Privacy Policy

Last updated: August 2026

1. Information We Collect

We collect information you provide when creating an account, including your username, email address, and password (stored only as a bcrypt hash, never in plain text). If you sign in with Google, we receive your Google account email and a Google account identifier. We also collect the picks, leagues, and other gameplay data you create while using the service, and ordinary usage data such as IP address, browser or app version, and pages or screens visited.

2. How We Use Your Information

We use this information to operate LockLeagues: authenticating you (on the web app via a signed session cookie, and in the mobile app via a short-lived access token and a longer-lived rotating refresh token), computing league standings and picks history, and communicating with you about your account. We do not use your information for advertising and do not sell your information to third parties.

3. Third-Party Services

If you sign in with Google, Google processes the sign-in on our behalf; Google's privacy policy is available at policies.google.com/privacy. Sportsbook odds data used to populate picks comes from The Odds API and does not include information about you.

4. Cookies and Tokens

The web app uses one strictly necessary, signed session cookie to keep you signed in; it is tamper-proof but not encrypted, so it should never be shared. We do not use cookies for advertising, tracking, or analytics. The mobile app stores its sign-in credential encrypted on your device instead of in a cookie.

5. Data Retention and Deletion

We retain account information while your account is active. Any account, including one linked to Google, can be permanently deleted at any time from the mobile app's account settings, which removes your account and revokes its sign-in sessions; leagues you created are kept for other members but are no longer attributed to you. If you don't have the mobile app, contact us at team@lockleagues.com to request deletion. Deleted data is removed from the live application immediately, but may persist in encrypted, access-restricted database backups for up to 15 days, our automated backup retention window; point-in-time recovery, used only to restore service after data loss, covers the most recent 7 days of that window. Backups are not accessed or used for any other purpose.

6. Contact

Questions about this policy can be sent to team@lockleagues.com.