Privacy Policy

1. What we collect

1.1 What you give us

• Account details: your email address, username and password. Passwords are stored only as a salted hash; we never see or store the plain text.
• Your fan identity: the team you plant your flag for and the city you type in. We turn the city into approximate map coordinates using Apple's geocoding service. We never ask for or read your device's GPS location.
• Profile images: a profile photo and banner if you choose to upload them from your photo library. Only the image you pick is uploaded.
• What you post and play: Discuss posts, replies, polls, charts and rankings; ballots; picks and forecasts; your fantasy roster; trivia and Drop the Pin answers; and the notification and team preferences you set.
• Newsletter subscription: your email address if you subscribe to the CFB Brief or hold a Pro subscription (Pro members receive it; every issue has an unsubscribe link).
• Subscription details: if you buy Sports Index Pro, we receive the subscription transaction identifiers, the product you bought, and its status and renewal or expiry dates from Apple or from Stripe so we can activate and manage Pro. We never see your card number: Apple or Stripe handles payment.
• Messages you send us: support and prize-claim emails, including a shipping address if you win a prize.

1.2 What the Service records as you use it

• Activity inside the app: check-ins and streaks, points, drawing tickets, game results and leaderboard standings. This is the score-keeping the Service is built on.
• Push token: if you allow notifications, the token Apple assigns to your device so we can deliver them.
• Technical data: your IP address, app version, device type and operating system, and the time, method, path and result of each request. Query strings, including the search terms you type, are not written to our request logs. We use these for security, rate limiting and debugging, and keep them in short-lived server logs.
• Who you follow: the teams, players and other fans you choose to follow in the app. We never read your device's address book.

1.3 What we do not collect

No precise location, no access to your device's address book, no calendar, no microphone or camera access, no advertising identifier, no health data, and no third-party analytics or advertising SDKs. The app does not use Sign in with Apple, Google or any other third-party login.

2. How we use it

• Create and secure your account, verify your email, and sign you in
• Run the Service: count you in your team's fan census, place you on the fan map, keep your streak, score your picks and roster, rank leaderboards, and post what you write in Discuss
• Run the Weekly Drawing: convert points to tickets, pick a winner, notify the winner and ship the prize
• Send notifications you have opted into and emails about your account
• Personalize what you see, such as coverage for the teams you follow
• Detect and prevent abuse: duplicate accounts, automation, vote or point manipulation, and attacks on the Service
• Understand how the Service is used, in aggregate, so we can improve it
• Comply with the law and enforce our Terms

3. What other people can see

Sports Index is a social app for fans, so some of your information is visible to other users by design:

• Your username, profile photo and banner
• The team you support and the city you planted your flag in, on the fan map and in the census
• Your Discuss posts, polls, rankings and replies
• Your points, streak, standings and results on leaderboards and in competitions
• Your username in the Winners list if you win a Weekly Drawing

Your email address, password, push token, IP address and shipping address are never shown to other users.

4. Who we share it with

We share personal information only with the companies that help us run the Service, and only what they need:

• Hosting and storage: Railway hosts our servers and database and stores uploaded images.
• Email: SendGrid delivers verification, account and prize emails and the CFB Brief newsletter.
• Push notifications: Apple's Push Notification service delivers notifications to your device.
• Geocoding: Apple's geocoding service converts the city you type into map coordinates.
• AI summaries: we use Anthropic's models to write summaries of public college football coverage. The text sent for summarizing is public news and social content, not your account information.
• Sports data: scores, schedules and statistics come from third-party data providers. Nothing about you is sent to them.

We may also disclose information when the law requires it, to respond to a valid legal request, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of the company, in which case this policy continues to apply to your information.

Embedded content. Pages on the website and in the iOS app may embed posts from X and videos from YouTube (and, on the website, Instagram or TikTok), and links you tap open in an in-app browser. When an embed loads, your device connects to that platform directly and it may collect your IP address, device and browser details and set its own cookies under its own privacy policy; an embedded YouTube video may show YouTube's own non-personalized ads. In the iOS app, X embeds are loaded with X's "do not track" option, YouTube videos use the privacy-enhanced player and load only when you tap play, and each embed runs in a separate, non-persistent web view that shares nothing with your Sports Index sign-in. Sports Index itself shows no ads.

Payments. Apple (for subscriptions bought in the iOS app) and Stripe (for subscriptions bought on the website) process payments and send us the subscription details described above.

5. Cookies and device storage

In the iOS app we store your sign-in token in the device Keychain and keep a cached copy of your profile and your preferences on the device so the app opens quickly. There are no advertising or analytics identifiers.

On the website we set a sign-in cookie and a "logged in" flag when you sign in, and we remember display preferences such as your theme. We do not use advertising cookies. We do not currently respond to browser "Do Not Track" signals because there is no agreed standard for them.

6. Notifications and email

Push notifications are off until you allow them. You can turn each kind on or off in the app's Settings, or turn them all off in iOS Settings, at any time.

We email you to verify your address, to tell you if you win a prize, when you start a Pro subscription, and for other account matters such as password resets. The CFB Brief newsletter goes to subscribers and Pro members; every issue includes an unsubscribe link.

7. How long we keep it, and deleting your account

• Your account and everything tied to it are kept while your account exists.
• Server logs containing IP addresses are kept for a short period for security and debugging, then discarded.
• Aggregate data that does not identify you, such as fan-census counts and past leaderboard results, may be kept indefinitely.

You can delete your account in the app at any time: Settings, then Delete account. Deletion is permanent and removes your profile, email, fan flag, points, picks, roster, ballots, Discuss posts and the images you uploaded; the image files themselves are deleted from storage shortly after, with automatic retries if storage is briefly unavailable. Deleting your account cancels a web (Stripe) subscription; an Apple subscription must be cancelled with Apple. Records we are required or permitted to keep, such as the result of a completed prize drawing, a prize shipping or fulfillment email, and billing audit records (provider transaction identifiers without your name), may be retained. Backup copies are removed within 90 days.

8. Security

Passwords are hashed with bcrypt. All traffic between the app or website and our servers uses HTTPS. Sign-in tokens expire and are stored in the iOS Keychain. Access to production systems is limited to the people who run the Service. No system is perfectly secure, and we cannot guarantee that unauthorized access will never happen; if it does and your information is affected, we will tell you as the law requires.

9. Children

The Service is for users who are 13 or older, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, contact us and we will delete it. Users under 18 can play, but prizes from the Weekly Drawing can only be claimed by an adult, as described in the Official Rules in our Terms.

10. Your rights and choices

Wherever you live, you can:

• See and change your username, profile images, team and notification preferences in the app's Settings
• Delete your account in the app, which removes your personal information as described in Section 7
• Ask us for a copy of the personal information we hold about you, to correct it, or to delete it, by emailing the address below. We may verify your identity first.

California residents. The California Consumer Privacy Act gives you the right to know what personal information we collect and how we use and share it (this policy), to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.

Other U.S. states. If your state's privacy law gives you similar rights, you may exercise them the same way.

11. Changes to this policy

We may update this policy as the Service changes. If a change is material we will tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.

12. Contact

Questions about privacy, or a request to access, correct or delete your information:

• Email: ben@sportsindex.io
• X: @sportsindexapp