WeChant Privacy Policy

Effective date: 9 July 2026 Last updated: 4 August 2026

Who we are

WeChant is a football chants platform operated by Corin Morrissey (sole trader), trading as WeChant. When we say "we," "us," or "WeChant" in this policy, we mean this operation.

We are based in the United Kingdom, and this policy is written under UK data protection law — the UK GDPR and the Data Protection Act 2018.

For any questions about this policy or your personal data: [email protected].

1. What this policy covers

This policy explains what personal data WeChant collects when you use our website and app at wechant.app, why we collect it, how we look after it, and what rights you have.

If you don't have an account and you're just browsing the website, we collect only the minimum needed for the site to work (see "Cookies" below).

2. What data we collect

Account data (when you sign up):

Your email address
A password (stored as a one-way hashed value — we never see or store your plain-text password)
A display name of your choice
Your date of birth (used to confirm you meet our minimum age requirement)

If you sign up or sign in with Google:

We receive your verified email address and your name from Google (your name becomes your display name, which you can change). We do NOT receive or store a password for Google accounts, and we do NOT collect your Google profile picture or any other Google profile data.

Content you create:

Audio recordings (chants) you upload
Text you write: chant titles, lyrics, descriptions, tune references, composer credits
Setlists you build
Votes you cast on other users' chants and setlists
Reports you file against chants you believe violate our rules

How you use WeChant (interaction data):

Which chants you play, skip, save, and share
How long you spend on a chant before moving on (dwell time)
Votes you cast (also listed above under content)
The text of searches you run in Explore We use this to power personalised chant recommendations (see "Why we collect this data" below). It is linked to your account and automatically deleted after 12 months.

Match presence data (only if you use the "at the ground" check-in feature):

We store the fact that you were at a specific stadium for a specific match ("checked in at Craven Cottage for Fulham v Arsenal on [date]")
We do NOT store your raw GPS coordinates. Your device provides its location to your browser at the moment of check-in for verification against the stadium's known coordinates, but that raw location data is not stored on our servers.

Activity data:

Reputation points (RP) you have earned, and the events that produced them
Matchday streak history
Whether your chants have been approved by the community
Whether your account has been actioned by moderators

Preferences you tell us (during the welcome setup):

The sports you follow and your primary sport
Your club affiliation
Your country These help us tailor what you see. They are optional and you can change them later.

Technical data collected automatically:

Your IP address — captured in short-term server-side security logs for rate limiting and abuse prevention. Not linked to your account identity, not shared with third parties, not used for tracking, profiling, advertising, or analytics. Retained a maximum of 90 days, then automatically discarded.
Basic device and browser information via standard web logs
Session cookies for keeping you logged in

3. Why we collect this data (legal basis)

Under UK GDPR, we need a legal basis for each type of processing. Ours are:

Account data (email, password, display name, date of birth) — under contract (we cannot provide the app without knowing who you are and authenticating you), and, for date of birth, legal obligation / legitimate interest (enforcing our minimum age requirement)
Content, activity data, votes, chants, setlists — under contract (creating and sharing chants is the app's core purpose)
Match check-in data (stadium + match, no raw coordinates) — under contract (a feature you actively opt into by tapping "I'm at the ground")
Interaction data and preferences (plays, skips, dwell time, saves, shares, search text, and the sports/club/country you tell us) — under legitimate interest (UK GDPR Art. 6(1)(f)), to personalise your experience and recommend chants we think you'll like. You can object to this at any time (see "Your rights") — email us and we'll stop using your activity for recommendations.
Technical data (IP, device, session cookies) — under legitimate interest (security, fraud prevention, abuse rate limiting)
AI content moderation — under legitimate interest (protecting the WeChant community from harmful content)

We use your activity to personalise WeChant and recommend chants — but we do NOT build advertising or marketing profiles, we do NOT run targeted advertising, and we do NOT sell your data to anyone.

We only send transactional email — verification links, password resets, and notifications about your own activity. We do not send marketing newsletters or promotional emails.

4. Third-party providers who help us run WeChant

To operate WeChant, we use the following third-party providers. Each processes data on our behalf under a data processing agreement, and only for the specific purpose noted:

Provider	Location	What they handle
Cloudflare Inc	United States	DNS, edge network, inbound email routing ([email protected])
Resend Inc	United States	Outbound transactional email delivery
Anthropic PBC	United States	AI content moderation (Claude API screens chant text for slurs, threats, and discriminatory content)
Google LLC	United States	Sign-in with Google (verified email + name) for users who choose that option
Abacus.AI	United States	Application hosting and deployment infrastructure
Amazon Web Services (indirectly, via Resend)	United States	Underlying email delivery infrastructure

These providers only receive the data needed for their specific job — they cannot use your data for their own purposes.

