WHAT WE KEEP.
WHAT YOU CONTROL.

We collect the name, username, email and timezone you provide; sign-in identifiers; password hashes for password accounts; eligibility and Terms acceptance records; optional profile photos and team images; league memberships and settings; submitted tickets, results and balances; support messages; early-access requests; and email subscription and delivery records. Google supplies basic identity information, including an identifier, name and email, when you choose Google sign-in. We do not receive your Google password.

Uploaded images are converted to small square thumbnails. We discard original filenames and image metadata. Your profile photo appears in your account header; team images are visible to active members of that league. Replacing or removing an image deletes the current stored thumbnail; protected backups may retain earlier copies until rotation.

Requests also involve technical information such as IP address, browser and request headers, handled by our host, Cloudflare and security controls. We use bounded security/rate-limit records to protect the service. Do not include sensitive personal information, passwords or verification links in support messages or team names.

We use this information to authenticate you, run leagues and solo play, grade and correct tickets, provide support, prevent abuse and send messages you request or enable. League members see team identity, standings and accepted league bets. Unsubmitted picks are private to your browser. Support requests and early-access requests are available to authorized operators.

Cloudflare handles delivery and security; Google handles optional Google sign-in; Resend processes email delivery; our NUCBox host and protected backups store app data. PayPal separately processes optional support payments under its own policies. We do not receive full payment-card details. We may share information when legally required or necessary to protect users and the service. We do not sell personal information or share it for cross-context behavioral advertising.

Essential session and sign-in cookies keep accounts secure. Browser storage holds demo progress, draft picks, workspace preferences and email-prompt dismissal. No advertising pixels, fingerprinting or session replay are used.

When enabled, Cloudflare Web Analytics measures visits, page views, referrer hosts and performance on approved public pages. Visits are not unique people, and are not linked to individual signups. Our policy excludes private routes, token-bearing URLs and unsafe referrers, and disables its beacon for Do Not Track and Global Privacy Control signals. Cloudflare’s regional exclusions and browser blocking can also prevent measurement. Social links do not load embedded social tracking on our pages; visiting a linked service is subject to its own policies.

Separately, internal aggregate usage reporting can count successful account registrations, first active memberships and first accepted league tickets. Internal account identifiers deduplicate counts; conversion events, names and emails are not sent to Cloudflare. We also calculate internal activity, returning-player, league-participation and completion statistics, and aggregate market/team selections from accepted game records. These reports contain counts rather than player lists and are accessible only to authorized operators. No additional browsing, location or demographic information is collected for these reports. Private league chat posts are visible to active members of that league. Authors and the league commissioner can remove post text; removal records remain for moderation. Your account export includes your own league posts. Historical totals are distinguished from newly tracked events and test activity. Activation dates are recorded by the operator.

Account verification, password recovery and requested service messages are distinct from marketing. Optional league email notifications use your account preferences. Product news and promotional updates require a separate unchecked opt-in followed by email confirmation. We keep the wording, source and time of consent. Unsubscribe links work without signing in. We retain a minimal suppression record to respect opt-outs. Pending subscriptions are not a marketing audience.

During restricted testing, the recipient allowlist may prevent delivery outside approved test addresses. We do not count provider acceptance as proof you received or opened a message. Email bodies do not contain tracking pixels; we do not intentionally measure opens or individual link clicks.

Account and season records are retained while needed to provide the service, preserve shared competition history, resolve disputes and meet legal obligations. Pending and delivery records are retained only as needed for confirmation, troubleshooting and suppression. Protected backups may retain prior copies until their normal rotation. We review deletion requests and explain any records that must remain; we do not promise instant deletion from all backups.

We use access controls, secure transport, password hashing, server-side authorization and protected backups. No system can promise absolute security. Report suspected exposure to the address below without sending credentials or exploiting another user’s account.

Account settings provide profile changes, notification choices and a data export. Request access, correction, account closure, deletion or other applicable privacy rights through Help or by email. We verify requests in a proportionate way before disclosing or changing private information. You can decline marketing without losing access to the service.

Accounts and participation are intended for U.S. adults 18 and older. We do not knowingly collect personal information from children under 13. Contact us if you believe we have done so. Material notice changes are posted here with a new effective date and, where needed, additional notice.

Baarstad Consulting Services
5431 Saratoga St., Yorba Linda, CA 92886, United States
[email protected]