Privacy Policy

Last updated: July 3, 2026  •  Operated by Saturday Night Showdown

1. Who This Applies To

Saturday Night Showdown ("SNS", "we", "us", "our") is a college-fantasy sports platform intended only for users who are 18 years of age or older. By creating an account you represent that you meet this requirement. This Privacy Policy describes what personal information we collect, how we use it, and the choices you have.

2. Information We Collect

Account information — provided directly by you:

  • Name and email address (required to create an account).
  • Password — stored as a one-way cryptographic hash (bcrypt). We never store or transmit your plaintext password.
  • Age bracket (e.g., 18–24, 25–34) derived from your date of birth at signup; the raw date of birth is used only to verify eligibility and is not retained afterward.
  • If you choose to sign in with Google OAuth, we receive your name, email address, and Google profile ID from Google. We do not receive your Google password. Google sign-in is optional; email and password is always available.
  • Optional profile details you add — display name, avatar, or team preferences.

Gameplay data — generated by your use of the service:

  • Leagues you create or join; your roster selections, lineup decisions, draft picks, and trade activity.
  • In-app NIL Bucks balances and transaction history. NIL Bucks are play-money with no real-world cash value (see Section 9).
  • Commissioner settings and league configuration you control.
  • Scores, standings, and historical results for leagues you participate in.

Messages and chat — content you create in league chat, group chats, and direct messages, including the message text, any images you attach, timestamps, and the participants. If you file an abuse report, we collect the reason you select, any note you add, and the message or user you reported.

First-party analytics — collected automatically as you use SNS:

  • Page views, navigation paths, feature interactions, and session timing.
  • The position of taps and clicks on a page, the on-screen label of the control tapped, and the link it points to — never the contents of any form field, never text you type, and never a page address's query values. We use this to see which controls people actually use and which ones do nothing when tapped. This click data is kept for 30 days.
  • These events are submitted by your browser to POST /api/v1/analytics/collect on our own servers and stored in our own database. We do not use Google Analytics, Meta Pixel, or any third-party analytics tracker.
  • Analytics data is used solely to understand how the product is used and to improve it.

Technical and device data:

  • Browser type, version, operating system, and screen dimensions — used to render the site correctly.
  • IP address — retained in server logs for up to 90 days for security purposes (rate limiting, abuse detection), then deleted.
  • Referring URL (the page you came from), if any.

Support communications — if you contact us via the Support page, we retain the content of your message and any account or session context you include for up to 12 months.

3. How We Use Your Information

  • Provide the service: run your leagues, process draft picks and lineup decisions, compute scores, and display player and team data from our stats provider.
  • Authentication and security: verify your identity at login, prevent unauthorized access, enforce the 18+ age requirement.
  • Transactional email: send account confirmations, password-reset links, and league notifications via our self-hosted email infrastructure. We do not send unsolicited marketing email without your opt-in.
  • Product improvement: analyze first-party analytics (aggregated and anonymized where possible) to understand usage patterns, prioritize features, and fix problems.
  • Support: respond to your questions and resolve account issues.
  • Legal compliance: meet obligations imposed by applicable law, including responding to valid legal requests from authorities.

We do not use your personal information to train external AI models, build advertising profiles, or sell data to third parties.

4. Cookies and Browser Storage

SNS uses a small set of first-party browser storage mechanisms only:

  • Authentication token (cff_token) in localStorage: a signed JSON Web Token (JWT) that keeps you logged in between sessions. It contains your user ID and permission flags; it never contains your password. You can clear it at any time by signing out or by clearing your browser's site data for this domain.
  • Session and UI preferences in localStorage: values such as your selected league, theme preference, and session state. These remain in your browser and are sent to our servers only as part of normal API calls they are attached to.
  • First-party session identifier: a short-lived, anonymous cookie used to group page views within a single visit for analytics. This cookie does not track you across other websites.

We do not set advertising cookies, and we do not allow third parties to set cookies on SNS pages at this time. If we integrate an external advertising network in the future, this policy will be updated and, where legally required, we will request your consent before any such cookies are set.

