Privacy Policy

When you sign in with an emailed link or Google, we receive and store:

• Your email address — used to match you to your league’s roster and to send essential competition communications.
• A random account ID generated for you.

Google also makes your name and profile photo available during Google sign-in. We do not use either as your public national-competition identity.

For national-competition registration, we collect:

• Your legal name, stored in application-encrypted form
• Your country and state, province, or territory of residence
• A verification record and irreversible keyed hash of your mobile number; the full number is sent to Google Identity Platform for SMS verification but is not retained in our application database
• Keyed hashes derived from registration network and browser signals, used to flag possible duplicate entries for human review
• The version and time of your eligibility confirmations and rules acceptance
• Your optional promotional-email preference and the time of any consent or unsubscribe request

Before registration opens, you may separately ask for a one-time opening notification. We store that email in application-encrypted form while confirmation is pending, and only confirmed addresses receive the opening notice.

If you send a support request or error report, we receive the description you enter, any reply email you provide, the app page, a browser description, and an error reference when one is available. Reports are delivered privately through our email provider and are used only to investigate and respond to the issue.

As you play, we store:

• Your weekly picks and the time each was submitted
• A history of changes to your picks, so the last one before the deadline can be identified
• Scoring, standings, commissioner corrections, and account-integrity review status

Essential competition messages include entry confirmations, pick receipts, deadline reminders, security notices, winner communications, and material administration updates. These messages are part of operating your entry.

Promotional messages, including referral promotions and optional prize announcements, are separate. New entrants choose whether to receive them and may unsubscribe using the link in a promotional email. Unsubscribing from promotional messages does not stop essential competition messages.

• No access to your Gmail, Drive, Contacts, Calendar, or Photos. Sign-in requests basic profile and email only.
• No payment-card or bank-account information.
• No Social Security number or government ID during ordinary registration.
• No advertising identifiers or sale of personal information.
• No precise GPS location.
• No full street address unless you become a potential prize winner and verification requires it.

Picks stay hidden from other players until that game’s deadline passes. After the deadline they’re visible to everyone in your league, which is the point of the game.

Your league’s commissioner administers the database and can therefore access the underlying records. The app enforces the deadline rules for everyone including them, but you should treat your commissioner the way you’d treat anyone running a league spreadsheet.

National standings display only an automatically generated player ID such as JT1. Legal name, email, phone information, country, region, and review signals are not public.

Repeated registrations associated with an identity, device, or network may be flagged for commissioner review. A shared household or network is not by itself grounds for disqualification. Potential winners may be asked for a government ID, residential address, and legally required tax information through a secure verification process.

Data is stored in a Postgres database hosted by Supabase in the United States. The app runs on Vercel. Confirmation emails are delivered through our email provider. Cloudflare processes security-check information, and Google Identity Platform processes phone numbers and verification messages. Each provider processes data on our behalf under its own terms.

Canadian entrants acknowledge that their information is transferred to and processed in the United States, where privacy laws may differ from those in Canada. We use contractual, access-control, encryption, and data-minimization safeguards appropriate to the information and the operation of the Competition.

Picks, standings, rules acceptance, and necessary competition records may be kept through the competition, prize-verification, dispute, and legal retention periods. Short-lived verification-attempt and anti-abuse records are removed when they are no longer needed. We do not keep personal data merely because it may be useful someday.

Use the support form to request access, correction, or deletion. Some records may need to be retained to administer an active competition, resolve disputes, prevent duplicate entries, or meet legal obligations. You can also disconnect the app from your Google account at any time at myaccount.google.com/permissions, which immediately stops it from signing you in.

The national competition is intended only for U.S. residents age 18 or older and Canadian residents age 19 or older.

If this policy changes materially, the date at the top will change and players will be told. Questions can be sent through the support form.