Sixth Tackle is a rugby league news app that points you to stories, videos and podcasts published by other people. We keep as little about you as we can: an email address if you make an account, the clubs and shows you follow, and nothing that follows you around the web.
Sixth Tackle (sixth-tackle.vercel.app), is run by Brad Clarke in the United Kingdom, who is the data controller for the information described here. Contact: brad@sixthtackle.co.uk.
| What | Why | Legal basis |
|---|---|---|
| Account details: your email address and a password (stored only as a secure hash by our sign-in provider). If you sign in with Google, we receive the email address and name on that account. When you create an account we also record that you confirmed you are 13 or over (we do not ask for your age or date of birth). | To create your account and let you sign in on any device. | Contract: providing the service you signed up for. |
| Your follows: the clubs, competitions and shows you choose to follow. | To build your For You feed. | Contract. |
| Marketing choice: whether you ticked the separate, optional box to get occasional emails from us, a record of each time you gave or withdrew that consent, and the version of the wording you saw. | To email you only if you asked us to, and to be able to show that you did. | Consent. Untick it on the Account page at any time; the withdrawal is recorded too. Messages we must send to run your account (for example confirming your email address or a password reset) are not marketing and do not depend on this box. |
| Outbound taps: when you tap a story, we record which story, which publisher, which tab you tapped it from and the time. We do not record your account. If you have accepted analytics cookies, we also record a random ID kept in your browser so repeat visits are not counted as new readers. | To show publishers how much traffic we send them, and to see which parts of the app are useful. We record nothing about what you do on the publisher's site. | Legitimate interests (the tap counts); consent (the browser ID, which is only stored if you accept analytics cookies). |
| Story impressions: how many times each publisher's story cards were on screen, added up per publisher per day. Nothing about you, your device or which stories you looked at is sent or kept. | To show publishers how often we feature their work and how many of those views turn into visits. | Legitimate interests: reporting to the publishers we link to. Nothing in it identifies you. |
| Telling publishers the visit came from us: links to publishers carry standard tags (utm_source=sixthtackle and the tab you came from), and your browser tells their site our web address. Nothing about you is in them. | So publishers can see in their own analytics how many readers we send them. | Legitimate interests: supporting the publishers we link to. |
| Site analytics (only if you accept): if you choose Accept on the cookie banner, PostHog records how the site is used: pages and tabs viewed, taps and clicks (including on stories), scrolling, the type of device and browser, roughly which country you are in, and anonymised recordings of your visit that replay what happened on screen. Anything you type into a box is hidden in recordings, and the text of Ask questions is never sent. We do not give PostHog your name, email or account ID, and your internet address is discarded rather than stored. | To see which parts of the site work, where people get stuck, and what to improve (heatmaps, click maps and recordings). | Consent. Change your mind at any time with Cookie settings at the bottom of every page. |
| Ask questions: the question you type is sent to our AI provider to produce an answer. Ask is for members only. We keep a count of how many questions each account asks per day. We do not store the question. Ask works as a conversation: your questions and answers stay in your browser until you close the tab or start a new chat, and the last few are sent with your next question so follow-ups make sense; we keep none of them. The answer is kept for up to an hour, under a one-way code made from the question and with nothing about who asked, so the same question asked again can be answered without a new AI call. We also keep a record of each answer with no question and no link to you: which stories it pointed to, whether it found an answer, and how long it took. | To answer you, and to stop the feature being overused. | Contract, and legitimate interests for the daily limit. |
| Searches that find nothing: when a search in the search box returns no stories, we keep the words typed, with no account, device or internet address attached. | To spot missing stories, misspellings and names we should recognise, and improve search. | Legitimate interests (making search work). Nothing in it identifies you. |
| Alert subscription: if you turn on alerts, your browser gives us a push address and encryption keys. We keep them with the alerts you chose (team news, signings and contracts, discipline, transfer news, official news), the names of the clubs you follow (for club alerts), whether alerts are paused, your quiet hours and your device's time zone. It is not linked to your account. | To send you the alerts you asked for, at the times you allow. | Consent. Change or turn them off on the Alerts page (Account → Alerts) or in your browser settings at any time. |
