Privacy Policy
Last updated: September 26, 2026
1The short version
PaperBook Sports keeps the data it needs to run a picks game with a public leaderboard, and not much else. There are no ads, no ad trackers, and we never sell or rent your data. You can delete your account and its data yourself from Settings.
2What we collect
Account: your email address, or the email and name Google gives us when you sign in with Google, plus the time you confirmed you are 21 or older. Profile: your handle, the teams and leagues you follow, your card cosmetics, and whether your profile is private. Play: every pick you make, its price, stake and result, your bankroll history, season entries, achievements, missions and XP, the players and leagues you follow, and the tickets and cards you share. Preferences: notification settings and time zone. Product analytics: events about how the app is used (for example that a pick was placed or a board loaded) with a few non-personal properties. They are stored in our own database; we don't use a third-party analytics service. Push subscriptions: if you turn on notifications, the browser subscription endpoint and keys needed to send them. Referrals: if you arrive through a shared ticket, the ticket code, so the sharer gets credit when you sign up.
3What we don't collect
We don't take card numbers (Stripe handles payment), we don't collect your location, contacts or identity documents, and we don't place advertising or cross-site tracking cookies.
4How we use it
To run the game: settle your tickets, keep your record, rank the season board, award badges and missions, show your public profile and the cards you choose to share. To sign you in and email you sign-in codes. To send notifications you opted into. To bill and support members. To understand how the app is used and fix what breaks. To enforce the rules, including one-account-per-person, and to meet legal obligations.
5Who processes it
A few services run parts of PaperBook and handle data on our behalf: Supabase (database and sign-in), Vercel (hosting; it sees requests as any web host does), Stripe (membership payments; Stripe collects your card details directly under its own privacy policy and tells us only whether a subscription is active), Resend (delivery of sign-in and account emails) and Google if you choose Google sign-in. ESPN is where the schedules, lines and scores come from; we read data from it and never send it anything about you. We don't share your data with anyone else except when the law requires it or to protect the game and its players.
6Cookies
Two kinds. A session cookie keeps you signed in; it is essential and set by our sign-in provider. A referral cookie (pb_ref) holds the code of a ticket you opened from a shared link, for seven days, so the sharer is credited if you sign up. There are no advertising or analytics cookies.
7How long we keep it
Your account data, picks and record are kept for as long as you have an account, because the record is the product. Analytics events are kept in aggregate for product decisions. Season standings that reach the Hall of Fame are kept as part of the season's history under the handle you used at the time. Stripe keeps billing records for as long as tax and payment rules require, under its own policy.
8Deleting your data
Delete your account from Settings on your profile page. That removes your login, tickets, record, achievements, follows, push subscriptions and public profile right away and can't be undone. Copies in our database provider's backups age out on its schedule, within weeks. You can also turn off notifications or make your profile private from Settings, and stop sharing any ticket from the ticket itself, at any time. To ask for a copy of your data, or for anything the app can't do itself, write to us.
9Public by design
A public profile shows your handle, level, season record, badges and best calls to anyone with the link, and your handle appears on the boards. Set your profile to private in Settings to keep it to yourself; a private profile can't hold a ranked spot. A ticket or card you share is visible to anyone with its link until you stop sharing it.
10Children
PaperBook is for people aged 21 and over. We don't knowingly collect data from anyone under 21, and we delete an account when we learn its holder is under age. If you believe someone under 21 has an account, tell us.
11Security
Sign-in uses one-time codes or Google; there are no passwords for us to store. Data is encrypted in transit and at rest by our providers, and access to the database is restricted to the game's own services. No system is perfectly secure, so if we learn of a breach affecting you we'll tell you.
12Changes and contact
We may update this policy as the game changes. The date at the top is the version in force, and we'll show a notice in the app when a change matters. Questions or requests go to the support address in Settings is being set up.