Privacy policy

1. Information we collect

• Account information: your email address, account identifier, optional phone number, verification status, and sign-in and account-security settings. If you create a password, we store a password hash rather than the password itself.
• Microsoft or Google sign-in: the provider's account identifier and basic profile information made available during sign-in, such as your name and email address. We store the link between that provider account and your Turton account. We do not receive your Microsoft or Google password.
• Groups and campaigns: group names and descriptions, organizer account associations, campaign titles and settings, payment instructions, and creation and archive information.
• Football Squares activity: chosen board names, reserved squares, reservation times, recorded payment status, assigned grid numbers, scores, prize amounts, winners, payout status, and score correction history.
• Administration and technical information: administrative actions and account identifiers, action times, and information needed to operate and protect the service. Hosting or security systems may process connection details such as IP addresses, browser information, request times, and error records.
• Messages you send us: the contact details and information you include when requesting help or contacting us about privacy.

Please provide only information needed for your fundraiser. Do not include banking credentials, card numbers, government identification, or sensitive personal details in group descriptions, payment instructions, or board names.

2. How we use information

We use information to create and secure accounts; operate groups and campaigns; manage reservations, payment records, and results; help organizers contact participants and winners; answer requests; investigate errors or misuse; and maintain administrative accountability. We may also use or disclose information where necessary to meet an applicable legal obligation.

Turton does not sell personal information, display advertising, or use advertising trackers. The website does not currently use third-party analytics. The contact form uses Google reCAPTCHA to help prevent spam; Google may process browser, device, and interaction information for this purpose.

3. Public campaign information

Football Squares boards can be viewed without signing in by anyone who has their link. Links can be forwarded, so a shared board should not be treated as private. Public board information includes the group and game names, payment instructions, chosen board names, square availability and payment status, scores, winning squares, prize and payout information, and score correction history.

Your account email address and phone number are not displayed on the public board. Use a first name or nickname for your board name, and avoid publishing someone else's personal information, especially information about children.

4. Organizers and site administrators

The owner of a group can privately view and download the current email address and any phone number supplied by participants in that group's games, along with verification status, reservations, payment records, and winner details. This helps the organizer reconcile payments and contact winners. Contact details marked unverified have not been verified by Turton.

Organizers are responsible for using this information appropriately for their fundraiser and protecting copies they download. Removing information from Turton does not automatically remove copies already exported by an organizer. Contact the organizer about their use of your information and any records they hold separately.

Authorized Global Administrators can review account, group, campaign, and participant records for site administration and can permanently delete eligible records. Administrative audit records retain actor and target account or record identifiers, the action, and its time.

5. Hosting, sign-in providers, and other disclosures

Information is processed through the hosting, database, and other service providers needed to run Turton. If you choose Microsoft or Google sign-in, that provider processes your authentication under its own terms and privacy policy. A Microsoft work or school account may also involve your organization's identity provider.

See the Microsoft Privacy Statement and Google Privacy Policy. These providers and hosting services may process information outside your province or Canada, where different laws and access requirements may apply.

We may disclose information in response to a valid legal requirement or where permitted by applicable law to protect people, investigate misuse, or protect the service.

6. Payments and prizes

Turton records payment and payout status entered by organizers. It does not collect, hold, or transfer fundraising payments or prizes and does not collect payment-card details. Payments, refunds, and prizes are handled outside this website by your organizer and any payment service you choose. Their information-handling practices apply to those transactions.

7. Cookies and security

Google reCAPTCHA on the contact form may set cookies and process browser or device information to distinguish people from automated submissions. Contact messages are delivered through Microsoft 365 and are not stored in a separate contact-message database on this site. Copies may be retained in the receiving mailbox and its email-service records.

We use cookies needed for authentication, optional remembered sign-in, protection against forged form submissions, temporary account messages, and completing Microsoft or Google sign-in. Those sign-in providers may use their own cookies while you interact with them. Blocking necessary cookies can prevent sign-in or other account features from working.

The application uses HTTPS, password hashing, and access controls to protect information. No website or transmission method can guarantee complete security. Keep your sign-in credentials private, sign out on shared devices, and avoid sending passwords or authentication codes in support messages.

8. Retention, archiving, and deletion

Account and campaign records remain on the service until they are deleted. Archiving a game closes updates but preserves its records and public board; it is not deletion. Records may also need to be retained to resolve outstanding fundraising matters, maintain security and accountability, or meet applicable legal obligations.

Deletion of a group or campaign removes its associated live fundraising records. Account deletion may require administrator assistance when groups, reservations, or score history still reference the account. Contact us to request review rather than assuming that releasing a square, disconnecting a sign-in provider, or signing out deletes your account.

Limited administrative audit records remain after deletion. Copies in hosting backups, where maintained, may remain until those backups expire or are replaced. Organizer exports and records held by external payment or sign-in providers are outside the website's deletion controls.

9. Your choices and requests

You can review and update available account details, manage linked sign-in providers, and download the account information available under My account → Personal data. That download may not include every campaign, technical, or administrative record associated with you. Contact us to request access to additional personal information, corrections, or deletion, or to raise a privacy concern.

We may need to verify your identity before acting on a request. Some requests may affect your ability to participate in a fundraiser, and some information may need to be retained or handled differently under applicable law. We will explain any limitation that applies to your request.

10. Changes to this policy

We will update this page when our information-handling practices change and revise the date above. Where required, we will provide additional notice or seek consent for a new use of personal information.

11. Contact us

For privacy questions, access or correction requests, or deletion requests, use our contact form. Please identify the relevant account or campaign without sending passwords or authentication codes.