The Losers Pool — Privacy Policy

1) Scope

This Privacy Policy describes how The Losers Pool ("we," "us") collects, uses, discloses, and protects personal information when you use The Losers Pool at https://theloserspool.com, create/join pools, or interact with us.

2) Information We Collect

Information you provide

• Account details (name, email, password or SSO identifier).
• Profile info (avatar, timezone, favourite team), pool settings, picks, chat messages.
• Payment information only if/when premium features are enabled (processed by third‑party providers), and limited billing info.

Information we collect automatically

• Usage and device data (pages viewed, actions, IP address, device/OS/browser, app version).
• Cookies and similar technologies limited to what is necessary for the site to function (session cookies, auth tokens). We do not use analytics or advertising cookies at this time.

Information from third parties

• Authentication providers (if used).
• Email delivery provider status (e.g., bounce/complaint indicators).
• Anti‑fraud/security tools (if implemented in the future).

3) How We Use Information

• Provide, secure, and improve the Service.
• Create and manage accounts and pools; process picks and standings.
• Communicate with you (service emails, updates, security alerts).
• Process payments for premium features (if enabled).
• Detect, prevent, and investigate fraud, abuse, or violations of our Terms.
• Personalize features (e.g., timezone, reminders) and run basic operational analytics (without tracking cookies).
• Comply with legal obligations and enforce our Terms.

Legal bases (EU/UK where applicable): contract performance, legitimate interests (e.g., securing and improving the Service), consent (where required), and legal obligations.

4) How We Share Information

We may share with:

• Service providers/processors bound by confidentiality and processing agreements, including:
• DigitalOcean (hosting & infrastructure)
• Resend (transactional email delivery)
• Cloudflare (DNS; may process IP addresses as part of DNS/edge security)
• Other users (e.g., your display name, picks, and pool participation may be visible within your pools per pool settings).
• Legal and compliance recipients (to comply with law, enforce Terms, protect rights/safety).
• Business transfers (e.g., merger, acquisition, or asset sale) subject to this Policy.

We do not sell personal information and do not share personal information with third parties for their own independent marketing without your consent.

5) International Transfers

We primarily host and process data in Canada. Some providers (e.g., email delivery and DNS) may process data outside Canada. Where required, we use appropriate safeguards for cross‑border transfers (e.g., contractual commitments) and ensure providers implement adequate protections.

6) Data Retention

We retain personal information only as long as necessary for the purposes described above, to comply with legal obligations, resolve disputes, and enforce agreements.

• Account data: for the life of the account.
• Usage/log data: ~90 days.
• Backups: ~30 days (rolling).

7) Your Rights & Choices

Depending on your location, you may have rights to access, correct, or delete your personal information; port your data; object to or restrict certain processing; and withdraw consent where processing is based on consent.

How to exercise: Contact [email protected]. We may verify your request and will respond within the timeframe required by law.

Account deletion: Self‑serve account deletion is not currently available; upon a verified request we will disable the account and delete/anonymize personal information where feasible, subject to legal/operational requirements and the retention periods above.

Marketing communications: You can opt out using the unsubscribe link in emails.

Canada (PIPEDA): You may request access to and correction of your personal information and to know how it is used and disclosed. You may contact the Office of the Privacy Commissioner of Canada if concerns are not resolved.

EU/UK GDPR: Legal bases include contract performance, legitimate interests (e.g., securing and improving the Service), consent (where required), and legal obligations. You may lodge a complaint with your local data protection authority.

California (CCPA/CPRA): We do not sell personal information. California residents can request disclosures about personal information collected, used, and shared, and request deletion or correction. We will not discriminate for exercising privacy rights.

8) Cookies & Tracking Technologies

We use only strictly necessary cookies to keep you signed in, remember essential preferences, and protect the Service. We do not use analytics, advertising, or cross‑site tracking cookies at this time. If this changes, we will update this Policy and (where required) obtain consent.

Do Not Track: We currently do not respond to browser DNT signals.

9) Security

We implement reasonable technical and organizational measures to protect personal information (e.g., encryption in transit, access controls, logging). No system is 100% secure; please use strong, unique passwords and keep them confidential.

10) Children’s Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a minor has provided personal information, contact us to request deletion.

11) Third‑Party Links & Services

The Service may link to third‑party websites/services (e.g., news sources, payment providers). We are not responsible for their privacy practices. Review their policies before submitting information.

12) Changes to This Policy

We may update this Policy periodically. We will notify you of material changes (e.g., by email or in‑app). The Effective date indicates when changes take effect.

13) Contact Us

Questions or requests? [email protected]
Data Protection Officer (if appointed): TBD

14) Region‑Specific Disclosures

Quebec Law 25 (if applicable): We will designate a privacy officer, describe cross‑border transfers, and maintain privacy impact assessments for high‑risk projects as required.

15) Data Map (Appendix)