This policy explains what information bbcfight.com and BBC Fight Pass (the “Sites”) collect about you, how it is used and what your choices are. The short version: we keep what we need to run a private, invite-only club, we don’t show ads, we don’t use tracking or analytics, and we never sell or share your information for advertising.
What we collect
From Google, when you sign in. Your name, Gmail address, Google account ID and the link to your Google profile picture. We never see or store your Google password.
Your Instagram. The Instagram username you tell us is yours, and the Instagram account we verify you with. The direct message you send us happens on Instagram, under Instagram’s own terms and privacy policy.
Verification. One-time admission codes (we keep only a scrambled, one-way version of each code), when they were issued and used, and whether your account was approved, refused, removed or let in early.
Your agreement. When you type “I agree” under the Content Notice: the date and time, which Site, what you typed and a description of your browser and device (its “user agent”). This is the record that you agreed.
Your settings. Playback preferences such as autoplay, and where you left off in a video so you can continue watching.
Account history. A log of account events — sign-ups, approvals, removals and staff actions — so staff can see what happened and when.
Technical information. Like almost every website, our servers record the IP address of each request and the page asked for, for security and to fix problems. We record page addresses without their query strings. To stop abuse, we count attempts at things like signing in, using a scrambled version of your IP address or account number.
What we don't do
- No advertising, and no advertising or analytics cookies, pixels or trackers.
- We do not sell your personal information, and we do not share it for targeted or cross-context advertising.
- No payments: we never ask for card or bank details.
- We don’t read your Instagram or Google account beyond what is listed above.
How we use it
- To sign you in, check you are on the guest list and verify that your Instagram account is really yours.
- To decide who may enter and when, including the launch countdown, early access and emergency holds.
- To record that you agreed to the Content Notice and show it on your profile.
- To remember your settings and where you left off.
- To keep the Sites and their members safe, prevent abuse and enforce our Terms of Use.
- To tell staff that somebody is waiting to be approved: when you claim an Instagram username, staff receive an email with your name, Gmail address and that username.
Who else is involved
We use a small number of other companies to run the Sites. Each receives only what it needs:
- Google — Google Sign-In, on the sign-in page, and Gmail, which carries staff notification emails.
- Cloudflare — every request to the Sites passes through Cloudflare’s network, which protects the Sites and can see your IP address and the pages requested.
- Kinescope — hosts and plays BBC videos. When you play a video, your browser connects to Kinescope, which receives your IP address and device information.
- Instagram (Meta) — where you send your verification message and where our account lives.
We may also disclose information if the law requires it, or to protect the safety of anybody involved in the club.
Cookies
We use only the cookies the Sites need to work, such as the one that keeps you signed in. See the Cookie Policy for the full list.
How long we keep it
Sign-in sessions end after 12 hours, admission codes expire after about 5 hours, and server logs are kept only as long as they are useful for security and fixing problems. Account information, settings, account history and agreement records are kept while your account exists. If your account is deleted, we delete its information, except where we need to keep a limited record — for example of an agreement or a removal — for safety, legal or dispute reasons.
Your choices
- See what your account says about you on your profile page.
- Sign out at any time; signing out ends your session on both Sites.
- Ask us for a copy of your information, to correct it, or to delete your account, by messaging @bbcfightofficial on Instagram from the Instagram account you verified with. Depending on where you live you may have further rights under local law, and we will honour them.
Children
The Sites are not for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has an account, tell us and we will delete it.
Security
The Sites are served only over HTTPS. Sessions use secure, HttpOnly cookies, admission codes are stored only in scrambled form, and access is checked on our servers for every page and video. No system is perfectly secure, so please keep your Google account protected.
Changes and contact
If we change this policy we will update the date at the top of this page. Questions or requests: message @bbcfightofficial on Instagram.