Privacy Policy

The information we collect depends on how you use QuinielaPool:

Pool creators (Google sign-in)

• Your Google account ID, name, email address, and profile photo
• Pools you create (names, entry fees, league, member list)
• Your predictions on those pools
• The $2 platform fee payment (processed by Stripe — we receive the transaction ID and amount only; Stripe handles card details and never shares them with us)
• Optional Venmo username / PayPal email you choose to display to members for peer-to-peer payments

Pool members joining via Google

• Google account ID, name, email, and profile photo
• Pool memberships and predictions

Pool members joining as guests

• The display name you type
• An optional email address (if provided)
• A randomly-generated guest ID stored in your browser's localStorage
• Your pool memberships and predictions

We do not collect your IP address, device fingerprint, or any other tracking identifier for guests beyond what is needed to recognize you on return visits.

• To provide the service: create pools, record predictions, calculate leaderboards, deliver in-app notifications.
• To process the $2 platform fee (via Stripe).
• To send transactional emails — for example, the final results email when a pool concludes.
• To send security alerts to administrators (suspicious activity, system issues).
• To improve the service (aggregate, non-identifying usage statistics).

We do not sell your personal information. We do notshow third-party ads. We do not profile you for advertising.

QuinielaPool runs on a small set of third-party services. Each has its own privacy policy:

• Google Firebase (Authentication, Firestore database, Cloud Functions) — privacy policy
• Vercel (hosting and serverless infrastructure) — privacy policy
• Stripe (payment processing for the $2 platform fee) — privacy policy
• Cloudflare (domain registration and DNS) — privacy policy
• football-data.org and ESPN (read-only match data feeds) — we send only league identifiers, never your personal data
• Gmail SMTP (transactional email delivery)

We use minimal browser storage:

• Firebase Auth session (IndexedDB) — keeps you signed in
• Guest identity (localStorage key quinielapool_guest) — recognizes guests on return visits
• Admin session (sessionStorage, admin users only) — caches the admin secret for the current tab

We do not set tracking cookies or use third-party analytics that profile you across sites. Clearing your browser's site data will sign you out and (for guests) lose your guest identity.

Pool data, predictions, and leaderboard records are retained as long as the pool is active. Archived pools are kept for 30 days, after which they are permanently deleted.

User accounts and their associated data are retained while the account is active. You can request deletion of your account and all associated data at any time by contacting us (see Section 8).

Platform-fee payment records are retained per Stripe's requirements (typically 7 years for tax compliance).

Depending on where you live (GDPR, CCPA, LGPD, etc.), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention requirements)
• Export your data in a portable format
• Object to certain processing

To exercise any of these rights, email contact@quinielapool.com. We respond within 30 days.

We protect your data with industry-standard measures: HTTPS encryption in transit, encryption at rest in Firestore, Firestore Security Rules to restrict access, CORS limiting cross-origin API calls, and security headers (HSTS, X-Frame-Options, etc.) on every response. Admin actions are gated behind a server-only secret.

No system is 100% secure. If we ever discover a data breach affecting you, we will notify affected users within 72 hours as required by applicable law.

For any privacy questions or requests, email contact@quinielapool.com.

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date at the top. For significant changes we will notify users via in-app notification or email.