Privacy Policy
1. What this page is
A plain description of the personal data this app handles today. The formal privacy policy (LGPD/GDPR legal bases, processor agreements, age gating) is pending counsel review.
2. Data we store
Account data: your email address, an optional username, an optional password (stored only as a hash), your language preference, the sport you last visited, and the timestamp of your Terms consent.
Gameplay data: the leagues you own or joined, your teams, rosters, and per-round lineup history.
Technical data: signed session and login tokens, and — for abuse protection — request counters keyed by IP address and email address, kept in server memory for at most one hour.
3. What we use it for
Running the game, sending the login and invitation emails you request, remembering your preferences, and protecting the service against abuse. Nothing else — there is no advertising and no sale of data.
4. What other users see
Members of your leagues see your display name (your username, or the part of your email before the @) and your in-league activity: teams, lineups, and standings. Public leagues are listed in Discover with their names.
5. Service providers
The app runs on cloud hosting (Fly.io), sends email through a delivery provider (Resend), and licenses sports data from API-Sports. Formal data-processing agreements with these providers are part of the pending compliance work.
6. Cookies
The app sets a signed session cookie, an optional "stay logged in" cookie (14 days), and stores your theme choice in your browser. There are no third-party trackers and no analytics cookies today.
7. Your tools and rights
Settings gives you a copy of your data ("Download my data", a JSON file) and account deletion. Deleting your account permanently deletes the leagues you own and removes your teams and memberships from leagues you don't own.
The mapping of these tools to specific LGPD and GDPR rights will be documented here after counsel review.
8. Retention
Account and gameplay data is kept while your account exists and is deleted as described above when you delete it. Database backups kept by the hosting provider expire on their own schedule.
9. Changes and contact
When this page changes in substance, the version identifier at the top changes with it.
A dedicated support contact will be published here before public launch.
Version: 2026-07-13-draft · Terms of Service