Privacy Policy

1. Who is responsible

For personal data processed through Ballity, the controller is the operator of ballity.com. Contact: privacy@ballity.com.

2. Data we collect

2.1 Browsing without an account

You can use much of Ballity without signing in. In that case we typically do not store an account profile on our servers. Some preferences and progress may still live in your browser (see §2.4).

2.2 Account and profile data

If you create or sign into an account, we process:

• Email addressand authentication credentials (password hashed by our auth provider, or Google account identifiers if you use “Continue with Google”)
• Profile preferences such as primary/favorite team, followed teams, leagues, content interests, onboarding completion, optional display name / avatar choice used in the product
• Session data needed to keep you signed in (auth cookies managed by Supabase Auth)

When signed in, preferences may sync from your browser to our database so they follow you across devices.

2.3 Subscriptions and payments

If you subscribe to Ballity Pro, we process:

• Subscription status, plan interval (monthly/yearly), renewal / cancellation flags, and related timestamps on our servers
• Stripe customer and subscription identifiers linking your Ballity account to Stripe

Payment card details are collected and processed by Stripe, not stored on Ballity servers. Stripe may receive your email, billing country/currency presentment data, and payment method information under Stripe's own privacy policy.

2.4 Product usage we store

• Duel Draft (Free tier): when Pro gating is enabled, we may store a per-day count of completed games for signed-in free users to enforce the daily limit
• Feature access: whether your account is entitled to Pro features, derived from subscription status

2.5 Data stored only on your device

Depending on features you use, your browser may store:

• Theme preference (light/dark) via cookie and/or localStorage
• Onboarding / feed preferences and favorite team (localStorage and/or a preferences cookie; synced to your account when signed in)
• Football Academy lesson progress (localStorage)
• Duel Draft local best scores / seat preferences (localStorage)

Clearing site data for ballity.com removes these local items. Account-synced preferences remain until you change them or delete your account.

2.6 Technical and security data

• Hosting (Vercel): standard request logs (e.g. IP address, timestamps, URLs) for security and operations
• Error monitoring (Sentry): application error reports which may include technical diagnostics (page URL, browser/runtime details). We configure this for reliability, not advertising
• Rate limiting (e.g. Upstash): ephemeral counters keyed by request metadata to protect APIs from abuse

We do not currently use advertising trackers, social pixels, or third-party marketing analytics SDKs. If that changes, we will update this policy and add consent where required.

3. Cookies and similar technologies

Ballity uses cookies (and local storage) that are:

• Strictly necessary / functional: auth session cookies (Supabase), theme preference, preference cookie used to personalize the homepage/feed
• Not used for ads: we do not set advertising or cross-site tracking cookies today

You can block or delete cookies in your browser settings. Blocking auth cookies will prevent sign-in and Pro entitlement from working correctly.

4. How we use information

• Provide and personalize Feed, profiles, Academy, and tools
• Authenticate users and secure accounts
• Process Ballity Pro subscriptions and unlock paid features
• Enforce Free-tier limits (e.g. Duel Draft daily games)
• Operate, debug, and protect the service (logs, Sentry, rate limits)
• Respond to support and legal requests

We do not sell personal data. We do not use your account data for third-party advertising.

5. Legal bases (EEA/UK)

Where GDPR/UK GDPR applies, we typically rely on:

• Contract: providing the account, Pro subscription, and core product features you request
• Legitimate interests: securing the service, preventing abuse, basic personalization of content you ask for, error monitoring
• Consent: where required for optional cookies or future non-essential tracking (not used for ads today)
• Legal obligation: when we must retain or disclose information to comply with law

6. Third-party services

We use processors and infrastructure providers. Each has its own privacy policy governing their processing:

7. Payments (Stripe)

Paid subscriptions are processed by Stripe. When you upgrade, you are redirected to Stripe Checkout (and can manage billing via Stripe Customer Portal). Ballity receives confirmation of payment / subscription status via secure webhooks and stores entitlement fields needed to unlock Pro features. For Stripe's practices, see stripe.com/privacy.

8. Retention

• Account and profile data: kept while your account is active
• Subscription records: kept while needed for entitlement, accounting, and dispute handling
• Duel Draft daily usage: short-lived operational counters (per UTC day)
• Logs and error reports: retained according to our providers' defaults / our operational needs, then deleted or anonymized
• Local browser data: until you clear it or uninstall/clear site storage

9. International transfers

Our providers (including Supabase, Stripe, Vercel, Google, and Sentry) may process data in the United States or other countries. Where required, we rely on appropriate safeguards offered by those providers (such as Standard Contractual Clauses).

10. Your choices and rights

• Preferences: change favorite team / interests in product settings or onboarding; clear browser site data to reset local-only state.
• Account: you may sign out at any time. To request access, correction, or deletion of account data, email privacy@ballity.com.
• Subscriptions:manage or cancel via the billing portal linked from your account / pricing page (Stripe). Cancellation stops future renewals per Stripe's timing; access continues until the current period ends unless stated otherwise.
• EEA/UK rights: where applicable you may have rights to access, rectify, erase, restrict, object, or port personal data, and to lodge a complaint with a supervisory authority. Contact us first so we can help.

11. Children's privacy

Ballity is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will take appropriate steps.

12. Security

We use industry-standard providers and access controls (including encrypted transport, auth sessions, and server-only secrets for Stripe/Supabase). No method of transmission or storage is 100% secure; please use a strong unique password and protect your devices.

13. Changes to this policy

We may update this policy as Ballity evolves (new features, processors, or legal requirements). We will revise the “Last updated” date above. Material changes may also be highlighted in-product or by email to account holders where appropriate.

14. Contact

Questions about privacy or data requests: privacy@ballity.com