Privacy Policy

What we collect

• Account: your username; your password (stored only as a one-way hash that can't be read back); a hashed recovery code; the date you joined and agreed to the terms; and your email address if you add one.
• Guest ID: if you use the app without an account, a random ID so your coins and picks stay with your device.
• Profile: your profile photo if you add one (we store a small, resized copy), your equipped cosmetics, jersey, coins, points, streaks, badges and items.
• Friends and chats: your friends, friend requests you send and receive, people you've blocked, the chats and groups you're in, and the messages you send in direct messages, group chats, public groups, game chats and play chats, including plays you share into a chat and the game a chat is watching.
• Games you play: reactions, picks and over/unders (including a history of your settled picks, used for group pick standings), "Call it" and trivia answers, and Blitz results.
• Reports: reports you file, and reports filed about your messages or photo.
• Saved on your device only: the teams and players you follow, your favorite league and display preferences stay on your device. While the app is open, the IDs of players you follow are sent to our server so we can alert you; we don't store them. In the app, your sign-in token and guest ID are kept in the app's storage on your device.
• Technical: your IP address is used briefly in memory to stop spam and abuse (rate limits) and isn't stored by us. Our hosting provider keeps standard server logs.

Phone permissions

The app only asks for access to your photos or camera when you choose to add a profile photo. The photo is cropped and shrunk on your phone before it's uploaded, and only that picture is sent to us.

Who can see what

• Anyone using the service: your username, profile photo (or initials), cosmetics, title, badges and points, and your messages in game chats, play chats and public groups. Anyone signed in can find you by searching your username. Public groups show their member list.
• Your friends and the people in your chats: your messages in those chats, whether you're active right now, your picks for a game the chat is watching, your Blitz results for that game, and your season pick record in that chat.
• Moderators: see the specific message or photo that was reported and who posted it, not the rest of the conversation.
• Our team: messages are stored on our server and aren't end-to-end encrypted. We only access them when needed to run and fix the service, look into reports or abuse, keep people safe, or follow the law.
• Never shown to anyone: your email, password, recovery code, IP address, friend list, and who you've blocked.

Cookies

On the website we use two essential cookies and nothing else: bbs keeps you signed in (30 days) and bbid is the guest ID. Both are HttpOnly (scripts can't read them) and are sent only over HTTPS. There are no advertising or tracking cookies.

Who else is involved

• Render hosts the service and its database, including profile photos, in the United States.
• Sports data providers: our server requests scores and stats from them. We don't send them any information about you.
• Google Fonts: your device loads the app's fonts from Google, so Google sees your IP address as with any website that uses its fonts. Team badges and player icons come from our own server.
• Email (only if turned on): verification and password-reset emails are sent through our email provider.

We don't sell or rent personal information, and we don't share it for advertising. We may share information if the law requires it, to report illegal content such as child sexual abuse material to NCMEC, or to protect people from harm.

How long we keep things

• Your account and profile: until you delete your account.
• Profile photo: until you change or remove it, or delete your account. A photo hidden by reports stays stored until a moderator decides.
• Direct messages, group chats and public groups: each conversation keeps its most recent 400 messages; older ones are deleted automatically.
• Game chats, play chats and reactions: deleted automatically about 14 days after the last activity on that game.
• Sign-in sessions: 30 days. Moderation reports: until reviewed, then up to the most recent 1,000.

Your choices and rights

• Delete your account: Profile → Account settings → Delete account. This permanently removes your account, profile, photo, coins, items, friends and friend requests, your messages in group chats, public groups, game chats and comments, your reactions and votes, and every direct message conversation you're in (for both people).
• Remove your photo: tap your profile picture → Remove photo.
• Block someone from one of their messages, or from a direct message's details.
• Access or correct your data: contact us at support@getscorch.app.
• Depending on where you live (for example under GDPR or California law), you may have more rights, such as getting a copy of your data. Contact us and we'll help.

Kids

The service isn't meant for children under 13, and we don't knowingly collect their information. If you think a child under 13 has an account, contact us and we'll delete it.

Security

Passwords and recovery codes are hashed, connections use HTTPS, and sign-in is rate-limited. No system is perfect, so please use a password you don't use anywhere else, and don't share very private information in chats.

Changes

If we change this policy in an important way, we'll tell you in the app before it takes effect. Contact: support@getscorch.app.