Privacy Policy

Last updated: 20 February 2026

Slops Leaderboard is a spending leaderboard for students at Downing College, Cambridge. This policy explains what data is collected when you use the service, how it is used, and your rights.

How It Works

To appear on the leaderboard, you log into your Upay account through upay.slopsleaderboard.com, a proxy hosted by this service. When you authenticate, the backend intercepts your login response to extract your name, identity details, and a session token. These are used to fetch your spending totals from the Upay API and populate the leaderboard.

Data We Collect

The following data is collected and stored when you log in through the proxy:

• Your name (first name and surname, as held by Upay)
• Your email address (your Upay account email)
• Authentication credentials — a JWT auth token and session identifier issued by Upay at login, stored to fetch your spending data
• Upay user identifiers — internal user and company IDs used to query the Upay API

From the Upay API, we retrieve your transaction history for the current academic year. Individual transaction details (dates, item descriptions, per-transaction amounts) are processed in memory and then discarded. Only the following aggregated totals are stored in our database:

• Your display name (first name and surname)
• Total spending per category per term — Hall, Butterfield, and Bar, broken down by Michaelmas, Lent, and Easter terms

Public Display

Your name and spending totals are displayed publicly on the Slops Leaderboard at slopsleaderboard.com, visible to anyone who visits the site.

How We Use Your Data

Your data is used solely to calculate and display spending totals on the Slops Leaderboard. We do not:

• Sell or transfer your data to third parties
• Use your data for advertising or marketing
• Use your data for any purpose unrelated to the leaderboard

Data Storage

Aggregated spending totals and your display name are stored in a Supabase (PostgreSQL) database. The service is hosted on Railway and Vercel.

Your Right to Removal

You can request to have your name and spending data removed from the leaderboard at any time. Simply email [email protected] from any address with your name or Upay email address, and your entry will be deleted promptly.

Contact

If you have any questions about this privacy policy or how your data is handled, please contact us at [email protected].