Privacy Policy

1. Introduction

BBMI Sports (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Information We Collect

2.1 Information You Provide

• Account. When you create an account we collect your email address. Your password is handled by Firebase Authentication and is never sent to or stored by BBMI Sports.
• Subscriptions. When you subscribe, Stripe collects and processes your payment details. We do not receive or store your card number. We store your Stripe customer and subscription identifiers, your subscription status, and the email address associated with your payment.
• Newsletter. If you sign up for our free newsletter we collect your email address.
• Feedback. If you send feedback we collect your message, the category and rating you choose, your email address if you provide one, and a one-way hashed version of your IP address used to limit abuse. We do not store the raw IP address.
• Bracket challenge. If you enter a bracket contest we store your picks, the bracket name you choose, and your account identifier and email.

2.2 Automatically Collected Information

• Page views while signed in. When you are signed in we record which pages you visit, when, and which account visited them. Some of these records also contain the account’s email address.
• Anonymous usage events. For visitors who are not signed in we record a random identifier stored in your browser, the general source that brought you to the site, and which parts of the site were used. These records are not linked to a name or email address.
• Hosting and performance. Our host, Vercel, collects standard request and performance information.

3. How We Use Your Information

We use collected information for:

• Providing and maintaining our services
• Processing premium subscriptions and payments
• Sending service-related communications
• Analyzing usage patterns to improve our services
• Measuring the effectiveness of BBMI advertising using the advertising privacy controls described below
• Detecting and preventing fraud or abuse
• Complying with legal obligations

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

• Google Firebase provides authentication and the database that holds accounts, subscription status, alert preferences, bracket entries and usage records.
• Vercel provides hosting, and Vercel Postgres holds newsletter signups and feedback submissions.
• Stripe processes payments and holds payment details.
• Resend delivers our email, including account emails, alerts and the newsletter.

Advertising measurement

BBMI uses Google Ads and Microsoft Ads for advertising measurement in the United States, subject to applicable privacy choices. Microsoft Ads measurement loads only for visitors classified as U.S. and stays blocked when Global Privacy Control or an explicit advertising-measurement opt-out applies. Microsoft does not load for other countries or when region lookup fails. Microsoft UET measures page visits and navigation using browser/request information, which may include cookies or device identifiers, page URLs, IP address and user agent. BBMI does not send customer email, Firebase UID, phone or address fields to Microsoft, and does not add Clarity, Enhanced Conversions or custom Purchase events. See Microsoft's privacy statement.

We use Google Ads technology to measure visits associated with BBMI advertising. When permitted by the controls below, Google may use cookies or device identifiers and receive browser/request information, including the page visited, IP address and user agent. This implementation does not send your account email or Firebase account identifier to Google. Personalized advertising remains disabled. See how Google uses information from partner sites.

4.2 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process or government requests
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or abuse

4.3 Advertising controls

The Advertising privacy settings control governs Google measurement and the U.S. Microsoft Ads opt-out. It does not change account, subscription or checkout access, or the separate operation of existing BBMI analytics and Reddit tracking.

5. Cookies and Tracking Technologies

BBMI and its service providers use browser storage and, where permitted, cookies or device identifiers.

We store a small amount of information in your browser’s local storage to keep you signed in, to remember an anonymous visitor identifier, to remember minor display preferences, and to retain your advertising measurement choice.

Services we rely on, including Google, Microsoft, Vercel and Stripe, may set their own cookies when their features load. Those are governed by their own privacy policies.

Advertising privacy settings

In the United States, Google advertising measurement loads by default unless you have opted out or your browser signals Global Privacy Control. A U.S. opt-out denies advertising storage and user-data permission and enables Google Restricted Data Processing; limited measurement may continue under those restrictions. Personalized advertising and Google Analytics storage remain denied in every region.

For EEA, UK and Switzerland visitors, other countries, and unknown locations, Google does not load until you select Allow Google measurement. Rejecting keeps it blocked. We use our hosting provider's approximate country information to choose this behavior; we do not store your IP address for this decision.

Use the persistent Advertising privacy settings control on any page to allow or reject measurement. A recognized Global Privacy Control signal overrides permission. Withdrawing outside the U.S. reloads the page to stop the Google tag; it cannot undo requests already sent while permission was active. You can also review Google's advertising controls.

We store only a policy version, measurement choice, timestamp and expiry in your browser, separate from your Firebase account. Choices expire after six months and are renewed if the policy version changes. If local storage is unavailable, session storage is used where possible; otherwise a choice may not survive navigation or a new visit. A saved rejection also blocks Microsoft Ads in the U.S.; allowing Google outside the U.S. never enables Microsoft. Withdrawing after Microsoft has loaded reloads the page to stop its automatic navigation tracking; it cannot undo earlier requests. Google's regional consent and restricted processing behavior are unchanged. Existing BBMI analytics and Reddit tracking remain separate.

6. Data Security

We use industry-standard providers and transmit data over encrypted connections. Access to production data is limited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We keep your information for as long as your account exists or as long as it is needed to provide the Service.

We do not currently delete usage records on a fixed schedule. If you would like your information deleted, contact us and we will delete it, except where we are required to keep it by law, such as records of payments.

If you unsubscribe from the newsletter we keep your email address on a suppression list so that we do not email you again.

8. Your Privacy Rights

You can ask us to access, correct or delete your personal information. Contact us and we will handle the request ourselves. There is no self-service deletion tool today.

You can unsubscribe from any marketing email using the unsubscribe link in that email.

Where the law gives you additional rights, we will honor them.

9. Children’s Privacy

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information where applicable
• Right to deletion of personal information
• Right to non-discrimination for exercising CCPA rights

To exercise these rights, contact us. We handle requests ourselves; there is no self-service tool.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise these rights, contact us. We handle requests ourselves; there is no self-service tool.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us through the contact form on our website.