Privacy notice

Opening updates

If you leave your email on the opening page, we use it only to let you know when Down The Den opens. We record your email address, the date and time you submitted it, and your IP address. The IP helps us limit automated submissions. The owner and assigned account operators can see these records in a private register; they are separate from member accounts and site-update preferences. Cloudflare handles the form request and Supabase stores the record. We do not send an email when you submit or add you to a third-party mailing list.

We keep the first accepted submission for up to 365 days and remove older records through scheduled cleanup. Short-lived per-IP rate-limit entries are removed after two hours. You can ask Ross at the contact address above to remove your address sooner, or to exercise your data rights. We rely on your request for the opening message and our legitimate interest in protecting the form from abuse.

What the Pilot collects

The account service keeps your verified email address privately in Supabase Auth. It may also keep your public name, account and session records, name history, optional supporter record, attendance choices, News topics and contact preferences. Public names are separate from private accounts. Your email is never used as your public name.

The optional record may include supporter tenure, first match, birthday day and month without a year, season-ticket seasons, how you follow, stand, favourite player, town-level locality and IANA timezone. Each answer can be skipped or cleared.

Why it is used

Account, sign-in, export, deletion and security information is used to provide the account service and keep it secure. Optional record information is used only for the private archive paybacks described beside each question. Optional editorial contact starts unset and is used only after an affirmative choice. Essential security and account messages remain separate.

Who processes it

Supabase provides authentication and database services. Cloudflare provides the site, network security, private file storage and file processing. Resend delivers sign-in, invitation, account and Feedback emails and supplies delivery, bounce and complaint receipts. Open and click tracking are disabled for application mail. Messages you send directly to the contact address are received through Apple iCloud Mail. No advertising profile or data sale is involved.

Registration, invitations, discussions and Feedback

Public registration records your verified email, account admission and necessary security events. It creates no invitation, invitation slot or mailing-list entry. Invitation use remains separately recorded to enforce the private cohort limit and prevent reuse. Morton’s topics, replies, display names and Matchday votes support the private member experience. A match-specific device identifier limits repeat votes. Contributions can be seen by other admitted members; account emails, reports and appeals are not shown alongside them.

Feedback stores your submission, correspondence, optional files and their processing status. Only you and operators with the necessary role can read private submissions. For account-linked Feedback, authorised operators can see your current display name and account email alongside your submission to identify who needs help. Safety processing may produce private previews and extracted text. A separate recorded rights review is required before any contributed item can be displayed in the archive. Withdrawal stops access immediately while verified deletion completes; a documented evidence or legal hold can delay deletion.

We use account and contribution information to deliver the service you request, optional preferences with your agreement, and proportionate security/moderation records for our legitimate interests in operating a safe private community. The operator can link display names and contributions to a private account when needed to handle abuse, reports or rights requests.

Optional Away Day postcode

You can save one Great Britain postcode privately in Travel from, change it or remove it. Saving or using it sends the postcode to Postcodes.io to resolve a journey origin. When you open same-day Rail or Bus planning with a saved postcode, change its arrival settings, or choose Check routes or Refresh routes, the server sends that origin’s coordinates and the requested ground/date/time to Buses & Trains. When private Driving is available, choosing Driving or changing its route settings can send an authenticated request after a one-second pause. The server sends the selected origin and reviewed parking or stadium-approach coordinates and travel time to TomTom. Outward and return drives are calculated separately. An explicit Check pickup connection or Check connection home uses Buses & Trains for the journey to or from a reviewed club-coach pickup. Opening an Away Day driving-directions link shares your selected trip postcode, or saved postcode, with Google Maps. Without a postcode it uses The New Den. Google receives the postcode only when you open that link; the planner does not automatically request Maps directions. Your email and account identity are not sent to these location or transport providers.

You can also choose a postcode for one fixture using This trip only. That choice never changes the saved setting; up to two recent choices remain only in the open page and disappear when you leave. We keep only the saved postcode and verification timestamps in your account. An optional next-day starting postcode or reviewed hotel is also for that trip only. Successful same-day rail and coach results from your saved postcode can be restored in the same browser tab for up to 30 minutes. This temporary tab storage holds normalised route sections and times, without your postcode, coordinates or account identifier. Signing out clears it; a changed account, saved postcode or fixture prevents reuse. If no current result is held, the visible saved-postcode planner checks routes automatically; a failed search stops until you retry. Trip-only and overnight searches are not stored this way. Driving results can be reused in the open page for five minutes. Coordinates and personal route results are temporary: they are not written to the database, application logs or shared route cache. Account-linked Buses & Trains and postcode request counters contain no location or itinerary and expire after 30 days. TomTom counters retain the neutral account link for at most 32 days to enforce its rolling 31-day limit; account deletion removes that link without refunding aggregate usage. Removing the postcode deletes the setting; your account export includes it while saved.

