PowerPlay DFS — Privacy Policy
Effective date: [EFFECTIVE DATE]
Last updated: [DATE]
1. Who we are, and what this policy covers
PowerPlay DFS ("PowerPlay," "we," "us," or "our") operates the website at www.powerplaydfs.com and the interactive analytics tools embedded in it (together, the "Service").
PowerPlay is an esports daily-fantasy-sports (DFS) analytics service. We provide statistical projections, a lineup builder, a public model track record / performance page, and social and leaderboard features for registered users.
We are not a sportsbook, a DFS contest operator, or a betting platform. We do not take wagers, hold contest entry fees, or pay out winnings. We do not move money for betting. The Service is an information and analytics tool only.
This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to visitors to our website and to holders of PowerPlay accounts.
This policy does not cover the practices of the third-party sportsbooks, DFS operators, or other websites we may reference or link to (for example PrizePicks, Underdog, Betr, Dabble, or ParlayPlay). Those operators have their own privacy policies, and we encourage you to read them.
Controller / contact. For the purposes of the EU/UK General Data Protection
Regulation (GDPR) and similar laws, the data controller is
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. You can reach us about privacy at
[PRIVACY CONTACT EMAIL, e.g. privacy@powerplaydfs.com].
[If you appoint a Data Protection Officer or an EU/UK representative, name them and give their contact details here — see founder decisions.]
2. The information we collect
We collect information in three ways: (a) information you provide to us, (b) information collected automatically when you use the Service, and (c) information we receive from third parties.
2a. Information you provide
| Category | Examples | Where it lives |
|---|---|---|
| Account information | Email address; username / handle; password credentials [confirm: passwords are handled by Supabase Auth — we do not store plaintext passwords]. | Supabase Auth |
| Profile information | Display name / handle, and any optional profile details or avatar you add. [confirm which optional fields exist] | Supabase database |
| User-generated content (UGC) | Saved lineups; lineups you share to the social feed; social posts; follows / who you follow; and other content you post. | Supabase database |
| Communications | The content of messages you send us (e.g., support requests) and your email address when you contact us. | [email/support tool — confirm] |
We do not intentionally collect special-category / sensitive personal data (e.g., health, biometric, racial or ethnic data). Please do not submit such information through UGC fields.
2b. Information collected automatically
When you visit or use the Service, we and our hosting providers automatically collect:
- Device and connection data: IP address, browser type and version, user-agent string, operating system, referring/exit pages, and approximate location derived from IP.
- Server and hosting logs: Our frontend host (Vercel) and our board server (a DigitalOcean droplet behind the Caddy web server) generate access logs that record requests, including IP address, timestamp, requested URL, and user-agent. These are standard operational/security logs.
- Usage data: Which pages and tools you use, lineups you build, and general interactions with the Service.
- Local storage / cookies: See Section 4 for the specific keys and their purposes.
Note on analytics: As of this draft, our codebase review found no third-party analytics or tracking SDKs (no Google Analytics, Plausible, PostHog, Segment, Mixpanel, Amplitude, Sentry, or advertising pixels) embedded in the Service. If you add any before launch, this policy must be updated. See founder decisions.
2c. Information from third parties
- Authentication providers: We use Supabase Auth to manage sign-up and
sign-in. If we offer social / OAuth login (e.g., "Sign in with Google")
[CONFIRM whether enabled], we receive basic profile data (such as email address and name) from that provider under their terms. - We do not currently purchase or ingest personal data from data brokers or advertising networks.
3. How we use your information, and our legal bases
We use personal information for the purposes below. For users in the EU/UK, the GDPR requires us to identify a legal basis for each purpose; those are noted.
| Purpose | Examples | GDPR legal basis |
|---|---|---|
| Provide the Service | Create and authenticate your account; save and display your lineups; run the projections, lineup builder, and performance pages. | Contract (Art. 6(1)(b)) — necessary to provide the service you signed up for. |
| Social & leaderboard features | Publish your posts, shared lineups, follows, and leaderboard standing to other users as you direct. | Contract; and consent where you actively choose to post publicly. |
| Operate, secure, and debug | Server logs, abuse / fraud prevention, rate-limiting, diagnosing errors, maintaining availability. | Legitimate interests (Art. 6(1)(f)) — running a secure, reliable service. |
| Communicate with you | Service / transactional emails (e.g., verification, security, account notices). | Contract; legitimate interests. |
Marketing emails [IF USED] | Product updates, newsletters. | Consent (opt-in) where required; otherwise legitimate interests with an opt-out. |
| Legal & compliance | Responding to lawful requests; enforcing our Terms; age gating. | Legal obligation (Art. 6(1)(c)); legitimate interests. |
Where we rely on consent, you may withdraw it at any time (this does not affect processing already carried out). Where we rely on legitimate interests, you may object — see Section 8.
