How we handleyour data

Email address

Collected when you submit the registration form. Used to send a confirmation email and, after you confirm, two launch announcements (June 3 reveal, July 6 build window). No marketing beyond that.

Legal basis: your consent (e.g. GDPR / UK GDPR Art. 6(1)(a), and equivalent provisions under other applicable laws). You can withdraw consent at any time by unsubscribing or emailing us.

IP address (transient)

Held in server memory for up to 60 seconds to enforce a 1 submission / minute rate limit per IP. Never written to disk, never logged.

That describes our own servers. Your IP address is also visible to Google on almost every page view: your browser loads Google Tag Manager directly from Google, and a browser cannot fetch a file without the server it fetches from seeing where the request came from. Section 3 sets out what Google receives, on what basis, and the one page where none of it loads.

And if you register, your IP address travels with the sign-up event our server sends to Meta and TikTok. Section 3 sets out exactly what that event contains, when it is sent, and how to stop it.

Legal basis: legitimate interest in preventing spam and abuse (e.g. GDPR / UK GDPR Art. 6(1)(f); comparable bases under other applicable laws).

Cloudflare Turnstile cookies

When you open the registration modal, Cloudflare Turnstile loads a small bot-detection script from challenges.cloudflare.com and may set short-lived cookies on that domain to verify you're human. We don't read or store these cookies ourselves.

Legal basis: legitimate interest in site security (e.g. GDPR / UK GDPR Art. 6(1)(f)). Treated as strictly necessary under the EU ePrivacy Directive and comparable rules.

Strictly necessary

Cloudflare Turnstile's bot-detection cookies (described in section 2), the sealed session cookie set when you sign in with GitHub to make a submission — it is scoped to the whole site rather than that one page, because the header shows you as signed in wherever you go — and a single browser-storage entry (nmac_consent_v3) recording the choice you make below. Without that last one we would have to ask you on every page.

Legal basis: necessary for a service you requested (e.g. GDPR / UK GDPR Art. 6(1)(b) and 6(1)(f)); exempt from consent under the EU ePrivacy Directive and comparable rules.

Analytics — cookies off unless you accept

Apart from that one page, Google Tag Manager loads on every visit, before you have chosen anything: it is the thing that applies your choice, so it has to be running to apply it. Loading it means your browser fetches a file directly from Google, and Google therefore receives your IP address, your browser's user-agent string and the address of the page you are on — on every such visit, whatever you go on to decide. With Google Consent Mode set to denied by default, nothing is stored on or read from your device, and the measurement hits Google Analytics 4 sends carry no identifier that would let Google recognise you on a later visit. They are individual hits, though, not aggregate statistics: Google receives them one by one and turns them into estimates at its end.

Legal basis for loading Tag Manager and for those identifier-free hits: our legitimate interest in operating a consent mechanism and in basic measurement of how the site is used (e.g. GDPR / UK GDPR Art. 6(1)(f)). You can object at any time by emailing us, and blocking googletagmanager.com in your browser prevents it outright.

If you accept analytics cookies, Google Analytics 4 additionally sets _ga and _ga_<id> on your device. Those let it recognise your browser from page to page and from visit to visit, which is what turns the hits above into visit counts and tells us which pages people actually use.

Legal basis for those cookies and the data they produce: your consent (e.g. GDPR / UK GDPR Art. 6(1)(a)). Retention: up to 2 years from your last visit.

Marketing — scripts off unless you accept

Five advertising tags, all there for the same purpose: telling us which announcements about the competition actually reached people. The Meta pixel sets _fbp and _fbc. The TikTok pixel sets _ttp, _tt_enable_cookie and ttcsid, plus ttclid if you arrived here from a TikTok ad and a few short-lived tt_ session entries. The Reddit pixel sets _rdt_uuid, and _rdt_cid if you arrived here from a Reddit ad. The Google Ads tag sets _gcl_au, which records that a Google ad brought you here so that a sign-up later in your visit can be credited to it. The X pixel does the same job for X (formerly Twitter); the identifiers it uses are held by X itself rather than written into this site's own cookies, so the switch below is what stops it running rather than a deletion afterwards — which is why none of these scripts is downloaded at all unless you accept marketing cookies. None is merely disabled, and that is true wherever you are.

None of these scripts is given your email address, and none takes it out of the sign-up form. What our own server sends Meta and TikTok when you register is a separate thing, described further down this section.

The Google Ads tag is the second thing on this site that comes from Google, and the two are treated differently on purpose. Tag Manager, described under Analytics above, loads on every visit before you have chosen anything. The Google Ads tag does not: it sits under Marketing with the three pixels, and it is not fetched from Google at all until you accept.

Reddit's pixel is also able to store a hashed email address or phone number of yours, in _rdt_em and _rdt_pn. We never give it either, so neither should ever appear — but both are on the list of cookies we delete when you switch Marketing off, because that promise should not depend on us having been right about what a vendor's script does.

