Privacy
Last updated 18 September 2026
Your analytics choice
You have not decided yet, so nothing is loading it.
The short version
You paste a football take. We send it to a model, store the answer, and show you a card. If you ask us to, the card goes on a public board.
Takes are deleted on a timer. We do not sell anything to anyone, and there is nothing here worth selling.
What we collect
Everything in this table, and nothing else. There is no profile, no tracking across other sites, and no advertising.
| What | Why | Kept |
|---|---|---|
| The take you paste | It is the thing being judged. It is sent to TypeSafe to be scored and stored with the result so the card has a permalink. | 14 days if you put it on the board, 90 days if you did not |
| The call, the salt score and the three reads | They are the card. | With the take, and deleted with it |
| A hashed form of your IP address | To count how many calls an address has made, so one visitor cannot spend the whole budget. It is salted and hashed — the table holds no readable addresses. | Until the rate-limit window it belongs to expires, then swept |
| Your En Dash account id, if you sign in | To attach calls to your account, show you /mine, and give you a higher limit. | With the calls it is attached to |
| Your X handle, if you use the bot | To reply to the right person and to rate-limit per handle. | With the call, and deleted with it |
Where it goes
Four companies other than us can see some part of this, and only the part they need.
TypeSafe receives the take and the league, and returns the scores. It is the model that makes the call. Nothing else is sent — not your address, not your account, not your name.
Turso stores the database. Google Cloud runs the site. Google Analytics counts visits.
Cloudflare Turnstile checks that you are a person before a take is judged, which is what stops a script spending the budget.
Google Analytics is the only one of these you are asked about, because it is the only one that is neither necessary to run the site nor needed to answer your request.
If you tip, Stripe handles the payment. We never see your card details — the payment page is Stripe's, not ours.
Cookies
Two of ours, both strictly necessary and neither used for tracking: booth_auth keeps you signed in for thirty days, and booth_oauth_state exists for ten minutes during sign-in to stop the login being hijacked. Both are signed and read only by the server.
Google Analytics sets its own, and it does not load until you say yes. Declining is not a setting we honour afterwards — the script is never put on the page at all, so there is nothing to honour. You can change your mind on this page at any time.
A third cookie of ours, booth_consent, remembers that answer for a year. Recording that you declined is what makes declining mean anything, so it is there whichever way you answered.
Cloudflare Turnstile sets one too, and it is not behind the banner. It is there to stop scripts spending a budget that pays for everyone's calls, which is a security measure rather than a preference — gating it would mean nobody could submit a take until they agreed to be protected from abuse.
Public means public
Ticking "Put this on the board" publishes your take, its call and its score to a page anyone can read, and to a share image anyone can post. Do not put anything on the board you would not put on a billboard.
Every call has a permalink whether or not it is public. A permalink is unlisted, not secret: anybody with the link can open it.
Calls made through the X bot are public by design, because they are replies to a public post.
What you can ask for
A copy of what we hold about you, or its deletion. Sign-in gives you /mine, which lists your calls; anything there can be removed on request, and everything deletes itself on the timer above regardless.
We cannot delete a call we cannot identify. If you never signed in, the take is not linked to you in any way we can search — which is good for your privacy and unhelpful when you want something removed, so send the permalink.
Write to hello@endash.us.
Children
This is not for under-13s and we do not knowingly keep anything from one. Tell us and it goes.
Changes
If this notice changes in a way that matters, the date at the top changes with it. The retention windows on this page are read from the same constants the deletion job runs on, so they cannot drift apart.