Privacy Policy

1. Introduction

BBMI Sports (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Information We Collect

2.1 Information You Provide

• Account. When you create an account we collect your email address. Your password is handled by Firebase Authentication and is never sent to or stored by BBMI Sports.
• Subscriptions. When you subscribe, Stripe collects and processes your payment details. We do not receive or store your card number. We store your Stripe customer and subscription identifiers, your subscription status, and the email address associated with your payment.
• Newsletter. If you sign up for our free newsletter we collect your email address.
• Feedback. If you send feedback we collect your message, the category and rating you choose, your email address if you provide one, and a one-way hashed version of your IP address used to limit abuse. We do not store the raw IP address.
• Bracket challenge. If you enter a bracket contest we store your picks, the bracket name you choose, and your account identifier and email.

2.2 Automatically Collected Information

• Page views while signed in. When you are signed in we record which pages you visit, when, and which account visited them. Some of these records also contain the account’s email address.
• Anonymous usage events. For visitors who are not signed in we record a random identifier stored in your browser, the general source that brought you to the site, and which parts of the site were used. These records are not linked to a name or email address.
• Hosting and performance. Our host, Vercel, collects standard request and performance information.

3. How We Use Your Information

We use collected information for:

• Providing and maintaining our services
• Processing premium subscriptions and payments
• Sending service-related communications
• Analyzing usage patterns to improve our services
• Detecting and preventing fraud or abuse
• Complying with legal obligations

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

• Google Firebase provides authentication and the database that holds accounts, subscription status, alert preferences, bracket entries and usage records.
• Vercel provides hosting, and Vercel Postgres holds newsletter signups and feedback submissions.
• Stripe processes payments and holds payment details.
• Resend delivers our email, including account emails, alerts and the newsletter.

4.2 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process or government requests
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or abuse

4.3 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Cookies and Tracking Technologies

BBMI Sports does not set its own cookies.

We store a small amount of information in your browser’s local storage to keep you signed in, to remember an anonymous visitor identifier, and to remember minor display preferences.

Services we rely on, including Vercel and Stripe, may set their own cookies when their features load. Those are governed by their own privacy policies.

6. Data Security

We use industry-standard providers and transmit data over encrypted connections. Access to production data is limited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We keep your information for as long as your account exists or as long as it is needed to provide the Service.

We do not currently delete usage records on a fixed schedule. If you would like your information deleted, contact us and we will delete it, except where we are required to keep it by law, such as records of payments.

If you unsubscribe from the newsletter we keep your email address on a suppression list so that we do not email you again.

8. Your Privacy Rights

You can ask us to access, correct or delete your personal information. Contact us and we will handle the request ourselves. There is no self-service deletion tool today.

You can unsubscribe from any marketing email using the unsubscribe link in that email.

Where the law gives you additional rights, we will honor them.

9. Children’s Privacy

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information (we don’t sell data)
• Right to deletion of personal information
• Right to non-discrimination for exercising CCPA rights

To exercise these rights, contact us. We handle requests ourselves; there is no self-service tool.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise these rights, contact us. We handle requests ourselves; there is no self-service tool.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us through the contact form on our website.