Optional Away Day lift sharing

For eligible upcoming Millwall away fixtures, invited adult members can choose to post a lift offer or request. Other eligible members see your display name, offer or request, broad starting area, approximate time band, direction, seat count and listing status. We keep your interest and response, separate decisions to share your verified account email, and the owner’s introduction review. Your email is disclosed only to the other participant after both people agree and the owner approves; it is not shown on the board. We do not share a saved postcode, exact pickup point, route search or travel result with the board.

You can cancel or withdraw. Private reports and appeals hold a controlled category and brief explanation for owner review; a necessary case or legal hold may extend retention. Ordinary linked records in the active database are scheduled for removal seven days after the fixture’s trip end; unlinked audit and request receipts after 14 days. A restored backup must replay due deletion before reopening the board. The owner can pause new arrangements and close access. Supabase and Cloudflare process these records for the private service, and Resend delivers any necessary application email. This is optional member coordination under our legitimate interest in running the invited community and your requested service; the separate exchange of your verified email requires your affirmative agreement. Use the board controls or contact Ross to raise a concern or exercise your rights.

Optional Matchday Arena

Opening the Arena panel loads Bzzoiro’s live graphic or replay directly in your browser. Bzzoiro receives your IP address, browser details, the selected match and this site’s origin to check that the embed is permitted. We do not send your Down The Den account, email or session. The panel stays unloaded until you open it; closing it removes the embedded page.

The provider controls its own rendering, requests and browser storage. Replay availability depends on its retained action stream. Read Bzzoiro’s privacy notice. You can continue using the text feed without opening the graphic.

Optional site usage

Updated 6 October 2026. While measurement is active, we count broad site sections, page views, estimated signed-out arrivals, limited visible active time and fixed error or performance categories to improve the site. This covers public visitors and admitted members. The owner can see aggregate daily totals, trends, guest/member page views and popular sections, including small counts, for selected dates. Views are not unique people; repeat browsing and signed-out members can contribute to guest counts. We do not create a guest identifier, fingerprint, named browsing history or individual activity report. Search text, messages, postcodes, full URLs, IP addresses, user agents and error messages are not stored for this purpose.

Our basis is legitimate interests in improving and maintaining the site. For browser storage or access used solely for site statistics, we rely on the statistical-purposes exception and provide this free objection control. Turning measurement off does not affect access or necessary security records. The browser stores only your measurement choice, in local storage and a one-year choice cookie, without an identifier. A signed-in objection applies across your account. Event retry identifiers expire after one day; earlier account-linked calculation material expires after at most 40 days and is no longer added. Aggregate counts and historical weekly reports expire after 24 months. Your account choice remains until changed or your account is deleted. Cloudflare and Supabase process this data for the site; no separate analytics vendor receives it. Blocked scripts, lost signals, objections and collection limits can make counts low.

Retention and visibility

Account information lasts while the account is active and is then handled under the deletion and retention procedure shown in Your data. Ordinary security logs are normally retained for 7–30 days. A vacated public name is held for 30 days before release. Optional record information and attendance are private by default.

Ordinary Morton’s topics lock after seven inactive days; member-visible bodies expire 90 days after lock or closure unless retained for a specific case. Closed ordinary moderation evidence is retained for up to 12 months. Feedback is kept while handling the submission and any separately agreed contribution use; withdrawal, deletion and retention holds are recorded against the item. Necessary case or legal evidence can remain for its recorded purpose after account deletion.

This Pilot is limited to admitted accounts. Ross is the sole moderator for the invited Pilot. Reports, appeals and Feedback are handled privately; necessary evidence may be disclosed to a relevant authority where required.

Your choices and rights

You can download your versioned JSON account export and request deletion from Your data. You may also ask for access, correction, restriction, objection or portability by emailing the contact above. Identity checks are used before disclosing private information. You can complain to the Information Commissioner’s Office.