Privacy Policy

Last updated: August 2026

1. Information We Collect

We collect information you provide when creating an account, including your username, email address, and password (stored only as a bcrypt hash, never in plain text). If you sign in with Google, we receive your Google account email and a Google account identifier. We also collect the picks, leagues, and other gameplay data you create while using the service, and ordinary usage data such as IP address, browser or app version, and pages or screens visited.

2. How We Use Your Information

We use this information to operate LockLeagues: authenticating you (on the web app via a signed session cookie, and in the mobile app via a short-lived access token and a longer-lived rotating refresh token), computing league standings and picks history, and communicating with you about your account. We do not use your information for advertising and do not sell your information to third parties.

3. Third-Party Services

If you sign in with Google, Google processes the sign-in on our behalf; Google's privacy policy is available at policies.google.com/privacy. Sportsbook odds data used to populate picks comes from The Odds API and does not include information about you.

4. Cookies and Tokens

The web app uses one strictly necessary, signed session cookie to keep you signed in; it is tamper-proof but not encrypted, so it should never be shared. We do not use cookies for advertising, tracking, or analytics. The mobile app stores its sign-in credential encrypted on your device instead of in a cookie.

5. Data Retention and Deletion

We retain account information while your account is active. Accounts created in the mobile app, including those that sign in with Google, can be scheduled for deletion at any time from the app's account settings by confirming your password. If you don't have the app, or your account was created on the LockLeagues website using Google and has no password set, email us and we will delete it for you; see how to delete your account. Scheduling deletion starts a 14-day grace period during which your account stays fully active and the request can be canceled at any time from account settings. Once the grace period ends, deletion is permanent: it removes your account and revokes its sign-in sessions; leagues you created are kept for other members but are no longer attributed to you. Deleted data is removed from the live application at that point, but may persist in encrypted, access-restricted database backups for up to 15 days, our automated backup retention window; point-in-time recovery, used only to restore service after data loss, covers the most recent 7 days of that window. Backups are not accessed or used for any other purpose.

6. Contact

Questions about this policy, and account-deletion requests, can be sent to team@lockleagues.com.