Privacy Policy

Information we collect

• Account details such as email address, username, password credentials, Google sign-in identity, and email verification status.
• Profile details you choose to use publicly, including your username and generated avatar initial/color.
• Public activity such as chart comments, news comments, replies, likes, dislikes, edit history, deletion status, and moderation status.
• Technical data needed to protect the service, including session cookies, CSRF tokens, request metadata, rate-limit signals, and security logs.
• Email delivery data for account confirmation, password reset, and essential account messages.

How we use your information

• To create, secure, and manage your public fan account.
• To show your public username beside comments, replies, and reactions.
• To keep chart discussions attached to the correct chart and published week.
• To confirm email ownership, send password reset links, and deliver important account messages.
• To prevent abuse, spam, impersonation, profanity, external-link misuse, and repeated automated requests.
• To operate admin tools for public user management and comment moderation.

Public comments and usernames

Comments, replies, likes, and dislikes are public community activity. Your email address is not shown publicly. Your public username is shown beside comments, and usernames must be unique. We block usernames that include profanity, explicit terms, artist or celebrity names, or confusing variants that could impersonate someone else.

Chart comments are connected to the chart and the specific published week they appear under. A new chart week starts a fresh discussion.

Google sign-in and email accounts

If you sign in with Google, we use the email address returned by Google to find or create your NGMCharts public account. If the same verified email is used with normal email/password sign-in and Google sign-in, it should point to the same account identity rather than creating a separate fan identity.

Emails

We use Resend to send account confirmation and password reset emails. These are automated account emails and the inbox is not monitored for replies. Password reset links and confirmation links are time-limited.

Storage and service providers

Public account and comment data is handled through Cloudflare infrastructure, including Workers and D1. We also use Google OAuth for Google sign-in and Resend for account emails. We do not use Supabase for public fan authentication.

Account deletion

You can request account deletion from your account page. When an account is deleted, we remove or anonymise account details used for sign-in. Public comments may remain in the discussion for context, but they are shown as from "Deleted User" rather than your username.

Some records may be kept for a limited period where needed for security, abuse prevention, legal obligations, backups, or to protect the integrity of moderation logs.

Your choices and rights

You can update your email, username, and password in your account page. You can delete your account from your account page. You can also contact us to ask about access, correction, deletion, or restrictions on your personal information.

Privacy rights can depend on where you live and the reason the data is being processed. The UK ICO explains that people should be given clear privacy information and may have rights such as access, rectification, and erasure; the right to erasure is not absolute in every case.

Contact

For privacy questions, account issues, or data requests, contact NGMCharts through the contact page.