Privacy Policy

Last Updated: June 20, 2026

1. Introduction & Scope

Welcome to The Loser's Bracket ("we," "our," or "us"). We provide a reverse fantasy sports platform where the goal is to draft active professional athletes and finish with the lowest eligible score.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit and use The Loser's Bracket, including our website at thelosersbracket.com and our supported mobile applications.

2. Information We Collect

We collect information to run the platform, calculate Penalty Scores, and manage leagues. This includes:

  • Account Credentials: If you use Google or Apple Sign-In, we receive your email, full name, and avatar URL under strict OAuth scopes.
  • Roster & League Choices: Player drafts, lineup configurations, trade history, and waiver claims associated with your league tenancy.
  • Communications & Messaging: Direct messages (DMs) between managers, public chat messages in league feeds, and reactions.
  • Finances & Virtual Currency: Ledger records tracking Shame Coins, cosmetics purchases, and references to premium upgrades.
  • Referrals & Notifications: Referral code usage to track rewards, and push notification device tokens.
  • Service Information: Technical information needed to protect the service and diagnose reliability issues.

3. Third-Party Identity Providers & OAuth User Data

To simplify registration and access, our service allows you to authenticate using third-party accounts (Google OAuth and Apple Sign-In). Below is a clear disclosure of how we interact with this user data:

A. Data Accessed & Collected

We request access only to non-sensitive scopes. When you sign in with Google or Apple, we access and store:

  • Your email address (to identify and verify your account)
  • Your full name / display name (to pre-populate your profile)
  • Your profile picture URL / avatar (to display within rosters, chat feeds, and league standings)

B. Data Usage & Processing Purpose

We process the retrieved Google and Apple user data solely to execute the reverse fantasy game and manage user identity:

  • Creating your user profile and verifying your unique identity upon login.
  • Rendering your avatar and name in matchup screens, league standings, and real-time chat drawers.
  • Sending transaction updates, password/recovery communications, and league notifications.

C. Data Sharing & Third-Party Disclosure

We maintain strict privacy policies regarding third-party integrations:

  • No Selling/Renting: We do not sell, rent, trade, or distribute your Google or Apple user data to advertisers, data brokers, or marketing firms.
  • Service Providers: We share user data only with our backend database provider, Supabase, which host and secure our infrastructure. These providers are bound by strict data protection agreements.
  • Legal Requirements: We will only disclose user data if required to do so by law, court order, or governmental regulations.

D. Data Storage & Security Protection

We implement robust practices to protect and secure your user data:

  • Encryption: All data is encrypted in transit using Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocols and at rest.
  • Access Controls: We utilize strict Row-Level Security (RLS) policies within our database, ensuring managers can access only authorized league and roster data.
  • OAuth Security: We do not store your raw Google or Apple passwords. All authentication sessions are managed via secure OAuth token exchanges.

E. Data Retention & Deletion Policy

We retain your user data for as long as your account remains active. We provide two direct ways to request and execute the deletion of your account and associated third-party data:

  • In-App Deletion: You can permanently delete your account and clear all associated data directly from the platform. Go to the Dashboard, select Account Settings, and click Delete Account. This performs a GDPR/CCPA-compliant hard delete that immediately purges your authentication record, deletes your private profile details, deletes your rosters and league memberships, and anonymizes community leaderboard history.
  • Email Deletion Request: You can contact our support team at privacy@thelosersbracket.com with a request to delete your account. We will verify your identity and process the deletion within 30 days.

4. League Data Protection & Separation

We restrict league records so managers can access only the leagues they belong to. Access controls are designed to keep private rosters, configuration, and commissioner activity separated from other leagues.

5. Contact Us

If you have any questions or suggestions about this Privacy Policy, your rights, or data protection controls, do not hesitate to contact us at:
privacy@thelosersbracket.com