PRIVACY POLICY

    Effective date: June 1, 2026

    1. INFORMATION WE COLLECT

    We collect the following categories of information:

    • Account information. Email address, display name, and password (stored as a hashed value via Supabase Auth).
    • Profile data. Optional profile photo, bio, and preferences you provide.
    • Usage data. Pages visited, features used, and actions taken within the Service (via Google Analytics and internal logging).
    • Attribution data. UTM parameters and referrer URL from your first visit, stored to understand how users discover the Service. No personally identifiable information is attached.
    • Payment data. When you make a purchase, payment is processed by Stripe. We receive a transaction confirmation and last-four digits only. We never see or store your full card number.
    • Device and connection data. IP address, browser type, operating system, and approximate geographic location inferred from IP.

    2. HOW WE USE YOUR INFORMATION

    We use the information we collect to:

    • Create and manage your account.
    • Operate leagues, sync scores, and display standings.
    • Process payments and send receipts.
    • Send transactional emails (account verification, password reset, league invites).
    • Send product updates or announcements (you may opt out at any time).
    • Detect fraud, abuse, or violations of our Terms of Service.
    • Analyze aggregate usage to improve the Service.

    3. LEGAL BASIS FOR PROCESSING (EEA / UK USERS)

    If you are located in the European Economic Area or United Kingdom, we process your personal data under the following legal bases: performance of a contract (providing the Service you signed up for), legitimate interests (improving the Service, preventing abuse), and consent (marketing emails, where required by law).

    4. DATA SHARING

    We do not sell your personal data. We share data only with:

    • Supabase (database and authentication hosting).
    • Stripe (payment processing).
    • Resend (transactional email delivery).
    • Google Analytics (aggregate usage analytics).
    • Law enforcement or government authorities when required by applicable law.

    5. COOKIES AND TRACKING

    We use cookies and localStorage to maintain your session, store attribution data, and support analytics. Google Analytics sets cookies to measure aggregate site usage. You can disable cookies in your browser settings; some features of the Service may not work correctly as a result.

    6. DATA RETENTION

    We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes (such as payment records, which we retain for 7 years).

    7. YOUR RIGHTS

    Depending on your location, you may have the right to:

    • Access the personal data we hold about you.
    • Request correction of inaccurate data.
    • Request deletion of your data ("right to be forgotten").
    • Object to or restrict certain processing.
    • Request a portable copy of your data.
    • Withdraw consent where processing is based on consent.

    To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

    8. CHILDREN'S PRIVACY

    The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

    9. DATA SECURITY

    We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed password storage, and access controls on our database. No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but we take reasonable precautions.

    10. INTERNATIONAL TRANSFERS

    Your data may be stored and processed in the United States. If you are located outside the United States, your information will be transferred to and processed in a country that may not have the same data protection laws as your country. By using the Service, you consent to this transfer.

    11. CHANGES TO THIS POLICY

    We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date above and, where appropriate, by email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

    12. CONTACT

    Privacy questions or requests? [email protected]