PowerPlay DFS — Privacy Policy
Effective date: September 1, 2026 Last updated: September 1, 2026
1. Who we are, and what this policy covers
PowerPlay DFS ("PowerPlay," "we," "us," or "our") operates the website at www.powerplaydfs.com and the interactive analytics tools embedded in it (together, the "Service").
PowerPlay is an esports daily-fantasy-sports (DFS) analytics service. We provide statistical projections, a lineup builder, a public model track record / performance page, and social and leaderboard features for registered users.
We are not a sportsbook, a DFS contest operator, or a betting platform. We do not take wagers, hold contest entry fees, or pay out winnings. We do not move money for betting. The Service is an information and analytics tool only.
This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to visitors to our website and to holders of PowerPlay accounts.
This policy does not cover the practices of the third-party sportsbooks, DFS operators, or other websites we may reference or link to (for example PrizePicks, Underdog, Betr, Dabble, or ParlayPlay). Those operators have their own privacy policies, and we encourage you to read them.
Controller / contact. For the purposes of the EU/UK General Data Protection Regulation (GDPR) and similar laws, the data controller is PowerPlay Projections, the operator of the Service. You can reach us about privacy at support@powerplaydfs.com. We have not appointed a Data Protection Officer or an EU/UK representative.
2. The information we collect
We collect information in three ways: (a) information you provide to us, (b) information collected automatically when you use the Service, and (c) information we receive from third parties.
2a. Information you provide
| Category | Examples | Where it lives |
|---|---|---|
| Account information | Email address; username / handle; password credentials (passwords are handled by Supabase Auth; we never see or store plaintext passwords). | Supabase Auth |
| Profile information | Your handle. We do not currently collect avatars, bios, or other optional profile fields — avatars shown on the site are generated from your handle's initials. | Supabase database |
| User-generated content (UGC) | Saved lineups; lineups you share to the social feed; social posts; follows / who you follow; and other content you post. | Supabase database |
| Communications | The content of messages you send us (e.g., support requests) and your email address when you contact us. | support@powerplaydfs.com mailbox |
We do not intentionally collect special-category / sensitive personal data (e.g., health, biometric, racial or ethnic data). Please do not submit such information through UGC fields.
2b. Information collected automatically
When you visit or use the Service, we and our hosting providers automatically collect:
- Device and connection data: IP address, browser type and version, user-agent string, operating system, referring/exit pages, and approximate location derived from IP.
- Server and hosting logs: Our frontend host (Vercel) and our board server (a DigitalOcean droplet behind the Caddy web server) generate access logs that record requests, including IP address, timestamp, requested URL, and user-agent. These are standard operational/security logs.
- Usage data: Which pages and tools you use, lineups you build, and general interactions with the Service.
- Local storage / cookies: See Section 4 for the specific keys and their purposes.
Note on analytics: The Service does not embed third-party analytics or tracking SDKs (no Google Analytics, Plausible, PostHog, Segment, Mixpanel, Amplitude, or advertising pixels). If we add any, we will update this policy first.
2c. Information from third parties
- Authentication providers: We use Supabase Auth to manage sign-up and sign-in with an email address and password. We do not currently offer social / OAuth login (e.g., "Sign in with Google").
- We do not currently purchase or ingest personal data from data brokers or advertising networks.
3. How we use your information, and our legal bases
We use personal information for the purposes below. For users in the EU/UK, the GDPR requires us to identify a legal basis for each purpose; those are noted.