4. Cookies and local storage
The Service uses browser local storage and cookies for the purposes below. We aim to keep non-essential tracking to a minimum.
Local storage keys (client-side, in your browser)
| Key | Purpose | Category |
|---|---|---|
pp_shared_lineup | Temporarily holds a lineup you chose to "Share to Social" so the site can carry it from the board into the social composer. | Functional / essential |
pp_landing_cache [CONFIRM] | Caches landing-page content to speed up load. | Functional / performance |
pp_landing [CONFIRM] | Landing-page state / cache. | Functional / performance |
The board tool also passes a short, non-identifying value (your account initials) between the embedded board and the parent page so it can show your avatar.
[Confirm final set of keys before publishing — see founder decisions. Thepp_landing*keys are used by the Next.js frontend and should be verified there.]
Cookies
- Authentication / session cookies: Supabase Auth sets cookies and/or
local-storage tokens to keep you signed in. These are strictly necessary
for the Service to function.
[Confirm cookie vs. localStorage token behavior in your Supabase config.] - Hosting cookies: Vercel and our infrastructure may set operational cookies
for load-balancing or security.
[Confirm.]
We do not currently use advertising or cross-site tracking cookies. If that changes, we will update this policy and, where required (e.g., EU/UK), present a cookie consent banner and honor your choices.
You can clear local storage and cookies through your browser settings, but doing so may sign you out or reset preferences.
5. How we share and disclose information
We do not sell your personal information for money. [See Section 8 for the CCPA/CPRA "sale"/"share" analysis, which turns on the third-party icon issue below.] We share information only as described here.
5a. Service providers / processors
We rely on the following providers, who process personal data on our behalf under contract (data processing agreements):
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Authentication and primary database (accounts, profiles, UGC, social/leaderboard data). | Email, handle, UGC, auth data. Hosted in [REGION — confirm]. |
| Vercel | Frontend hosting (www.powerplaydfs.com) and edge/serverless functions. | Request logs (IP, user-agent), served content. |
| DigitalOcean | Hosts our board/analytics server (droplet behind the Caddy web server). | Server access logs (IP, user-agent), requests to the board and APIs. |
Email provider [IF USED] | Sending transactional and/or marketing email. | Email address, message content. |
Payment processor [IF PAID TIER] | Processing subscription payments. | Billing details handled by the processor; we do not store full card numbers. |
5b. Third-party content that reveals your IP address (important)
Some pages in the Service load images hosted by third parties directly in
your browser. Because your browser fetches these images from the third party's
servers, your IP address and user-agent are disclosed to those third parties
each time the image loads — even though we set referrerPolicy="no-referrer",
which only hides the referring URL, not your IP.
This currently includes:
- Google favicon service (
google.com/s2/favicons) — used to show small sportsbook/operator logos (e.g., for PrizePicks, Underdog, Betr, Dabble, ParlayPlay). Loading these tells Google the IP address of every visitor who views the board or performance page. - Other third-party image hosts — team/operator logo images served from
external URLs (e.g., app-store icons,
googleusercontent.com, and other operator-supplied image hosts). These disclose your IP to whichever host serves the image.
We are aware of this and intend to remediate it by self-hosting these icons
and images so they load from our own domain and do not leak visitor IPs to
Google or other third parties. [Founder decision / remediation item — see the list at the end. Until remediated, this disclosure must be described honestly here, and it may count as a "sale"/"share" under CCPA/CPRA if the recipients use the data for their own purposes.]
5c. Other disclosures
- Public / social features: Content you choose to make public (posts, shared lineups, handle, leaderboard standing) is visible to other users and, if the page is public, to anyone on the internet. Do not post anything you want to keep private.
- Legal and safety: We may disclose information if required by law, subpoena, or legal process, or to protect the rights, safety, or property of PowerPlay, our users, or the public, or to investigate fraud or abuse.
