Privacy Notice

Last updated: August 2026

This is a casual pick'em game. Your data is not used for marketing, advertising, or sale to anyone. We don't ship newsletters, retargeting pixels, or third-party trackers.

What we collect

When you create or join a rivalry, we store the minimum needed to make the game work:

  • The username you choose.
  • An email address if you provide one (used only to send you league invites, password resets, or admin notifications about your rivalry).
  • The picks, scores, and rankings you submit inside the app.
  • A personal recovery code so you can sign back in if you lose access.
  • Basic technical logs (timestamps, error reports) for keeping the app running.

That's the whole list.

What we do with it

  • Run the game: show your picks to your rivalry, calculate standings, send the occasional league-related email (invites, password resets, admin handoff confirmations).
  • Keep it working: aggregate technical logs to diagnose bugs and improve performance.
  • Nothing else.

What we do NOT do

  • We do not sell, rent, or share your data with third parties.
  • We do not use your data for marketing, advertising, or profiling.
  • We do not send promotional emails. The only emails the app sends are league-related (invites, admin notifications, password resets, league-event updates).
  • We do not run ad networks or analytics trackers (no Google Analytics, no Facebook Pixel, no advertising SDKs).
  • We do not support gambling, wagering, paid entry, prizes, or chance-based outcomes of any kind. Paid features within Tiny Crew Rivalries are limited to administrative tools — such as analytics, customization, and enhanced rivalry management — and do not influence gameplay, scoring, or competition outcomes. Any attempt to use the Platform for gambling or prize-based contests is strictly prohibited and may result in account termination.

Third-party services

We rely on a small, deliberately narrow set of vendors to run the app:

  • MongoDB (managed database) — where your rivalry data lives.
  • Resend — sends the transactional emails listed above.
  • Cloudflare Turnstile — a bot-protection challenge shown on public forms (see Cookies & local storage below for what it sets).
  • API-Sports (API-Football and API-American-Football) — read-only sports data feeds for live fixtures, scores, and standings (soccer and American football).
  • MLB Stats API (official, public feed) — read-only MLB schedule, score, and standings data for the MLB Playoffs template.
  • Highlightly (via RapidAPI) — read-only sports data feed: backup for MLB Playoffs, primary feed for NBA Playoffs.
  • The Odds API — read-only sportsbook odds feed powering spread-line features (e.g. Weekly Spread Challenge, Matchday Boost).
  • Slash Golf (via RapidAPI) — read-only tournament data for PGA and DP World Tour events.
  • Clerk — handles sign-in and identity for Pro+ subscribers only. Free-tier Rivalry Admins, Site Admins, and players continue to sign in through our own bcrypt-hashed local accounts (see Security below). Clerk never sees your picks, scores, or rivalry data — only the email address you use to sign in.
  • Paddle — Merchant of Record for optional Pro+ subscriptions. Card details are entered directly with Paddle and never touch our servers; we only receive a subscription status and a receipt confirmation for your records. Paid features unlocked by Pro+ are limited to administrative tools (analytics, customization, higher limits) and never affect gameplay, scoring, or competition outcomes.
  • Anthropic Claude — powers the in-app AI helpers (Ride Story tournament recaps, Rivalries Intel weekly-pick commentary). In the preview environment we route through the shared Emergent LLM key; in the production environment (beta.tinycrewrivalries.com) we route directly to Anthropic under a Tiny Crew Rivalries API key. Either way, requests carry only short text prompts assembled from public tournament data — no email, no account identifiers, no usernames are ever sent.

No personal data ever leaves the app to the sports-data or AI vendors. Each vendor has their own privacy policy and security controls.

Cookies & local storage

We use the bare minimum client-side storage needed to keep you signed in and remember your session:

  • HttpOnly session cookie — set on sign-in, sent back to our own servers on each request so we know it's you. Not readable by JavaScript. Not shared cross-site. Cleared when you sign out.
  • Local storage — remembers non-sensitive UI state (your session ID, last-viewed rivalry, preferred sort orders). No auth tokens, no personal data, no tracking IDs.
  • Third-party cookies — a Cloudflare Turnstile challenge is served on the "Request League" and login forms to block bots. Cloudflare sets its own short-lived challenge cookie for that page load only.

We do not set advertising cookies, cross-site tracking cookies, or analytics cookies of any kind.

Your controls

  • Delete your account: ask your Rivalry Admin to remove you from a rivalry, or email admin@tinycrewrivalries.com to request a full platform-wide account wipe. We delete the participant record (your picks remain attached to the rivalry only as an anonymized placeholder so the rivalry's history still makes sense).
  • Change your email or username: any time from your participant profile.
  • Request your data: email the contact below; we'll send back what we have on file.

Data retention

  • Active rivalries: data is retained while the rivalry is in use.
  • Free-tier rivalries — completed tournaments: 30 days after a tournament is marked complete, the rivalry auto-archives (read-only, record preserved). Reopening the tournament or upgrading to Premium cancels the countdown.
  • Premium / comp rivalries: retained indefinitely — no auto-archive.
  • Orphan tournaments (no parent rivalry): hard-deleted 45 days after completion so cruft doesn't accumulate.
  • Old draft snapshots: auto-purge after 7 days.
  • Account deletion: 100% of personally-identifying fields are wiped on request. Picks may remain anonymized so rivalry history still adds up.

Security

  • All traffic is TLS-encrypted in transit.
  • Passwords are stored as bcrypt hashes — we cannot read them, even if we wanted to.
  • Rivalry-admin and platform-admin accounts use brute-force lockouts and (for some flows) one-time magic-link verification.
  • Pro+ subscribers sign in via Clerk, which manages its own password/session security independently of our bcrypt-based accounts.

Changes to this notice

If we ever materially change how data is used, we will update this notice and ping all Rivalry Admins through the in-app notification system. Right now this notice is at the "casual, no marketing, no data sale" baseline — that is the level we intend to keep.

Contact

Have a question, want your data, or want it deleted? Email admin@tinycrewrivalries.com and a real human will respond.