| Purpose | Examples | GDPR legal basis |
|---|---|---|
| Provide the Service | Create and authenticate your account; save and display your lineups; run the projections, lineup builder, and performance pages. | Contract (Art. 6(1)(b)) — necessary to provide the service you signed up for. |
| Social & leaderboard features | Publish your posts, shared lineups, follows, and leaderboard standing to other users as you direct. | Contract; and consent where you actively choose to post publicly. |
| Operate, secure, and debug | Server logs, abuse / fraud prevention, rate-limiting, diagnosing errors, maintaining availability. | Legitimate interests (Art. 6(1)(f)) — running a secure, reliable service. |
| Communicate with you | Service / transactional emails (e.g., verification, security, account notices). | Contract; legitimate interests. |
| Marketing emails (if we send them) | Product updates, newsletters. | Consent (opt-in) where required; otherwise legitimate interests with an opt-out. |
| Legal & compliance | Responding to lawful requests; enforcing our Terms; age gating. | Legal obligation (Art. 6(1)(c)); legitimate interests. |
Where we rely on consent, you may withdraw it at any time (this does not affect processing already carried out). Where we rely on legitimate interests, you may object — see Section 8.
4. Cookies and local storage
The Service uses browser local storage and cookies for the purposes below. We aim to keep non-essential tracking to a minimum.
Local storage keys (client-side, in your browser)
| Key | Purpose | Category |
|---|---|---|
pp_shared_lineup | Temporarily holds a lineup you chose to "Share to Social" so the site can carry it from the board into the social composer. | Functional / essential |
pp_landing_cache | Caches landing-page content to speed up load. | Functional / performance |
The board tool also passes a short, non-identifying value (your account initials) between the embedded board and the parent page so it can show your avatar.
Cookies
- Authentication / session cookies: Supabase Auth keeps your session token
in browser local storage, and we set a
pp_tokenHttpOnly cookie (scoped to.powerplaydfs.com) so the embedded board can authenticate your requests. Both are strictly necessary for the Service to function and are cleared when you sign out. - Hosting cookies: Vercel and our infrastructure may set operational cookies for load-balancing or security.
We do not currently use advertising or cross-site tracking cookies. If that changes, we will update this policy and, where required (e.g., EU/UK), present a cookie consent banner and honor your choices.
You can clear local storage and cookies through your browser settings, but doing so may sign you out or reset preferences.
5. How we share and disclose information
We do not sell your personal information for money. We share information only as described here (see Section 8b regarding the third-party image loading described in Section 5b).
5a. Service providers / processors
We rely on the following providers, who process personal data on our behalf under contract (data processing agreements):
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Authentication and primary database (accounts, profiles, UGC, social/leaderboard data). | Email, handle, UGC, auth data. Hosted on Supabase's managed cloud infrastructure in the United States. |
| Vercel | Frontend hosting (www.powerplaydfs.com) and edge/serverless functions. | Request logs (IP, user-agent), served content. |
| DigitalOcean | Hosts our board/analytics server (droplet behind the Caddy web server). | Server access logs (IP, user-agent), requests to the board and APIs. |
| Email delivery | Transactional email (verification, password resets, notifications) sent through our auth/email providers. | Email address, message content. |
| Stripe | Processing membership subscription payments (checkout, billing portal, renewals). | Billing details are collected and held by Stripe; we do not see or store full card numbers. |
5b. Third-party content that reveals your IP address (important)
Some pages in the Service load images hosted by third parties directly in
your browser. Because your browser fetches these images from the third party's
servers, your IP address and user-agent are disclosed to those third parties
each time the image loads — even though we set referrerPolicy="no-referrer",
which only hides the referring URL, not your IP.
This currently includes:
- Google favicon service (
google.com/s2/favicons) — used to show small sportsbook/operator logos (e.g., for PrizePicks, Underdog, Betr, Dabble, ParlayPlay). Loading these tells Google the IP address of every visitor who views the board or performance page. - Other third-party image hosts — team/operator logo images served from
external URLs (e.g., app-store icons,
googleusercontent.com, and other operator-supplied image hosts). These disclose your IP to whichever host serves the image.
We are aware of this and intend to remediate it by self-hosting these icons and images so they load from our own domain and do not disclose visitor IPs to Google or other third parties. Until then, this section is our honest disclosure of that behavior.
5c. Other disclosures
- Public / social features: Content you choose to make public (posts, shared lineups, handle, leaderboard standing) is visible to other users and, if the page is public, to anyone on the internet. Do not post anything you want to keep private.