| Alert log: for each alert we send, the story, the kind of alert, the club, the time, whether it was delivered and whether it was tapped. The device is recorded only as a one-way scrambled code (a hash) of its push address, not the address itself. | To keep to our limits (no more than 8 alerts a day, no repeats within 90 minutes) and to see which alerts are useful and which are ignored. | Legitimate interests: sending only alerts that are wanted, and no more than promised. |
| Publisher accounts (only for people at clubs, leagues and media we list, who we invite to the publisher portal): the email address we were given for you, the source it gives access to, when you were invited and first signed in; if you sign a permissions agreement, your name, role, organisation, email, the choices you ticked and when; and the requests and messages you send through the portal, with our replies. If you use the Request access form on the portal page: your name, work email, organisation, role, website, what you asked for and any message, and whether you were signed in with that email when you sent it. Your choice of publisher emails (weekly and monthly reports, replies to your requests, feed problems, promotions), set on the portal's Emails tab. | To show you the traffic we send your outlet, let you manage how your stories appear, and keep a clear record of the permissions you gave. | Legitimate interests (running the publisher relationship) and, for the agreement, keeping a record of what was agreed. |
| Your country, for the optional Super League / NRL lean: when the site loads, our host (Vercel) works out which country your connection is in and gives the site only the two-letter country code (for example GB or AU). Your internet address is not passed to us, and the country is not stored on our servers: it is kept in your browser for a day. It only affects what you see if you choose "Based on where I am" under Your feed on the Account page; the default, "Best of everything", has no lean. Your choice there is saved in your browser and, if you are signed in, on your account. | To show readers who ask for it more Super League in the UK, or more NRL in Australia, New Zealand and the Pacific. | Legitimate interests: showing the news most relevant to you, at your request. Change it at any time on the Account page. |
| Abuse protection: when you send the content complaint form or change your alert settings, we keep a one-way scrambled code (a salted hash) of your internet address, with the time, for two days. The address itself is not stored and the code is not linked to anything else. | To limit how many requests can come from one place, so the forms keep working for everyone. | Legitimate interests: keeping the service working and stopping misuse. |
| Settings on your device: your filters, follows (if you are signed out), cookie choice and your signed-in session are kept in your browser's local storage. See the cookie policy for the full list. | So the app remembers your choices between visits. | Strictly necessary for features you ask for. |
Analytics cookie (only if you accept): PostHog sets a cookie and local storage entry beginning ph_ holding a random ID, so visits can be grouped together. Choosing No thanks, or withdrawing later, removes it. | Site analytics, above. | Consent. |
Apart from the country described above, we do not collect your location, and we do not collect your contacts, phone number, date of birth or payment details. We do not build advertising profiles.
We use a small number of service providers. They handle data only to provide their service to us.
The Watch section uses YouTube API Services to list videos from the channels we feature (video titles, thumbnails and links). By using Sixth Tackle you also agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. When you tap a video it opens on YouTube, where YouTube's own terms and privacy policy apply. You can revoke any access you have granted to YouTube data through Google's security settings; Sixth Tackle itself does not ask for access to your YouTube account.
Some pictures load straight from the sites that host them: YouTube (video thumbnails), podcast hosts (show artwork) and publishers' own websites (the picture a publisher attaches to a story in its feed or for link previews). We link to those pictures and never copy them. As with any website, those servers see your internet address when your browser fetches the picture. Our fonts and code are served from our own site. When you tap a story you go to the publisher's own site or to YouTube, and their privacy policies apply there.
Some of these providers are based outside the UK. Where data leaves the UK, it is protected by the safeguards UK law requires, such as adequacy regulations or standard contractual clauses.
Under UK data protection law you can ask to see the information we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy to take elsewhere. You can withdraw consent (marketing emails, notifications, analytics cookies) at any time.
Most of this you can do yourself. Account → Download my data gives you a copy of everything held against your account, and Account → Delete my account removes your account, follows, consent history and settings immediately; we then send one email to confirm it, and keep no copy of your address. For anything else, email brad@sixthtackle.co.uk and we will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Sixth Tackle is not aimed at children, and you must be 13 or over to create an account.
Connections to the app are encrypted. Passwords are never stored in readable form. Access to the database is limited to what each part of the app needs.
If we change what we collect or how we use it, we will update this page and the date at the top. If a change is significant, we will tell signed-in members in the app before it takes effect.