Privacy Policy

Last Updated: April 9, 2026

At Offseason ("we", "us", or "our"), we respect your privacy and we keep our data practices as boring as possible. This Privacy Policy explains what information we collect, how we use it, and the controls you have over it when you use the Offseason mobile app or this website (collectively, the "Service").

What We Collect

We only collect what we genuinely need to run the Service. Here's the full list:

Category	What it is	Why we have it
Account info	Email address, hashed password, chosen username, profile emoji	To create and authenticate your account, and so your league commissioner can find you.
Pick'em data	Your predictions, bracket picks, and selections for any tournament you enter (e.g. group-stage scores, knockout bracket, champion pick)	To score your entry, show you on the leaderboard, and let your league compare picks.
League membership	Which leagues you're in, your role (member or commissioner)	To grant you access to the right leaderboards and pick views.
Device info	Device type, OS version, app version, language preference	To send you the right notifications, debug crashes, and serve the right localized experience.
Server logs	IP address, request timestamp, error codes	Standard web-server logs for security, abuse prevention, and uptime debugging. Rotated regularly.

That's it. We do not collect: real names, phone numbers, dates of birth, contact lists, precise location, photos, microphone access, advertising IDs, or anything else not in the table above.

Analytics

We run our own first-party analytics so we can understand how the Service is used and make it better. We do not use Google Analytics, Mixpanel, Segment, Meta Pixel, or any other third-party tracker. No data about your use of the Service is shared with any third party for advertising or profiling purposes.

Our analytics are aggregate-only. When you use the Service we count events (for example, "pageview of /home") in hourly buckets. For each event we store:

• What happened: event name (from a fixed allowlist like page_view, picks_submitted, league_created) and an optional short label (e.g. the page path or team code).
• Approximate where: country (2-letter code from our CDN's edge header, never your IP), and if our CDN provides it, state/province. We never store your IP address in analytics.
• Approximate who: the primary language from your browser's Accept-Language header, collapsed to a 2-letter code (en, es, pt-BR, etc.). No user ID is attached.
• Platform: web, iOS, or Android — so we can tell platforms apart in aggregate.

We explicitly do not store in our analytics: IP addresses, user IDs, device fingerprints, user agents, advertising IDs, or any other identifier that could single you out. Counts are updated in-place, so the same row represents many people's activity at once. Analytics rows are kept for as long as they remain useful for product decisions, but they are never de-anonymized, sold, or shared with third parties.

If your browser sends a Do-Not-Track signal, our web tracker skips itself and records nothing on that page load. In our mobile apps, analytics is disabled when the OS reports that analytics tracking is off in device settings.

Waitlist

If you give us your email on our pre-launch waitlist form, that's different from analytics. You're intentionally handing us your email so we can tell you when the product is ready. We store your email, the date you signed up, and the IP address and browser your signup came from (to catch spam sign-ups and bots). This data is accessible to the Offseason admin (currently one person, the founder) in the internal admin dashboard.

We use your waitlist email for exactly one thing: one operational email telling you the product is live. We don't send marketing drips, promos, or re-engagement campaigns. You can remove yourself at any time by emailing privacy@offseason.org; we'll delete your row within 7 days. When the product launches and you create a full Offseason account, the waitlist entry is archived and then deleted within 30 days.

How We Use It

We use your data for exactly these purposes, nothing more:

• Run the Service: Score your picks, render leaderboards, sync your data across your devices, and let you compare picks with your league.
• Account security: Log you in, recover your password, detect suspicious access attempts.
• Communication: Send you operational emails (password resets, league invites, important account notices). We don't send marketing emails, so there are no marketing emails to opt out of.
• Improve the app: Look at aggregate, anonymized usage patterns (see the Analytics section above) to fix bugs and improve features. We do not profile individual users, and we do not combine analytics data with your account data.
• Share data points publicly: We may occasionally publish aggregate, anonymized stats to social (e.g. "top 3 champion picks across all our users"). These are computed at the same aggregate level — no single user is identifiable.

Data Sharing

We do not sell your personal data. Ever. To anyone. Full stop.

We share data only in these limited circumstances:

• Within your league: Your username, profile emoji, picks, points, and rank are visible to other members of leagues you join. That's the entire point of a pick'em.
• Service providers: We use a small set of trusted vendors (cloud hosting, transactional email delivery, crash reporting). They process data only on our behalf, under contract, and only the minimum needed to do their job.
• Legal compliance: If we receive a valid legal request (court order, subpoena, etc.) that we are legally required to honor, we may disclose the specific data the request covers. We will resist overbroad requests where we can.
• Business changes: If Offseason is ever acquired by or merged into another company, your data may transfer as part of the deal. The new owner inherits this Privacy Policy and your rights under it.

Security

We take security seriously and use industry-standard practices:

• Encryption in transit: All traffic between your device and our servers uses HTTPS (TLS 1.2+).
• Encryption at rest: Sensitive fields (including hashed passwords) are encrypted in our database.
• Password hashing: We never store plaintext passwords. We use a modern, salted, slow hash (bcrypt or equivalent).
• Access control: Only a small number of authorized engineers can access production data, and only when necessary for support or security work.
• Regular review: We review our security posture regularly and patch dependencies promptly.

That said, no system is bulletproof. If we ever discover a security incident that affects your data, we will notify you and the appropriate authorities promptly.

Your Rights

You have control over your data. You can, at any time:

• Access: Request a copy of the personal data we hold about you. We'll send it within 30 days.
• Correct: Update your username, email, password, and profile emoji from inside the app. For anything else, email us.
• Delete: Request that we permanently delete your account and all associated data. We'll do it within 30 days, except where we are legally required to retain something (e.g., for fraud-prevention records).
• Export: Request a portable copy of your account data in JSON format.
• Object: Ask us to stop processing your data for any non-essential purpose.

To exercise any of these rights, email privacy@offseason.org. We don't make you fill out forms or wait for a ticket queue.

Data Retention

We keep your data for as long as your account is active. If you delete your account, we permanently delete your personal data within 30 days, with two narrow exceptions:

• Anonymized aggregate stats: Things like "120,000 users played a given tournament pick'em". These contain no personal data and may be retained.
• Legal records: If we're legally required to keep certain records (e.g. for tax or fraud-prevention reasons), we retain only the minimum necessary for the legally required period.

Children

Offseason is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, please email us at privacy@offseason.org and we will delete the account.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you via email and update the "Last Updated" date at the top of this page. Your continued use of the Service after a change becomes effective constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy, our data practices, or you'd like to exercise any of your data rights, get in touch: