Depth Chart privacy policy
What we collect
- Your account. Your email address and the display name you choose. If you sign in with a password, we store only a scrambled (hashed) version of it, never the password. If you sign in with Google, Google gives us your email address, name, profile picture link and an account ID, and we ask for nothing more. GitHub sign-in is used only by the site's administrator and gives us the same kind of details.
- Your game. Your player, team, ratings, training choices, game results, messages in the game and history. Most of this is visible to other players in the league. Your email address is not.
- Visits. We note which days you were signed in, so we can see whether people come back and so training plans can pause after two weeks away.
- Site health. We count page visits and how long pages take to load, per page and per hour, with no names, accounts or IP addresses attached, to keep the site running well.
- Fair-play signals. We allow one account per person. To notice when two accounts seem to be the same person, we keep two hashed signals for each account: one from your network address and one from a random code in your browser (the dc_device cookie). A hash is a one-way scramble. We keep the scramble, not your address, and it cannot be turned back into the address. A signal is deleted 90 days after it was last seen. Only the site's administrator can see a count of shared signals, and any flag is reviewed by a person: nothing is banned automatically.
- Email records. For each email we send you, we record the address, the kind of email, whether it sent, and when. A failed password sign-in is recorded with the time and deleted after one day.
- Age. You must be 18 or older. We check your date of birth once and do not keep it.
Cookies
Depth Chart uses only its own cookies. There are no advertising or tracking cookies, and no analytics.
- Signing in. The session cookie that keeps you signed in, plus the short-lived security cookies the sign-in system sets while you sign in. A sign-up also sets dc_signup for one day so the confirmation link signs you in on the same browser.
- Device. dc_device, a random code used for the fair-play signal above. It lasts one year.
- Invites and teams. dc_invite holds an invite link until you use it or it expires.
- View and display preferences. For one year each: dc_view (Player or Manager view), dc_league (your chosen league), dc-a11y (your accessibility settings), dc-camera, dc-view3d, dc-view3d-keep and dc-sideline3d (how you watch games) and dc-box-team (which team you view in a box score).
We send the emails your account needs, such as confirming your address or resetting your password. The weekly email is optional and off unless you turn it on at /digest. Every one has a link that turns it off. We send no marketing email.
What we do not do
- We do not sell your data.
- We do not show ads or share your data with advertisers.
- We do not track you across other websites.
Who handles it for us
Vercel hosts the site and keeps ordinary request logs. Neon stores the database. Resend delivers email. Google and GitHub handle sign-in when you choose them. They use your information only to provide that service to us.
Deleting your account
There is no delete button yet, so deletion is a manual request. Ask through the Feedback button where you see it, or email support@nectarlyyours.com, and we will delete your account, sign-in details and player. Games already played are part of the league's history and stay.
Contact
Depth Chart is run by Nectarly LLC, a Colorado limited liability company. Questions or requests about your data: use the Feedback button where you see it, or email support@nectarlyyours.com.