Legal basis: your consent (e.g. GDPR / UK GDPR Art. 6(1)(a)). Retention: up to 90 days from your last visit for Meta's, Reddit's and Google Ads' cookies, up to 13 months for TikTok's. X's are held by X on its own domains, under its own policy.

One further cookie belongs to this category, and it is ours rather than a vendor's: nmac_attr. If you arrive here from an ad, the web address you arrive at carries a click identifier — Google's gclid, gbraid or wbraid, Meta's fbclid, TikTok's ttclid, X's twclid — and this cookie holds it, together with the moment it was captured, so that a sign-up later in your visit can be traced back to the ad that brought you. It holds nothing else: no email address, no name, no record of the pages you looked at.

A second cookie of ours, nmac_utm, holds the campaign labels from the same web address — the utm_source, utm_medium, utm_campaign and similar parameters you can see in the address bar when you arrive. Unlike the click identifier, these are labels we write ourselves when we place an advert, describing which campaign and which channel a link belongs to; any parameter beginning utm_ is kept, because we cannot know in advance every label a campaign will use. They say nothing about you — only about the advert you clicked. Like the cookie above, this one holds no email address, no name, and no record of the pages you looked at.

They are kept apart rather than in one cookie for a practical reason: a long campaign label can then never crowd out the click identifier stored beside it. They are written in the same moment, by the same request, and expire together.

Both differ from every other tracking cookie described here in two ways. They are set by our own server, not by a script running in your browser; and they are marked HttpOnly, which means no script on the page can read them — only our server can, and only when your browser sends them back to us.

Legal basis: your consent (e.g. GDPR / UK GDPR Art. 6(1)(a)) where consent is required — see "Where you are", just below, which governs these cookies as well as the events described there. Retention: 90 days from the click.

Sign-up events sent from our server

When you register, and only once your registration has actually been saved, our server sends a single event about it straight to Meta, TikTok and Google. This one does not go through your browser at all — it travels from our server to theirs — so nothing installed in your browser can see it or block it. What does stop it is the Marketing and Analytics switches below, on the terms set out in a moment.

To Meta and TikTok that event carries: your email address hashed with SHA-256, never in clear text; your IP address; your browser's user-agent string; the address of the page you registered from, with its query string removed; whichever of their own cookies your browser already holds (_fbp, _fbc, _ttp); and a random, single-use event id.

We also send each of them a click identifier, but only its own: Meta gets fbclid if you arrived on a Meta ad, TikTok gets ttclid if you arrived on a TikTok one, and we send neither of them the other's. The Google identifiers held in the cookie above — gclid, gbraid, wbraid — and X's twclid we do not send to Meta or TikTok at all. Our server sends none of those four anywhere but the contact record described in section 4: there is no Google or X equivalent of the Meta and TikTok calls above, so for those two the cookie and that record are the only places the identifier exists.

To Google it carries considerably less: no email address, no IP address, no user-agent string and no page address — only the identifier that Google Analytics' own _ga cookie already holds, the fact that a sign-up happened, and whether the two advertising-consent signals are granted. If you have no _ga cookie, no sign-up event is sent to Google at all.

Why we send it: so those platforms can tell which of their ads actually produced a registration. Whenever the pixels are running, your browser sends a matching event of its own, and the two carry the same event id, so each platform counts one sign-up rather than two.

Reddit is the exception, and in the quieter direction: our server sends Reddit nothing at all. If you register while the Reddit pixel is running, the only sign-up event Reddit receives is the one your own browser sends, and blocking the pixel stops it completely — which is not true of the three above.

Where you are. If you are in the EEA, the UK or Switzerland, none of these three sign-up events is sent unless you have accepted the category it belongs to — and if we cannot tell where you are, we treat you as though you were. Everywhere else the sign-up event is sent unless you have switched that category off, and switching it off stops it, wherever you are. The Meta and TikTok events, and the nmac_attr and nmac_utm cookies above, follow your Marketing choice; the Google event follows Analytics.

That rule governs the sign-up event and that cookie. It does not change what Google receives simply because Tag Manager loads on a page, which happens on almost every visit whatever you decide and is described under Analytics above — and that includes the address of the page you are on, which is the address carrying the click identifier if you arrived on a Google ad.

Legal basis: your consent (e.g. GDPR / UK GDPR Art. 6(1)(a)) wherever consent is required, as just described. Where it is not, our legitimate interest in measuring which advertising works (e.g. GDPR / UK GDPR Art. 6(1)(f), and comparable bases under other applicable laws) — and you can end that at any time with the settings below.

Changing your mind

You can withdraw or extend consent at any time, and withdrawing is as easy as granting. Switching a category off deletes the cookies it set and reloads the page so nothing from it is left running — in every tab you have open on this site, not only the one you changed it in.

nmac_attr and nmac_utm are the two cookies the page cannot delete by itself, because HttpOnly hides them from the page's own code. So switching Marketing off asks our server to expire them, in the same moment and as part of the same action. The promise above holds for them too.