Privacy Policy

1. What we collect

• Your account: your name, email address and a hashed password. We never store your password itself.
• Google sign-in, if you use it: your name, email address and profile photo from Google. We don’t get your Google password or anything else in your Google account.
• A profile photo, if you upload one.
• What you do on brckts: the pools, crews and tournaments you create or join, the brackets and picks you make, and your scores.
• People you add: when you add someone to a crew or pool, the name and email address you give us, so we can send them an invite or show them in the pool.
• The pot: entry fees and who has been marked paid, as the pool owner records them. brckts never handles money — see the Terms.
• Your email settings, and a record of the emails we send you, such as invites and bracket lock reminders.

2. Why we use it

• To run your account and sign you in.
• To run pools: show standings, score brackets, and show your name and picks to the people in your pools.
• To send the emails you’ve asked for, like invitations and reminders before a pool locks. You can turn each kind off in Account → Notifications, and every reminder has a one-click unsubscribe link.
• To keep brckts working and secure, and to fix it when it breaks.

We don’t sell your information, and we don’t use it for advertising.

3. Who can see what

• People in your pools see your name, photo, scores and position. They see your picks once the pool locks, never before.
• Everyone can see a pool its owner lists publicly, with the owner’s name, how many people have joined and its standings. Invite-only pools, and open pools that aren’t listed, aren’t shown to the public.
• Tournament owners see the people they invite to help run their tournament.

4. Services that handle your data for us

We use these providers to run brckts. Each only gets what it needs to do its job:

• Vercel hosts the site and stores uploaded photos.
• Prisma hosts the database.
• Resend sends our emails.
• Google signs you in, if you choose Google sign-in.
• Anthropic helps our automated tools read public tournament documents, such as a competition’s regulations. We don’t send it any of your personal information.

These providers may process data in the United States and other countries.

5. Cookies

We use only the cookies needed to keep you signed in and secure. We don’t use advertising or tracking cookies.

6. How long we keep it

We keep your account until you delete it, which you can do yourself in Account settings. Deleting it removes your sign-in and settings. Your name and past entries may stay in the results of pools you played in, so the standings still add up. Ask us at privacy@brckts.app and we’ll remove or anonymize them.

7. Your choices

You can see and change most of your information in Account settings. You can also ask us to send you a copy of your data, correct it, or delete it. Email privacy@brckts.app and we’ll reply within 30 days. Depending on where you live, you may have more rights under local law. We’ll honor them.

8. Children

brckts isn’t meant for children under 13, and we don’t knowingly collect their information. If you think a child has signed up, tell us and we’ll delete the account.

9. Security

We encrypt connections to brckts, hash passwords, and limit who can reach the database. No service is perfectly secure, but we’ll tell you promptly if a breach affects your information.

10. Changes

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll email you before it takes effect.