Cookie Policy

1. What cookies are

2. Types of cookies we use

• Strictly necessary: required for core functionality, including authentication, session security, and CSRF protection. These cannot be turned off without breaking the service.
• Functional: remember your preferences such as the active league, sidebar collapsed state, and locale. Without these the product still works but resets on every visit.
• Analytics: help us understand aggregate usage patterns (page views, feature adoption) so we can improve the product. These are anonymized and do not identify individual users.
• We do not use advertising cookies, cross-site tracking pixels, or third-party retargeting tags.

3. Cookies set by our service providers

• Supabase (authentication): sets session cookies (sb-access-token, sb-refresh-token) so you stay signed in. Required. Supabase also opens a WebSocket connection while the app is open to deliver real-time updates (scores, messages); this uses the same authentication cookies described above.
• Stripe (payments): sets cookies on Stripe-hosted checkout pages for fraud prevention. Only set when you are completing a payment.
• Vercel (hosting): Vercel Analytics and Speed Insights are cookieless and first-party (no third-party tracking, no advertising cookies). Vercel may set a short-lived routing cookie.
• We do not set Google Analytics, Meta Pixel, or any advertising cookies.

4. How to control cookies

• Browser controls: you can clear or block cookies from your browser settings. If you block strictly necessary cookies, you will not be able to sign in.
• Consent banner: when you first visit, we ask whether you accept analytics cookies. You can change your choice at any time via the “Cookie preferences” link in the footer.
• Global Privacy Control: we respect the GPC signal where supported. When detected, we treat it as an opt-out from analytics cookies and skip the banner.

5. Children

6. Changes