- Legal and safety: We may disclose information if required by law, subpoena, or legal process, or to protect the rights, safety, or property of PowerPlay, our users, or the public, or to investigate fraud or abuse.
- Business transfers: If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
6. Data retention
We keep personal information only as long as necessary for the purposes above.
| Data | Retention |
|---|---|
| Account and profile data | For the life of your account, then deleted or anonymized within 60 days of account closure. |
| User-generated content (posts, lineups) | Until you delete it or close your account; backups may persist for up to 30 days. Public content that other users have interacted with (e.g., tailed lineups) may be retained in anonymized form to preserve the integrity of social and track-record features. |
| Server / hosting access logs | Up to 90 days, then rotated/deleted, unless retained longer for an active security investigation. |
| Marketing preferences / suppression list | As long as needed to honor your opt-out. |
7. How we protect your information
We take reasonable technical and organizational measures to protect personal data, including:
- Managed authentication via Supabase Auth (we do not roll our own password storage) and encrypted credential handling.
- Encryption in transit (HTTPS/TLS across the site, the Caddy-fronted board server, and Supabase).
- Access controls: administrative/database keys are restricted to server-side environments and are not exposed to the browser. The board server uses a privileged server-side key to read analytics data; user-facing access to the database is governed by row-level security, which is enabled on our user and social tables so users can only modify their own rows.
- Least-exposure design: the embedded board handles only minimal, non-identifying data and does not set its own tracking cookies.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that legally requires notification, we will notify affected users and regulators as required.
8. Your privacy rights
Your rights depend on where you live. To exercise any right, contact support@powerplaydfs.com. We will verify your identity (typically via the email on your account) before acting, and respond within the timeframe the law requires.
8a. EU / UK / EEA residents (GDPR / UK GDPR)
You have the right to: access your data; rectify inaccurate data; erase ("right to be forgotten"); restrict processing; data portability (receive your data in a portable format); object to processing based on legitimate interests or to direct marketing; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.
8b. California residents (CCPA / CPRA)
You have the right to: know / access the categories and specific pieces of personal information we collect; delete your personal information; correct inaccurate information; opt out of the "sale" or "sharing" of personal information and of targeted advertising; and to non-discrimination for exercising your rights.
- Do we "sell" or "share" personal information? We do not sell personal information for money. However, the third-party image/favicon loading described in Section 5b discloses visitor IP addresses to Google and other hosts and could be treated as a "sale" or "share" under the CPRA's broad definitions depending on how those recipients use the data. If you would like us to limit that disclosure for you, or wish to make any opt-out request (including via an authorized agent or a Global Privacy Control signal), contact support@powerplaydfs.com and we will honor it as the law requires.
8c. Other U.S. states / other regions
Residents of other states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, and Texas) may have similar rights. We honor comparable requests where the law applies.
You may authorize an agent to make a request on your behalf, subject to verification.
9. International data transfers
PowerPlay is operated from, and hosts data in, the United States. If you access the Service from the EU/UK or elsewhere, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.
Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, and/or the providers' certifications under the EU-U.S. Data Privacy Framework, as applicable.
10. Children and age restrictions
The Service is not directed to children, and because it is gambling-adjacent (esports DFS analytics), we set a firm minimum age.
- You must be at least 18 years old — or older where the laws of your jurisdiction require — to create an account or use the Service. This matches the minimum age in our Terms of Service.
- We do not knowingly collect personal information from anyone under 18, and specifically not from children under 13 (per the U.S. Children's Online Privacy Protection Act, "COPPA") or under 16 in certain jurisdictions.
- If we learn that we have collected personal information from someone under the applicable minimum age, we will delete it. If you believe a minor has provided us information, contact support@powerplaydfs.com.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where required, notify you (e.g., by email or an in-app notice) before the changes take effect. Your continued use of the Service after an update means you accept the revised policy.
12. Contact us
Questions or requests about this policy or your personal data:
- Email: support@powerplaydfs.com
- Operator: PowerPlay Projections (postal address available on request)