Privacy Policy

Information We Collect

• Account information: your email address, your password (held only in scrambled form by our login provider, never readable by us), and a username made from your email.
• Date of birth and gender: asked when you sign up. Your date of birth confirms you meet the minimum age for your country; your gender can be "Prefer not to say". Neither is ever shown to other users, including your league. We use them only in anonymous, combined totals (for example, the age range of our players) to run and grow the service, and we may share those combined totals, never your individual details, with advertisers or sponsors.
• League and team data: the leagues you create or join, your team name and picture, rosters, lineups, trades and trade messages, waiver claims, and scoring history. Other members of your league can see your team, roster and lineups; your draft queue, waiver claims and pending trade offers stay private to you.
• Feedback you send us from the app or website: your message, its category, and the context attached automatically (your app version, device or browser, the page you were on, and your current league). It's tied to your account so we can follow up, and it's only seen by us.
• What you post in BoxToBox Fantasy: messages in league chat, draft room chat, matchup comments and player Discuss threads, your emoji reactions, the managers you've blocked or muted, and your notification settings for a chat. League chat is seen by the teams in that league, matchup comments by the two managers in the matchup, and Discuss threads are public: anyone can read them, signed in or not. If you report a post, we keep a copy of it with your report.
• Purchase and reward records: what you bought and when, the coins and Premium Tokens you earned and spent, and the rewarded ads you watched. We never see or store your full card number.
• Device information: if you turn on notifications in the app, a push token so we can send them; your time zone, so daily rewards reset at your midnight.
• Technical logs: our hosting providers keep standard server logs (such as IP address, browser or device type, and pages requested) for security and troubleshooting. We don't use a separate analytics or tracking service.
• Waitlist: if you join the next-season waitlist, the email address you give us and whether you asked to receive news. We use it to send the one reminder you asked for, and news only if you ticked that box. Every email has an unsubscribe link, and you don’t need an account.

How We Use Your Information

We use this information to run your account and leagues, show accurate scoring and standings, process purchases and rewards, send the notifications you've turned on, keep the game safe (content moderation, and preventing cheating and fraud), and improve the platform. We do not sell your personal information.

Cookies and Local Storage

We use cookies to keep you signed in, to remember a referral code from an invite link for 30 days, and to recognize repeat visits to a shared link so its sharer is rewarded fairly. For that last one we store only a scrambled version of the visitor's IP address, never the address itself. Your browser or phone also keeps small preferences, such as your theme and which pop-ups you've already seen. On the website we count page visits and actions like signing up or creating a league with Vercel Web Analytics, which sets no cookies and doesn't identify you. When we're comparing two versions of the home page, one more cookie remembers which version you saw. If you arrive by a link tagged with a campaign name, such as one in our social media posts, two cookies (in the app, your phone’s storage) remember that name: the first one for up to 90 days and the latest for 30. If you then sign up, on the website or in the app, those names are saved with your account, so we can learn which posts bring people in. They hold only the campaign’s name, nothing about you.

Advertising on the Website

We work with Google AdSense to display advertising. Google and its partners may use cookies and similar technologies to serve ads based on your prior visits to this or other websites. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent before personalized ads are shown, through a consent message provided by Google; you can change your choice at any time with the “Privacy choices” link at the bottom of every page. You can also opt out of personalized advertising at Google’s Ads Settings or at aboutads.info. Learn more about how Google uses information from sites that use its services.

Advertising in the App

• The BoxToBox Fantasy app shows ads through Google AdMob, including optional rewarded ads you choose to watch in exchange for in-app coins and Premium Tokens.
• AdMob may collect device information such as your device’s advertising identifier (IDFA on iOS, Advertising ID on Android), IP address, and information about the ads you see and interact with, to show, measure and limit ads and to prevent fraud.
• On iOS we ask your permission before your advertising identifier is used for tracking. If you decline, you still see ads, but they aren’t personalized using that identifier. You can change this in your device’s Settings.
• Where the law requires it (for example in the European Economic Area, the United Kingdom and Switzerland), the app asks for your consent through a message provided by Google before personalized ads are shown. You can change your choice with “Privacy choices” on the app’s Home screen. On Android you can also reset or delete your Advertising ID in your device settings.
• When you finish a rewarded ad, Google sends us a signed confirmation containing your account ID so we can credit your reward. We keep a record of each rewarded ad view (time and placement) to credit rewards and enforce daily limits.
• If you buy Ad-Free, we stop showing you ads you didn't ask for; rewarded ads you choose to watch stay available.

Content Moderation

To keep BoxToBox Fantasy safe, every team picture you upload, and every photo you send with a custom buddy or banner order, is checked by OpenAI's moderation service before it's saved; OpenAI receives the image only to return a safety result. Custom order photos are stored privately, seen only by us, and deleted once the order is finished. Team names, league names and trade messages are checked against a list of banned words. Other members of your league can report a team's name or picture to the league's commissioner, and we keep a record of each report.

Purchases

On the website, payment is handled by Stripe on its own secure checkout page. In the app, purchases go through the App Store or Google Play, and RevenueCat confirms them to us. We receive a confirmation of what was bought, the price, and your account ID, never your full card details. We keep purchase records so we can give you access, handle refunds, and meet tax and accounting rules.

Third-Party Services

We use these services to run BoxToBox Fantasy, and share only what each one needs to do its job:

• Supabase: our database, sign-in and file storage (account, league data and team pictures).
• Vercel and Fly.io: hosting for the website and for background jobs such as scoring.
• Sportmonks: real-world player statistics. No personal information is sent to them.
• Google AdSense and AdMob: advertising, as described above.
• Stripe, Apple, Google and RevenueCat: payments.
• OpenAI: checking uploaded team pictures and custom order photos.
• Expo: app updates and push notifications.
• GIPHY: GIF search and GIFs in league chat, draft chat, matchup comments and player Discuss threads. Your searches go through our servers, so GIPHY doesn't receive them from you directly, but a GIF shown in a chat or thread is loaded from GIPHY, which then sees your IP address and device details as any website would.

These providers process data on our behalf under their own privacy and security terms. Some of them are located in the United States, so your information may be processed there.

How We Protect Your Information

Data is encrypted in transit (HTTPS) and at rest with our database provider. Access rules inside the database mean other people can only see what the game needs them to see. Payment details never reach our servers. No system is perfectly secure, but we work to protect your information and will tell you about a breach that affects you as the law requires.

How Long We Keep It

We keep your information while your account is open. When you delete your account, we delete your personal information. If your team is part of a league other people are playing or have played, the team stays in that league's history under a generic name (such as “Team 4”) with no link back to you. Purchase records may be kept as long as tax law requires, and backups held by our providers are overwritten on their normal schedule.

Children

BoxToBox Fantasy isn't meant for children under 13, or under the minimum age for online services in your country if that's higher (such as 16 in parts of Europe). We ask for your date of birth at sign-up and don't create an account for anyone below that age. If you believe a child has made an account, contact us and we'll delete it.

Your Rights

You can delete your account yourself at any time, from your account page on the website or from the app's Home screen. You can also ask for a copy of your information, or to correct it, by emailing boxtoboxfantasy@gmail.com. Depending on where you live (for example the EEA, the UK or California) you may have further rights, such as objecting to certain uses; we'll respond within the time the law requires.

Changes to This Policy

If we change this policy we'll update the date at the top, and tell you in the app or by email if the change is significant.