Privacy Policy

Overview

This policy explains how Steel City Gameday ("we," "us," or "our") handles information when you use our iOS app, website, and related services (the "Service"). We use information to provide the Service, keep Crews safe, process support requests, and comply with law. We do not sell personal information, serve ads, or track you across other companies’ apps and websites.

Information we collect

• Account information: You can sign in with Apple or with an email address and password. Sign in with Apple provides an account-specific identifier and, only if you choose to share it, your name. For email accounts, Supabase stores the email address and securely manages the password credential; we cannot view your password. Supabase maintains the authentication account and session used to sign you in. When you use Apple, we securely exchange Apple’s authorization code and retain an encrypted refresh credential so we can revoke access if you delete your account. We do not request your Apple ID password or contacts.
• Profile and Crew information: your display name, avatar color, Crews, memberships, roles, and invite activity.
• User content: messages, reactions, Crew polls and votes, game-day moments, reports and report details, predictions, picks, standings, and game results or receipts associated with your account.
• Purchase history: Apple processes Season Pass purchases. The app sends Apple’s signed transaction to our server, where we verify and retain the product, transaction identifiers, purchase and revocation dates, and the Steel City Gameday account linked to the entitlement. This lets us enforce access, restore it across devices, and respond to refunds. We do not receive or store your payment card or bank information.
• Technical and diagnostic information: our hosting and authentication providers may process your account identifier, IP address, request time, request path and status, device or browser type, user agent, authentication events, and error, diagnostic, or security details when you connect. We use this information to operate, secure, and troubleshoot the Service—not for advertising.
• Support communications: if you email us, we receive your email address and the information you include so we can respond.

How we use information

• Authenticate you and maintain your profile across devices.
• Create Crews, deliver messages and reactions, score picks, show standings, and restore access you purchased from Apple.
• Apply automated content safeguards, investigate reports, block abuse, enforce our Terms, and protect users and the Service.
• Respond to support, diagnose failures, prevent fraud, and satisfy legal obligations.

Crew privacy and moderation

Crew content is available to members of that Crew and is protected by account authentication and server-side access controls. It is not public, but it is not end-to-end encrypted. We and our service providers can process content to deliver the Service. If content is reported, we may review the reported content and related account information to investigate and act on abuse. Automated safeguards may reject messages that appear to violate our Community Rules.

On-device storage and widgets

When you use Sign in with Apple, the app stores your Apple account-specific identifier in the device Keychain. For either sign-in method, the app uses device storage for your signed-in session. It also saves local snapshots of schedules, Crews, participation, and standings so the app can load quickly, work through brief connection problems, and supply the Season Race widget.

Signing out or completing account deletion clears the main user-specific snapshots and the Season Race widget snapshot from the shared app and widget container. A basic preference showing that you completed the welcome screens may remain on the device until you delete the app. Deleting the app removes its device-local data, but it does not delete your account or server-side information.

If you add the Season Race widget, your Crew name, member display names, and points can appear on your Home Screen. Anyone who can view your Home Screen may see that information.

When we disclose information

We disclose information only as needed to operate the Service:

• Other users: your display name, avatar color, Crew role, and content you post to a Crew are visible to the people in that Crew.
• Service providers: Supabase provides authentication, database, and realtime services; Vercel hosts our API and operational logs; GitHub Pages hosts the public website; Apple provides sign-in and in-app purchase services; and Google serves fonts on the website and hosts our support inbox. These providers may receive the information needed to perform those services, such as account, connection, transaction, or support information. We require providers that handle personal information for us to protect it consistently with this policy and applicable law.
• News and other external sites: when you open a story from The Wire or follow another external link, the destination site receives ordinary connection information, such as your IP address and browser details, and handles it under its own privacy policy.
• Safety and law: we may preserve or disclose information when reasonably necessary to comply with law, respond to valid legal process, protect a person’s safety, investigate fraud or abuse, or protect our rights and the Service.
• Business transfer: if the Service is involved in a merger, financing, acquisition, or sale, information may transfer as part of that transaction subject to this policy and applicable law.

We do not sell personal information or share it for cross-context behavioral advertising.

Retention and account deletion

We retain account information, encrypted Sign in with Apple revocation credentials when applicable, content, and linked entitlement records while your account is active and as needed to provide and secure the Service. Technical and authentication logs are generally retained for limited periods based on provider configuration and operational needs. Reports and security records may be retained longer when needed to investigate abuse, enforce our Terms, prevent fraud, resolve disputes, or comply with law.

You can delete your account in the app at Settings → Delete account. In ordinary operation, this revokes the app’s Sign in with Apple access when applicable and removes your authentication account, encrypted Apple refresh credential when applicable, profile, Crews you own, memberships, messages, reactions, polls and votes, moments, picks, reports you submitted, invitations, blocks, and linked entitlement record from the live Service.

To preserve a Crew’s season history, completed-game receipts and game-room result events in a Crew you did not own may remain after deletion. Those historical records may include your internal account identifier, the display name recorded at the time, points, awards, and game results, and remain available only to members of that Crew. Limited information may also remain temporarily in provider backups, authentication logs, or security logs, or where retention is required for safety, fraud prevention, dispute resolution, or law.

Deleting the app does not delete your account. A Season Pass is managed by your Apple Account; deleting your Steel City Gameday account does not cancel or erase Apple’s purchase record.

Your choices and rights

• Edit your display name or block and unblock users in Settings.
• Delete your account and associated content from Settings without contacting us, subject to the limited historical, backup, security, and legal-retention exceptions described above.
• Contact us to request access, correction, deletion, or a copy of information associated with you. We may need to verify your identity and may retain information where permitted by law.

Depending on where you live, you may have additional privacy rights and the right to appeal a decision. We will not discriminate against you for exercising a privacy right.

Children

The Service requires users to be at least 13 and is not directed to children under 13. We do not ask for a birth date or knowingly collect personal information from a child under 13. If we learn that a child under 13 has provided personal information, we will take steps to delete it. If you believe that has happened, please contact us.

Security and international processing

We use reasonable technical and organizational safeguards, including encrypted network connections, authentication, and server-side access controls. No system is completely secure, so we cannot guarantee absolute security. Information may be processed in the United States and other places where our providers operate, subject to applicable safeguards.

Changes to this policy

We may update this policy as the Service changes. We will post the revised version here and update the effective date. If a change materially affects how we handle personal information, we will provide additional notice when appropriate.

Contact

Questions, privacy requests, and safety concerns can be sent to [email protected].