Privacy Policy
Version 2.0.0 · Effective July 7, 2026
Privacy Policy
Version: 2.0.0 Effective Date: July 7, 2026
Plain-English summary (not a substitute for the Policy): We collect the minimum needed to run your pool: your email, a display name, and your league activity (picks, results, standings). We send league emails, never marketing blasts. We don't run ads, we don't sell your data, and today we don't even run analytics. Your league can see your picks after kickoff — that's the game.
1. Who We Are
SquiFi LLC ("Cover," "we," "us") operates the Cover application at coverpool.app (the "Service"), software for running private NFL pick'em pools. For the personal data described here, Cover is the data controller. Contact: coverpool.app@gmail.com.
2. Data We Collect
We collect only what the Service needs to function:
2.1 Account data (you provide it).
- Email address (used for sign-in links and league notifications)
- Display name (shown to your league)
- Optional avatar image
2.2 League activity data (created by using the Service).
- League memberships, roles (member, commissioner, co-owner), and team assignments
- Your picks, pick timestamps, confidence designations, graded results, records, and standings
- League administration records (invites you send or accept, commissioner actions affecting you, audit-log entries that reference your account)
- Your acceptances of legal documents (which version, when)
2.3 Technical data (collected automatically).
- Authentication session data via essential cookies (see Section 6)
- Server logs kept by our infrastructure providers (IP address, browser user-agent, request timestamps) for security and operations
- If an error occurs while you use the app, our error-monitoring service receives a technical report of the error which can include your IP address, browser details, and the page involved
What we do NOT collect: no payment or financial information (the Service currently charges nothing and processes no payments); no precise location; no contacts or address book; no advertising identifiers; no analytics profiles (see Section 6); no data from anyone under 18 knowingly (Section 10).
3. How We Use Data
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Signing you in (magic links) and keeping your session | Email, session cookies | Contract |
| Running your leagues: picks, grading, standings, tiebreakers, deadlines | Account + league activity data | Contract |
| League notifications by email (invites, pick reminders, deadlines approaching, results graded, corrections, playoff events) | Email, league activity | Contract |
| Enforcing competitive integrity (deadline locks, pick visibility rules, audit logging of administrative actions) | League activity, audit records | Contract; legitimate interest (fair play, dispute records) |
| Security, debugging, and keeping the Service running | Technical data, error reports | Legitimate interest (secure, working software) |
| Legal-document versioning and acceptance records | Acceptance records | Legal obligation; legitimate interest |
We do not use your data for advertising, we do not sell or rent it to anyone, and we do not send marketing email. Every email the Service sends is operational — it's about your league.
4. Who Sees Your Data
4.1 Your league. Members of a league you join can see your display name, avatar, assigned team, your picks only after the applicable deadline/kickoff (never before), your record, standings, and league-visible activity. League commissioners additionally see administration records (for example, the audit log of corrections). This sharing is inherent to running a pool and cannot be turned off while you're in a league.
4.2 Service providers (processors). We use a small set of infrastructure providers that process data on our instructions:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database, authentication, backend hosting | All account and league data; auth logs |
| Vercel | Application hosting and delivery | Technical data (server logs) |
| Resend | Transactional email delivery | Email address, notification content |
| Sentry (Functional Software, Inc.) | Error monitoring | Error reports (may include IP, browser details) |
Sports schedules, scores, and point-spread data are fetched from third-party sports-data sources (such as ESPN's public scoreboard and sportsbook line aggregators) by our servers; no personal data about you is sent to them.
4.3 Legal and safety. We may disclose data if required by law, or to protect the rights, safety, or integrity of the Service or its users.
4.4 Business transfers. If Cover is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to this Policy.
5. International Transfers
Our providers process data in the United States. If you use the Service from outside the U.S. (including the EU/EEA or UK), your data is transferred to and processed in the U.S. Where required, transfers rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework (where a provider is certified) and/or Standard Contractual Clauses in our providers' data-processing agreements.
6. Cookies — Essential Only
The Service sets only essential cookies: the authentication cookies required to keep you signed in. There are no advertising cookies, no third-party tracking cookies, and no analytics running today. If we later introduce analytics, it will be consent-gated (asked for, not assumed), and this Policy will be updated first — which requires your re-acceptance for material changes (Section 11). Because only essential cookies are used, no cookie-consent banner is currently required.
7. Data Retention
- Account and league data: kept while your account is active. League history (picks, results, standings) is the shared record of your pool and persists for the life of the league.
- Account deletion: when you request deletion, your account is soft-deleted immediately and purged within 30 days. League records that must remain coherent for other members (for example, past graded results your picks contributed to) are anonymized rather than destroyed — your identity is removed; the league's history stays intact.
- Audit logs: retained for the life of the relevant league, as the dispute-record for league administration.
- Server and error logs: retained per our providers' standard rolling windows.
8. Your Rights
Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have rights to access, receive a copy of, correct, delete, or restrict the processing of your personal data, to object to processing based on legitimate interest, and to data portability. California residents: we do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA, and we collect only the categories described in Section 2 for the purposes in Section 3.
How to exercise any right: email coverpool.app@gmail.com from the address on your account. We fulfill these requests directly (there is no self-service export/deletion flow in-app yet) and will respond within the timeframe the applicable law requires. You also have the right to complain to your local data-protection authority.
9. Security
Access to data is controlled with row-level security in the database (league data is scoped to league members; your picks are hidden from other members until the deadline passes by the same mechanism), transport encryption everywhere, and administrative access limited to what operating the Service requires. Sign-in is passwordless — there is no password of yours for us to lose — which also means your email account controls your Cover account; protect it accordingly.
10. Children
The Service is for adults 18 and older. We do not knowingly collect personal data from anyone under 18; if you believe a minor has an account, contact us and we will delete it.
11. Changes to This Policy
We version this Policy. Each version is stored with a version number and cryptographic hash, and your acceptance of a specific version is recorded. Material changes require you to review and accept the new version before continuing to use the Service.
12. Contact
Privacy questions or requests: coverpool.app@gmail.com
Postal address: SquiFi LLC, 555 NE 34th Street APT 904, Miami, FL 33137