Privacy Policy
What we collect, why, and the choices you have. We collect as little as a league needs to run and we never sell your data.
1. What we collect
- Account: email address, display name, optional avatar, time zone, the date you confirmed you are 18+ and the version of the terms you accepted.
- League activity: leagues you belong to, picks, unit history, standings, chat messages, reports you file and support requests.
- Usage analytics: product events (for example signing up, creating a league, viewing standings), device and browser type, and coarse region derived from your IP address. With your consent in supported browsers we may record masked session replays to debug problems; text you type and personal fields are masked before anything leaves your device.
- Diagnostics: error reports and performance traces that may include the page you were on and your user ID.
We do not collect identity documents, government identifiers, payment details or precise location, and we never ask your browser for location permission.
2. How we use it
To run leagues and grade picks; to send sign-in links, league notifications and support replies; to keep the service secure and enforce our terms, including filtering payment links; to understand which features are used and fix bugs; and to meet legal obligations.
3. Who sees it
- Members of your leagues see your display name, avatar, picks (after the pick locks, per league rules), standings and chat messages. They do not see your email.
- Commissioners of your leagues additionally see your membership status and the email you were invited with, if any.
- Service providers that host and operate the product on our behalf: Vercel (hosting), Supabase (database and authentication), Resend (email), PostHog (analytics and session replay), Sentry (error monitoring), Inngest (background jobs) and our odds and scores data providers. They process data only on our instructions.
- Platform administrators can view accounts and leagues to provide support and enforce the terms. Every such view is logged.
We do not sell personal information and we do not share it for third-party advertising.
4. Cookies and similar tech
We use strictly necessary cookies to keep you signed in and a first-party analytics identifier to understand product usage. We do not use third-party advertising cookies.
5. Retention
Account data is kept while your account is active. Unit history is append-only so league standings stay auditable; when you delete your account we anonymize your profile and keep the anonymized ledger rows. Analytics and diagnostics data are kept for a limited period set with each provider and then deleted or aggregated.
6. Your choices and rights
- Update your display name, avatar and time zone from your account page.
- Leave any league from its members page.
- Pause your account from the Responsible play page.
- Request a copy of your data or deletion of your account by emailing [email protected]. We honour requests under the CCPA, GDPR and similar laws regardless of where you live.
Placeholder for counsel: controller identity and address, legal bases (GDPR), EU/UK representative if required, and the self-service deletion flow once shipped.
7. Children
The service is for adults 18 and older. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
8. Security
Data is encrypted in transit and at rest. Access inside the database is restricted by row-level security so members only read what their leagues allow. No system is perfectly secure; if we discover a breach that affects you we will notify you as the law requires.
9. Changes
We will post changes here and update the version above. For material changes we will also notify you in the app or by email.