legal

Privacy Policy

last updated September 4, 2026

draft — pending attorney review

This policy is a good-faith plain-English draft written by the operator of NFL Survivor Edge. It has not yet been reviewed by an attorney and is not legal advice.

NFL Survivor Edge ("we", "the site") is an analytics and information tool for people who play survivor pools somewhere else. This page explains, in plain language, exactly what we collect about you, what we do not collect, who else touches it, and how you get it back or delete it.

1. What we collect

Account and authentication data

When you create an account we store your email address and authentication metadata (account creation time, last sign-in time, email-confirmation state, and — if you sign in with Google — the identifier that provider returns). Passwords are handled by our authentication provider and are stored only as salted hashes; we never see them.

Pool-tracking data you enter yourself

Everything in your dashboard is self-reported by you: pool names, entry names, the weeks and teams you say you picked, elimination status, and an optional entry-fee amount.

no money moves through this app

Any entry fee you record is an informational number used only to show what your own tracked pools are worth to you. We do not collect, hold, transfer, escrow, or pay out pool entry fees or prize money. Your real pool lives on Yahoo, ESPN, a spreadsheet, or your office — not here.

Product usage analytics, session replay and location

We use PostHog for product analytics across the whole site, for both signed-in and anonymous visitors. This includes: page views and page-leave/exit events; automatic click and interaction tracking (autocapture) and heatmap-style aggregate click patterns; browser, device and referring-page information; and session recordings — a replay of your on-site behaviour such as page navigation, scrolling and clicks.

what session replay does and does not capture

All form inputs are masked by default, so what you type — email addresses, passwords, pool and entry names — is not recorded. Network request and response payloads are not captured. Recordings are retained for 30 days and then deleted.

We also record how you arrived at the site: the referrer domain (such as the search engine or site that linked to you) and any UTM campaign parameters in the URL. This is used to understand which channels bring visitors to the Service, for product improvement and understanding our user base — not for advertising, and not sold or shared with third parties.

We also track the checkout and upgrade flow: when an upgrade prompt is shown, when checkout is started, when a purchase completes, and when checkout is cancelled. This exists so we can see where people drop off. No payment or card details ever reach our analytics — card entry happens entirely inside Stripe's hosted checkout.

IP address and approximate location

Your IP address is collected with analytics events and used by PostHog's GeoIP enrichment to derive an approximate location — country, region, city and timezone. We use this to understand where our users are located and to improve the product. It is not used for advertising, is not sold, and is not shared with ad networks or third-party ad trackers. PostHog retains this event data for up to 7 years under its standard retention; session recordings are kept for 30 days.

The overall purpose of all of the above is product improvement, conversion analysis and understanding our user base — nothing else.

Support correspondence

Emails you send us, and our replies, are retained so we can follow up.

Contact form and newsletter sign-up abuse prevention

When you submit the contact form or sign up for our newsletter, we temporarily process a hashed version of your IP address solely to prevent spam and automated abuse. This is separate from the PostHog IP/location data described above.

The hashed value is never linked to your name, email, or account, is not used for analytics or location, and is automatically deleted after 48 hours.

2. The odds and stats data is about NFL games, not about you

A large share of what this site stores is sports data: bookmaker odds from The Odds API, box scores and player data from Highlightly, and public play-by-play, roster, injury and schedule releases from nflverse. That data describes NFL teams, NFL players, referees, stadiums and games.

None of it is derived from you, tied to you, or used to profile you. We do not buy data about our users, do not track you across other websites, and do not run advertising networks or third-party ad pixels. When you browse Explore, you are reading a public sports database — it is not reading you.

3. Why we use it

To create and secure your account and sign you in.
To show your pools, entries, picks and recommendations back to you.
To send transactional email (confirmation, password reset, receipts).
To process a purchase, if you buy full access.
To understand which features are used and fix what is broken.
To detect abuse and enforce our Terms.

4. Who else touches your data

We use a small number of processors. We do not sell personal data to anyone.

Supabase / Lovable Cloud — hosting, database, and authentication. Stores your account and pool-tracking data.
Stripe — payment processing, once purchasing is live. Card details go directly to Stripe; we never receive or store your card number. We receive only the fact of payment, the amount, and a customer identifier.
Lovable Emails / Resend — delivery of transactional and, if you opt in, newsletter email. Receives your email address and the message content.
PostHog — product analytics, session replay and heatmaps. Receives usage and click events, session recordings with inputs masked, a pseudonymous identifier, and your IP address, which it uses to derive approximate location.

We may also disclose data if legally compelled, or to a successor entity in a merger or acquisition — in which case this policy travels with it.

5. Cookies and tracking

Strictly necessary: a session token stored in your browser so you stay signed in. Removing it signs you out.
Preferences: small local-storage values such as your last selected pool or a dismissed banner.
Analytics: a pseudonymous PostHog analytics cookie and local-storage identifier, used for usage events, click tracking and session replay.

There are no advertising or cross-site tracking cookies on this site. Browser "Do Not Track" and Global Privacy Control signals are respected for analytics where the browser sends them.

6. Your rights over your data

Regardless of where you live, you can:

Access — see everything tied to your account.
Export — request a machine-readable copy of your account and pool-tracking data.
Correct — edit your pools, entries and picks directly in the app at any time.
Delete — delete your account and its associated data.
Object / opt out — unsubscribe from non-transactional email using the link in any such email. We do not sell or "share" personal information as those terms are defined under California law.

To exercise any of these, email privacy@nflsurvivoredge.com from your account address. We aim to respond within 30 days.

7. How long we keep it

Account and pool data — for as long as your account exists, then deleted within 30 days of a deletion request.
Payment records — retained by Stripe and by us for as long as tax and accounting law requires (typically 7 years).
Analytics events (including IP-derived location) — retained by PostHog in pseudonymous form under its standard retention of up to 7 years.
Session recordings — 30 days, then deleted.
Support email — up to 24 months.
Contact form / newsletter sign-up abuse-prevention hash — 48 hours, then automatically deleted.
NFL sports data — retained indefinitely; it is historical public sports information and contains nothing about you.

8. Security

Data is encrypted in transit (TLS) and at rest by our hosting provider. Database access is restricted by row-level security so one account cannot read another account's pools. No system is perfect, and we will notify affected users without undue delay if a breach affecting personal data occurs.

9. Children's privacy

This site is intended for adults. You must be at least 18 years old to create an account, consistent with our Terms of Service. The site is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete the account and its data. If you believe a minor has registered, email us and we will remove it.

10. Where your data is processed

Our providers process data in the United States. If you access the site from outside the US, you understand that your data will be transferred to and stored in the US.

11. Changes to this policy

We will update the "last updated" date above when this policy changes, and will email account holders before any material change takes effect. Questions go to privacy@nflsurvivoredge.com.