store your password itself. We ask you to confirm the address by clicking a link we email you; until you do, the account still works, but we cannot be sure a reset link will reach you.
• Sign-in links, if you ask for one instead of using a password: a single-use code, stored only in scrambled (hashed) form, that expires after 15 minutes.
• Sessions, each recording the IP address and browser user agent that created it, so you can review and revoke your own sign-ins.
• Two-factor secrets and backup codes, if you switch two-factor authentication on.

2.2 What you choose

• Followed teams and athletes.
• Preferences: your start page, which leagues you hide from Games Today, and whether alerts include scores.

2.3 Notifications, calendar and API

• Push subscriptions: the endpoint your browser issues, its encryption keys, the browser user agent, and the time zone your device reports, so an alert can name a kickoff in your local time. We also record which alerts were sent, so the same game is never announced twice.
• A calendar token, if you subscribe to your fixtures, and an API token, if you create one. Each is a random value that identifies your feed. Anyone holding one can read that feed, which is why both can be reset at any time.

2.4 A small activity log

We record events such as sign-in, sign-up, adding or removing a favourite, saving preferences, sending an alert, calendar feed fetches, and whether an account email (a confirmation or reset link) went out. These exist to operate and debug the service. They are not used to build a profile of you and are not shared.

3. What we do not collect

• No advertising identifiers, ad networks, or third-party analytics.
• No payment details. dwwt is free and takes no payments.
• No location data beyond the time zone your browser reports.
• No contact list, calendar contents, or anything from other apps.

4. Where your data goes

We use a small number of third-party providers to run the service. We describe them by what they do rather than by name, because those choices change and a policy naming last year's vendor would be worse than one that does not:

• Hosting and database providers, which store the data described above on our behalf.
• An email provider, for confirming your address, sign-in links, password resets and the notice we send after one, and replying to messages you send us.
• Your browser's push service, if you turn alerts on. Your browser chooses it, not us: it issues an endpoint and we send the notification text there. With scores switched off, that text does not contain the result.
• Font, icon and image providers, whose files your browser fetches directly to render the page, including team crests and photographs. As with any embedded resource anywhere on the web, those requests reveal your IP address and rough location to whoever serves them. That happens in your browser, not on our servers.

Scores and schedules come from third-party sports data sources. Those are requests we make outbound for public sports information. Nothing about you is sent to them.

We do not sell personal information, and we do not share it for advertising. We may disclose information if legally required, or to protect the service against abuse.

5. Keeping and deleting

We keep your data while your account exists. A session ends when you sign out, when your password is reset, or after 60 days without a visit. A push subscription is deleted automatically once your browser reports it is no longer valid, and it is deleted when that device is signed out by Sign out everywhere else, or by a password reset (which signs out every device). You can remove any favourite, reset either token, or turn alerts off at any time from Settings.

To delete your account and everything attached to it, use Delete account in Settings. It removes your account, favourites, calendar and API tokens, alert subscriptions and the event log entries tied to you, straight away. You can also write to us and we will do it for you.

6. Your choices

• Notifications can be switched off in Settings, or revoked in your browser or operating system.
• Calendar and API tokens can be reset, which immediately breaks anything using the old one.
• Access, correction and deletion: in Settings, Download my data gives you a copy of what your account holds, Change sign-in email corrects your address, and Delete account removes everything. For anything else, write to us and we will help. Depending on where you live you may have additional rights under laws such as the GDPR or CCPA; we apply the same practices to everyone.

7. Children

dwwt is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

8. Security

Passwords are hashed, traffic is encrypted in transit, and two-factor authentication is available. No service can promise perfect security, and we will not pretend otherwise.

9. Changes

If this policy changes materially we will update the date above. Continued use after a change means you accept the revised policy.

10. Contact

Questions about this policy: contact us or email hello@didwewintoday.com.