Privacy Policy
Version 3.0.0 · Effective July 26, 2026
Privacy Policy
Version: 3.0.0 Effective Date: August 1, 2026
Plain-English summary (not a substitute for the Policy): We collect the minimum needed to run your pool: your email, a display name, and your league activity (picks, results, standings). We send league emails, never marketing blasts. We don't run ads and we don't sell your data. We use Google Analytics to understand how the app is used — in the EEA, UK, and Switzerland it stays off unless you opt in, and you can turn it off anywhere via the "Cookie preferences" link. Your league can see your picks after kickoff — that's the game.
1. Who We Are
SquiFi LLC ("Cover," "we," "us") operates the Cover application at coverpool.app (the "Service"), software for running private NFL pick'em pools. For the personal data described here, Cover is the data controller. Contact: coverpool.app@gmail.com.
2. Data We Collect
We collect only what the Service needs to function, plus consent-gated analytics:
2.1 Account data (you provide it).
- Email address (used for sign-in links and league notifications)
- Display name (shown to your league)
- Optional avatar image
2.2 League activity data (created by using the Service).
- League memberships, roles (member, commissioner, co-owner), and team assignments
- Your picks, pick timestamps, confidence designations, graded results, records, and standings
- League administration records (invites you send or accept, commissioner actions affecting you, audit-log entries that reference your account)
- Your league's dues and payout bookkeeping: whether your commissioner has marked your league dues as collected or a payout as paid, and who recorded it and when. This is record-keeping your commissioner enters — the Service never collects bank, card, or payment details and never moves money (see Terms of Service Section 3)
- Your acceptances of legal documents (which version, when)
2.3 Technical data (collected automatically).
- Authentication session data via strictly necessary cookies (see Section 6)
- Server logs kept by our infrastructure providers (IP address, browser user-agent, request timestamps) for security and operations
- If an error occurs while you use the app, our error-monitoring service receives a technical report of the error which can include your IP address, browser details, and the page involved
2.4 Analytics data (only when analytics runs for you — see Sections 6 and 7).
- Pages you view and product events (for example, that a pick was submitted or a league was created — never the content of a pick or anything else personal)
- Device and browser type, and an approximate location that Google derives from your connection
- Google's analytics identifiers (the
_gacookies), used to count visitors and sessions
We do not send Google your email address, display name, picks, or any other personal details from your account.
What we do NOT collect: no bank, card, or payment credentials (the Service processes no payments and moves no money — the dues bookkeeping in Section 2.2 is a note your commissioner types in); no precise location; no contacts or address book; no advertising identifiers or advertising profiles; no data from anyone under 18 knowingly (Section 11).
3. How We Use Data
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Signing you in (magic links) and keeping your session | Email, session cookies | Contract |
| Running your leagues: picks, grading, standings, tiebreakers, deadlines | Account + league activity data | Contract |
| League notifications by email (invites, pick reminders, deadlines approaching, results graded, corrections, playoff events) | Email, league activity | Contract |
| Enforcing competitive integrity (deadline locks, pick visibility rules, audit logging of administrative actions) | League activity, audit records | Contract; legitimate interest (fair play, dispute records) |
| Security, debugging, and keeping the Service running | Technical data, error reports | Legitimate interest (secure, working software) |
| Understanding how the product is used, so we can improve it | Analytics data (Section 2.4) | Consent (EEA/UK/Switzerland); legitimate interest with an always-available opt-out (everywhere else) |
| Legal-document versioning and acceptance records | Acceptance records | Legal obligation; legitimate interest |
We do not use your data for advertising, we do not sell or rent it to anyone, and we do not send marketing email. Every email the Service sends is operational — it's about your league. Analytics is measurement only: it is never used for advertising, and Google may process it only on our instructions (Section 7).
4. Who Sees Your Data
4.1 Your league. Members of a league you join can see your display name, avatar, assigned team, your picks only after the applicable deadline/kickoff (never before), your record, standings, and league-visible activity. League commissioners additionally see administration records — the audit log of corrections and the dues/payout bookkeeping described in Section 2.2. This sharing is inherent to running a pool and cannot be turned off while you're in a league.
4.2 Service providers (processors). We use a small set of providers that process data on our instructions:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database, authentication, backend hosting | All account and league data; auth logs |
| Vercel | Application hosting and delivery | Technical data (server logs) |
| Resend | Transactional email delivery | Email address, notification content |
| Sentry (Functional Software, Inc.) | Error monitoring | Error reports (may include IP, browser details) |
| Google LLC | Analytics (Google Analytics 4) | Analytics data (Section 2.4), only when analytics runs for you |
Google processes analytics data as our processor under Google's data-processing terms; Google Signals is off, no advertising products are linked, and analytics data is not used for advertising (Section 7).
Sports schedules, scores, and point-spread data are fetched from third-party sports-data sources (such as ESPN's public scoreboard and sportsbook line aggregators) by our servers; no personal data about you is sent to them.
4.3 Legal and safety. We may disclose data if required by law, or to protect the rights, safety, or integrity of the Service or its users.