5. International data transfers

All of the providers listed above are based in the United States. When your data reaches them, it is transferred outside the United Kingdom.

We rely on the following ICO-recognised safeguards for these transfers:

UK International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU Standard Contractual Clauses (SCCs) — the standard approved contract terms that each provider commits to
The UK-US Data Bridge (where the provider is certified under the equivalent US framework)

These are the standard, ICO-recognised legal mechanisms for UK-to-US personal data transfers.

6. How long we keep your data

Account data, content, votes, reputation, activity — kept for as long as your account exists
Interaction data used for recommendations (plays, skips, dwell time, saves, shares, search text) — automatically deleted 12 months after it is recorded
Location check-in data (stadium/match only, no raw coordinates) — deleted when your account is deleted
Audio recordings (your chants) — deleted when your account is deleted, or when you individually delete a chant. Individually-deleted chants sit in a Bin (up to 100 items) where you can restore them; when the Bin overflows the oldest are permanently removed.
Reports you have filed (as reporter) — kept for audit purposes even after your account is anonymised, but detached from your identity
Technical logs (IP, device) — retained for a maximum of 90 days for security and abuse investigation, then automatically discarded
Anonymised residual records — where we need to retain something for community integrity (e.g. votes, historical chants), we strip your identity from it. See "Deleting your account" below.

7. Your rights under UK GDPR

You have the right to:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data (you can also edit most fields directly in your profile)
Erasure (right to be forgotten) — request that we delete your account and personal data. See "Deleting your account" below.
Restriction — ask us to pause processing of your data while a query is resolved
Portability — receive a copy of your data in a portable, machine-readable format
Objection — object to processing based on legitimate interest

To exercise any of these rights, email [email protected] with the subject line "Data request." We will respond within 30 days as required by UK GDPR. We may need to verify your identity before releasing data.

8. Deleting your account

You can delete your account in three ways:

In-app — sign in, go to Settings → Delete my account, and confirm. After a 14-day grace period (during which you can restore your account by logging back in), your data is permanently anonymised.
Public web form — visit wechant.app/delete-account to request deletion without needing to sign in (useful if you can no longer access your account). We will verify your registered email address before processing.
By email — write to [email protected] from your registered email address. We will process the deletion within 30 days.

What "anonymised" means: we permanently remove your email, display name, phone number, social links, and any raw location metadata from the chants you uploaded. Your community-contributed content — chants, votes, reports you filed — remains but is attributed to "Former WeChant Fan" with no link back to you. Your setlists and match check-in records are hard-deleted. The anonymisation is irreversible: after the 14-day grace period, we cannot restore your account, and no mapping from the anonymised record back to your original identity is retained.

This approach complies with the UK GDPR's "right to erasure" while preserving the integrity of the community's shared history.

9. Cookies

WeChant uses only essential cookies required for the app to function:

Session cookies — to keep you logged in
Security cookies — to prevent cross-site request forgery (CSRF) and other abuse

We do NOT use tracking cookies, advertising cookies, or third-party analytics cookies. Because we only set essential cookies, no cookie consent banner is required under UK PECR (Privacy and Electronic Communications Regulations).

The app also stores minimal functional data locally in your browser (session tokens, offline cache for the installable app, and interface preferences) — none of which is transmitted to us or to third parties.

10. Security

We take the security of your data seriously:

Passwords are stored as one-way hashes — we never see or store the plain text
All data is transmitted over HTTPS with modern TLS
Third-party providers are contractually bound to industry-standard security practices
Access to production systems is limited to authorised personnel operating under confidentiality obligations
We enforce rate limits and abuse controls throughout the app

If a security incident occurred that risked your personal data, we would notify you and the Information Commissioner's Office (ICO) as required by UK GDPR (within 72 hours of becoming aware, where the incident is likely to result in a risk to your rights).

11. Age minimum

You must be at least 13 years old to use WeChant. We do not knowingly collect personal data from anyone under 13. If you believe we have collected data from a child under 13, please contact [email protected] and we will delete it as soon as possible.

12. Changes to this policy

We may update this policy from time to time. When we do, we will:

Update the "Effective date" and "Last updated" at the top of this document
If the change is material (for example, a new category of data or a new sub-processor), notify you via an in-app notice or email before the change takes effect

Continued use of WeChant after a policy update means you accept the updated policy. If you don't agree with a change, you can delete your account as described in Section 8.

13. How to contact us

For all privacy-related questions or requests: [email protected]

To make a complaint: if you are unhappy with how we have handled your personal data, you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: ico.org.uk
Helpline: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would appreciate the chance to address your concerns before you contact the ICO, but it is your right to go directly to them if you prefer.

Data controller: Corin Morrissey, trading as WeChant. Contact: [email protected] Registered address: available on request via [email protected].

This privacy policy is written in plain English by choice. If you have a question about anything in it, email us — we'll answer honestly.