Privacy Policy

Last updated August 1, 2026

SportyPants runs private sports pools for you and the people you invite. This policy explains what we collect, why we collect it, and who we share it with.

Who we are

SportyPants is developed and operated by MGB. In this policy, "we" and "us" mean MGB as the operator of the SportyPants service at sportypants.app. You can reach us any time at alek@mgbdev.com.

Information we collect

• Account details. Your email address, your display name, and whether your address has been confirmed. Sign-in itself is handled by Firebase Authentication, a Google service: if you use an email and password, the password is sent to Firebase and never reaches our servers, and we never see or store it.
• Google sign-in details. If you sign in with Google, we receive your Google account identifier, email address, and name from the ID token Google issues. We request only the basic profile, email, and OpenID scopes. We do not receive your Google password, and we request no access to Gmail, Drive, Calendar, Contacts, or any other Google service.
• Pool activity. The pools you create or join, your picks and entries, standings, and the invitations you send or accept.
• Notification settings. If you enable browser notifications, we store the push endpoint and encryption keys your browser generates so we can deliver messages to it.
• Purchase records. Seat token purchases, the pack purchased, and the identifiers our payment processor returns. Card numbers are entered on the processor's checkout page and never reach our servers.
• Technical data. A sign-in cookie that keeps you signed in, plus server logs that may include your IP address, browser user agent, and the pages you requested.

How we use it

We use this information to create and secure your account, run the pools you participate in, score games and publish standings, send invitations and the notifications you asked for, process purchases and track your seat token balance, and diagnose problems and abuse. We do not sell your personal information, and we do not use it to serve advertising.

Google user data and Limited Use

SportyPants' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, the only Google user data we access is the identifier, email address, and name in the ID token issued when you choose Google sign-in. We use it solely to create and identify your SportyPants account, to show your name to the other people in your pools, and to email you about your account and pools. We store it in our own database alongside the rest of your account, and it is available to our hosting provider only as part of running that database. We do not transfer it to anyone else, we do not sell it, we do not use it for advertising or to build advertising profiles, and no human reads it except where you have asked for support, where the law requires it, or where it is necessary to investigate abuse or a security incident. We do not use it to train generalized artificial intelligence or machine learning models.

You can disconnect Google sign-in at any time from your Google account's third-party connections page. Deleting your SportyPants account deletes the Google account identifier, email address, and name we hold for you.

Service providers

We share only what each provider needs to do its job:

• Google (Firebase Authentication) — verifies your identity for both Google sign-in and email-and-password sign-in, and holds the credentials for it.
• Stripe — processes payments and handles your card details directly under its own privacy policy.
• Resend — delivers transactional email such as pool invitations and account notices.
• Our hosting provider — stores the database and runs the application servers.

We may also disclose information where the law requires it, or where it is necessary to protect our users or defend our rights.

Cookies

We set one cookie, named SPORTYSESSION, so the site can remember that you are signed in. It is strictly necessary to run the service: blocking it will prevent you from signing in, so we do not ask for consent to set it.

It is marked HttpOnly and SameSite=Strict, so it cannot be read by scripts on the page or sent from another site, and it is served over HTTPS only in production. It expires no more than 30 days after you sign in, and signing out deletes it immediately.

That is the only cookie we set on this site and in the app. We use no analytics, advertising, or cross-site tracking cookies, and we embed no third-party scripts, fonts, or players that would set cookies of their own. If that ever changes, we will ask for your consent before setting any non-essential cookie.

Retention and deletion

We keep your account data for as long as your account is open. Pool history is retained so standings stay accurate for the other participants. Push subscriptions are removed when you turn notifications off or when your browser invalidates them. Purchase records are retained as long as tax and accounting rules require. You can ask us to delete your account and we will remove your personal details, though records of completed transactions and a pool's historical results may be retained in de-identified form.

Your choices

You can update your email address or password from your account settings, turn notifications off in your browser or in the app at any time, and request access to or deletion of your data by emailing us. If you signed in with Google, you can also revoke our access from your Google account's security settings.

Children

Our Terms of Service require account holders to be at least 18. SportyPants is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

Changes to this policy

If we change this policy we will update the date at the top of this page, and we will notify you by email when the change is significant.

Contact us

Questions about this policy or your data can go to alek@mgbdev.com.

Terms of Service · Back to home