4.4 Business transfers. If Cover is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to this Policy.
5. International Transfers
Our providers process data in the United States. If you use the Service from outside the U.S. (including the EU/EEA, UK, or Switzerland), your data is transferred to and processed in the U.S. Where required, transfers rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework (Google LLC is a certified participant; other providers where certified) and/or Standard Contractual Clauses in our providers' data-processing agreements.
6. Cookies and Your Choices
6.1 What we set. The Service uses these cookies:
| Cookie | Set by | Category | Purpose | Lifetime |
|---|---|---|---|---|
sb-…-auth-token (may be split into numbered parts) | Cover (Supabase Auth) | Strictly necessary | Keeps you signed in | For the life of your sign-in session; refreshed while you use the Service |
cover_consent | Cover | Strictly necessary | Records your cookie choices so we honor them and don't re-ask | Up to 12 months |
_ga, _ga_… | Google Analytics | Analytics | Distinguishes visitors and sessions for the measurement described in Section 7 | Up to 2 years, or until you withdraw consent or clear them |
There are no advertising cookies and no third-party tracking cookies. The Service also uses your browser's local storage for a light/dark theme preference (cover-theme) and to mirror your cookie choices; this stays on your device and is not sent to us.
6.2 If you are in the EEA, UK, or Switzerland: analytics is opt-in. On your first visit you'll see a cookie banner. Analytics is off until you accept it — no analytics tag loads, no analytics cookie is written, and Google Consent Mode v2 signals default to "denied." Declining (or ignoring the banner) leaves only the strictly necessary cookies above.
6.3 Everywhere else: analytics runs by default, with an opt-out. If you're outside those regions, analytics runs unless you turn it off.
6.4 Changing your mind. A persistent "Cookie preferences" link in the Service lets you review and change your choice at any time. Withdrawing consent (or opting out) stops analytics and removes Google's analytics cookies for this site. Withdrawal is as easy as acceptance was.
7. Analytics (Google Analytics 4)
We use Google Analytics 4 to measure page views and product events, configured to collect as little as possible:
- Google Signals is off, no Google advertising products are linked, and analytics data is not used for advertising — by us or, on our instructions, by Google.
- Retention in Google Analytics is set to 14 months, the shortest multi-season window GA4 offers.
- No personal details are sent: events carry no email addresses, names, picks, or other account data. Per Google's documentation, GA4 does not log or store IP addresses for EU-based users; IPs are used transiently to derive coarse location.
- Google LLC processes this data as our processor under Google's data-processing terms and is a certified EU-U.S. Data Privacy Framework participant.
8. Data Retention
- Account and league data: kept while your account is active. League history (picks, results, standings) is the shared record of your pool and persists for the life of the league.
- Account deletion: you can delete your account yourself from your Account page (or by emailing us). Deletion takes effect immediately — you are signed out everywhere and your email address is released (you could sign up fresh with it right away) — and your account is scheduled for a final scrub that permanently removes remaining identifying details within 30 days. During that 30-day window we can restore a deleted account if you contact us; after the scrub, restoration is impossible. The deletion record itself briefly retains your email so we can process a restore request; the 30-day scrub removes it. League records that must remain coherent for other members (for example, past graded results your picks contributed to) are anonymized rather than destroyed — your identity is removed; the league's history stays intact.
- Audit logs: retained for the life of the relevant league, as the dispute-record for league administration.
- Analytics data: retained in Google Analytics for 14 months (Section 7).
- Server and error logs: retained per our providers' standard rolling windows.
9. Your Rights
Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have rights to access, receive a copy of, correct, delete, or restrict the processing of your personal data, to object to processing based on legitimate interest, to withdraw consent, and to data portability.
We extend the core of these rights to all users, wherever you live — access, correction, deletion, and opting out of analytics — even where no privacy law requires us to. We do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA, and we do not use it for targeted advertising, so there is nothing to opt out of on that front.
How to exercise your rights:
- Deletion: self-service from your Account page (see Section 8), or by email.
- Analytics opt-out / consent withdrawal: the "Cookie preferences" link, any time (Section 6).
- Correction: your display name is editable in the app; for your email address or anything else, contact us.
- Access / copy of your data and everything else: email coverpool.app@gmail.com from the address on your account. There is no self-service data-export button yet; we fulfill these requests directly and will respond within the timeframe the applicable law requires.
You also have the right to complain to your local data-protection authority.
10. Security
Access to data is controlled with row-level security in the database (league data is scoped to league members; your picks are hidden from other members until the deadline passes by the same mechanism), transport encryption everywhere, and administrative access limited to what operating the Service requires. Sign-in is passwordless — there is no password of yours for us to lose — which also means your email account controls your Cover account; protect it accordingly.
11. Children
The Service is for adults 18 and older. We do not knowingly collect personal data from anyone under 18; if you believe a minor has an account, contact us and we will delete it.
12. Changes to This Policy
We version this Policy. Each version is stored with a version number and cryptographic hash, and your acceptance of a specific version is recorded. Material changes require you to review and accept the new version before continuing to use the Service.
13. Contact
Privacy questions or requests: coverpool.app@gmail.com
Postal address: SquiFi LLC, 555 NE 34th Street APT 904, Miami, FL 33137