Privacy Policy
Effective September 16, 2026. Operated by [operator legal entity to be confirmed].
1. What we collect
When you create an account we store:
- your email address and a one-way hash of your password (we never store the password itself);
- the display name you choose, which is public;
- your founder number (sign-up order) and the date you joined;
- the teams you follow, your primary team and when you set it, and your predictions;
- a time-on-site count: while you are signed in and a tab is visible, the site records about one minute per minute, per day. This feeds fan levels and the weekly fan board. It does not record what pages you looked at.
Without an account we store nothing about you beyond ordinary server logs kept by our hosting provider.
2. What is public
Your display name, founder number, primary team, level, badges and weekly points appear on team pages and fan boards. Your email address, password and exact activity are never shown to other fans.
3. Cookies
We use one session cookie to keep you signed in. We do not use advertising cookies or third-party trackers. Your browser may keep small conveniences such as a remembered tab locally on your device.
4. Who processes the data
- Vercel hosts the site and keeps standard request logs, which include IP addresses, for security and operations.
- Neon hosts the database in the United States.
We do not sell personal data and we do not share it with advertisers. We share it only with these providers, or when the law requires.
5. Children
The service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, write to [contact email to be confirmed] and we will delete it. If paid features are ever offered to younger fans, verifiable parental consent will be required first.
6. Your choices
- Change your primary team or follows at any time from My League.
- Ask for a copy of your data or deletion of your account at [contact email to be confirmed]. We answer within 30 days.
- Sign out on any device to end the session cookie.
7. Retention and security
Account data is kept while your account exists and for up to 30 days after deletion in backups. Passwords are hashed with bcrypt; connections use HTTPS; database access is limited to the application. No system is perfectly secure, and we will tell affected users about any breach as the law requires.
8. Changes and contact
We will update this page when data collection changes and update the effective date. Questions go to [contact email to be confirmed]. See also the Terms of Use.