5. Third-Party Services

SNS depends on a small number of external services to operate:

  • College Football Data (CFBD) API — provides public college football statistics (player, team, game data) that power the fantasy game. Your personal information is not shared with CFBD; all requests are server-to-server using a licensed API key. See collegefootballdata.com.
  • Google OAuth — if you choose "Sign in with Google," Google authenticates you and sends us your name, email address, and Google ID. Google's handling of your data during this flow is governed by the Google Privacy Policy.
  • Self-hosted email (Postal) — transactional email is delivered via Postal, a mail server we operate on our own infrastructure. Your email address is not shared with a third-party email marketing or delivery service.
  • Self-hosted infrastructure — all user data is stored on virtual machines we own and operate. We do not use a public cloud provider (AWS, GCP, Azure) for user data storage.
  • Stripe (PRO subscription payments) — if you subscribe to SNS PRO, payment is processed by Stripe. We receive a payment-status confirmation; we do not store your full card number. Stripe's privacy practices are described in the Stripe Privacy Policy. Note: paid features are not currently processing live real-money charges (Stripe is in test mode). This disclosure will be updated when live billing is enabled.

6. No Sale of Personal Information

We do not sell, rent, trade, or otherwise transfer your personal information to outside parties for their own marketing or commercial purposes. We share data only with the specific service providers listed in Section 5, each under terms that restrict their use of your data to operating the services we contracted them for.

7. Children

SNS is strictly an 18+ service and is not directed at or intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us via Support and we will remove that account promptly.

8. Data Retention

  • Active accounts: your account data (profile, leagues, rosters, NIL history) is retained for as long as your account remains active, because it constitutes your game record and league history.
  • Deleted accounts: when you request account deletion (see Section 9), we remove your identifying information within 30 days. Aggregated, anonymized analytics derived from your sessions may be retained beyond that period.
  • Server logs (IP addresses, request metadata): retained for up to 90 days for security and debugging purposes, then deleted.
  • Chat and messages: messages you send in league chat, group chats, and direct messages are retained while your account is active so conversations and league history keep working. You can delete your own messages; deleted messages are removed from view immediately and permanently purged on a rolling schedule (by default within about 30 days). When you delete your account, your messages are erased or anonymized as described in Section 9. Abuse reports and related moderation records are retained as long as needed to keep the community safe and to meet our legal obligations.
  • Support messages: retained for 12 months unless you request earlier deletion.

9. Your Rights and Choices

Regardless of where you live, you can exercise the following rights by contacting us via Support:

  • Access: request a summary of the personal data we hold about your account.
  • Correction: update inaccurate information via your account settings page or by contacting support.
  • Deletion: request deletion of your account and associated personal data. We will process the request within 30 days. We may retain a minimal record to prevent re-registration fraud if legally permitted to do so.
  • Portability: request an export of your personal data in a common format. We will respond to data export and access requests within 30 days.
  • Ad-free experience: SNS PRO subscribers can remove house advertising entirely. See your account settings.

We may need to verify your identity before processing a request. We will not discriminate against you for exercising these rights.

10. Security

We take reasonable technical and organizational measures to protect your information:

  • All traffic between your browser and our servers is encrypted via HTTPS (TLS).
  • Passwords are stored as salted cryptographic hashes (bcrypt); never in plaintext.
  • Authentication tokens (JWTs) use short expiry windows and support server-side revocation.
  • Rate limiting and anomaly detection are applied to authentication and sensitive endpoints.
  • Database access is scoped to a non-superuser application role.
  • Nightly encrypted backups are retained off-server.

No system is perfectly secure. If you discover a security vulnerability in SNS, please report it responsibly via Support.

11. Changes to This Policy

We may update this Privacy Policy as the product evolves. Material changes will be reflected by updating the "Last updated" date at the top of this page. For significant changes, we may also notify you by email or an in-app notice. Continued use of SNS after a policy update constitutes acceptance of the revised policy.

12. Contact

Privacy questions, data access or deletion requests, or other concerns — please use Support or email us at [email protected].