- Business transfers: If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
6. Data retention
We keep personal information only as long as necessary for the purposes above.
| Data | Retention [CONFIRM — placeholders] |
|---|---|
| Account and profile data | For the life of your account, then deleted / anonymized within [e.g., 30–90 days] of account closure. |
| User-generated content (posts, lineups) | Until you delete it or close your account; backups may persist for [e.g., 30 days]. |
| Server / hosting access logs | [e.g., 30–90 days], then rotated/deleted, unless retained for security investigations. |
| Marketing preferences / suppression list | As long as needed to honor your opt-out. |
Actual retention periods are a founder/attorney decision and are marked
[CONFIRM] above.
7. How we protect your information
We take reasonable technical and organizational measures to protect personal data, including:
- Managed authentication via Supabase Auth (we do not roll our own password storage) and encrypted credential handling.
- Encryption in transit (HTTPS/TLS across the site, the Caddy-fronted board server, and Supabase).
- Access controls: administrative/database keys are restricted to server-side
environments and are not exposed to the browser. The board server uses a
privileged server-side key to read analytics data; user-facing access to the
database is governed by row-level security.
[Confirm that row-level security (RLS) is enabled and correctly scoped on all user/social tables so that users can only read/write their own rows — see founder decisions.] - Least-exposure design: the embedded board handles only minimal, non-identifying data and does not set its own tracking cookies.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that legally requires notification, we will notify affected users and regulators as required.
8. Your privacy rights
Your rights depend on where you live. To exercise any right, contact
[PRIVACY CONTACT EMAIL]. We will verify your identity (typically via the
email on your account) before acting, and respond within the timeframe the law
requires.
8a. EU / UK / EEA residents (GDPR / UK GDPR)
You have the right to: access your data; rectify inaccurate data; erase ("right to be forgotten"); restrict processing; data portability (receive your data in a portable format); object to processing based on legitimate interests or to direct marketing; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.
8b. California residents (CCPA / CPRA)
You have the right to: know / access the categories and specific pieces of personal information we collect; delete your personal information; correct inaccurate information; opt out of the "sale" or "sharing" of personal information and of targeted advertising; and to non-discrimination for exercising your rights.
- Do we "sell" or "share" personal information? We do not sell personal
information for money. However, the third-party image/favicon loading
described in Section 5b discloses visitor IP addresses to Google and other
hosts and could be treated as a "sale" or "share" under the CPRA's broad
definitions depending on how those recipients use the data.
[This is a founder/attorney determination. If it qualifies, you must offer a "Do Not Sell or Share My Personal Information" link and honor Global Privacy Control (GPC) signals. Remediating Section 5b by self-hosting icons likely removes this issue.]
8c. Other U.S. states / other regions
Residents of [other states with comprehensive privacy laws — e.g., Virginia, Colorado, Connecticut, Texas] may have similar rights. We honor comparable
requests where the law applies. [Confirm scope with counsel.]
You may authorize an agent to make a request on your behalf, subject to verification.
9. International data transfers
PowerPlay is operated from, and hosts data in, the United States (and/or
[other regions — confirm Supabase/Vercel/DigitalOcean data regions]). If you
access the Service from the EU/UK or elsewhere, your information will be
transferred to and processed in the United States, where data-protection laws
may differ from those in your country.
Where we transfer personal data out of the EEA/UK, we rely on appropriate
safeguards such as the European Commission's Standard Contractual Clauses
(SCCs) and the UK International Data Transfer Addendum, and/or the
providers' certifications under the EU-U.S. Data Privacy Framework, as
applicable. [Confirm the mechanism each processor offers.]
10. Children and age restrictions
The Service is not directed to children, and because it is gambling-adjacent (esports DFS analytics), we set a firm minimum age.
- You must be at least
[18 OR 21]years old to create an account or use the Service.[This must match the minimum age set in the Terms of Service. Many DFS/gambling-adjacent products use 18+, some jurisdictions require 21+ — founder/attorney decision.] - We do not knowingly collect personal information from anyone under
[18/21], and specifically not from children under 13 (per the U.S. Children's Online Privacy Protection Act, "COPPA") or under 16 in certain jurisdictions. - If we learn that we have collected personal information from someone under the
applicable minimum age, we will delete it. If you believe a minor has provided
us information, contact
[PRIVACY CONTACT EMAIL].
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where required, notify you (e.g., by email or an in-app notice) before the changes take effect. Your continued use of the Service after an update means you accept the revised policy.
12. Contact us
Questions or requests about this policy or your personal data:
- Email:
[PRIVACY CONTACT EMAIL] - Postal:
[LEGAL ENTITY NAME AND ADDRESS] - Data Protection Officer / EU-UK representative (if appointed):
[NAME & CONTACT]