What we collect
For online pools we store the pool title, team names, cost, payout split, square names, paid/unpaid flags, scores and the dates they were entered. We also store a salted hash of the IP address that claimed a square or created a pool, so rate limits can be enforced. We do not collect player email addresses.
Admin keys and passwords
A pool admin key is shown once at creation and stored only as a SHA-256 hash. A pool password, if the owner sets one, is stored as a salted scrypt hash. Neither value is included in the public board response.
Cookies
One long-lived, httpOnly cookie holds a random owner id. It ties an online pool and a Season Pass to the same browser. It is not an advertising cookie and is not shared with third parties for tracking.
Third-party processors
Payments are processed by PayPal. The site sends PayPal the plan id and an anonymous custom id so the subscription can be attached to the right browser. No card details reach this server. Analytics is disabled unless the operator configures an analytics id.
Retention and your choices
Pool records are kept while the pool is useful to its organiser. To request deletion of records tied to your cookie or a pool you administer, email [email protected] with the pool link and approximate date. Clearing your browser cookie starts a fresh free limit but does not delete server records.