Privacy Policy

Citrus Fantasy Hockey ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web service (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy.

We collect information that you voluntarily provide when using our Service:

• Account Information: Email address, username, password (securely hashed)
• Profile Information: Display name, first and last name, team name, and optional phone number, location, biography, and avatar/logo
• League Data: League names, team rosters, draft picks, transactions, matchup results
• Communications: Messages you send through our support channels or in-app chat features

When you use our Service, we automatically collect certain information:

• Usage Data: With your permission, pages visited, features used, and interaction patterns
• Device Information: Device type, operating system, app version, unique device identifiers
• Network Information: IP address, connection type, general location (country/region)
• Performance Data: App crashes, errors, loading times (for improving service quality)

We collect publicly available NHL player statistics and game data from official NHL sources to power our fantasy sports platform. This data includes player names, statistics, team affiliations, and game schedules. We are not affiliated with or endorsed by the National Hockey League (NHL).

We use the collected information for the following purposes:

• Service Delivery: Provide, maintain, and improve our fantasy hockey platform
• Account Management: Create and manage your account, authenticate users
• League Operations: Process drafts, roster changes, scoring, matchups, and standings
• Personalization: Customize your experience based on preferences and usage patterns
• Communications: Send service updates, league notifications, and important announcements
• Analytics: Understand how users interact with our Service to improve features
• Security: Detect, prevent, and address fraud, abuse, and security issues
• Legal Compliance: Comply with applicable laws, regulations, and legal processes

We do not sell your personal information. We may share your information in the following limited circumstances:

3.1 With Other Users

• Your team name, roster, and league activity are visible to other members of your leagues
• League commissioners can view all team rosters and transactions within their leagues
• Your profile information (username, team name, avatar) is visible to league members

3.2 With Service Providers

• Supabase: Database and authentication services (see: Supabase Privacy Policy)
• Firebase: Hosting and optional usage analytics (see: Firebase Privacy Policy)
• Anthropic (Claude): When you confirm sending a question to Stormy, we send your question, recent conversation and relevant league, roster and matchup context to Anthropic to generate an answer. You can cancel without sending. See Anthropic Privacy Policy.
• NHL API: Player statistics and game data (publicly available data only)

3.3 For Legal Reasons

• To comply with legal obligations, court orders, or government requests
• To protect our rights, property, and safety, or that of our users
• To investigate and prevent fraud, security issues, or illegal activity

3.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We retain your personal information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: Data retained while your account is active
• Inactive Accounts: Data retained for 2 years after last login, then anonymized or deleted
• Deleted Accounts: Personal data deleted within 30 days of account deletion request
• Legal Requirements: Some data may be retained longer to comply with legal obligations

You have the following rights regarding your personal information:

5.1 Access and Portability

You can access your account information at any time through the app's Settings page. You may request a copy of your data in a portable format.

5.2 Correction

You can update your account information (email, username, team name) through the Settings page.

5.3 Deletion

You can request deletion of your account and personal data through the Settings page. This will:

• Permanently delete your account and authentication credentials
• Remove your personal information from active databases
• Anonymize your historical league data (team names become "Former Team")
• Complete within 30 days of request

5.4 Marketing Opt-Out

You can unsubscribe from promotional emails using the unsubscribe link in any marketing email. Service-related emails (password resets, league notifications) cannot be disabled.

5.5 Do Not Track

We do not track users across third-party websites. Our Service does not respond to Do Not Track signals as we do not engage in cross-site tracking.

We implement industry-standard security measures to protect your information:

• Encryption: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Password Protection: Passwords are hashed using bcrypt before storage
• Access Controls: Strict access controls limit who can access user data
• Regular Audits: We conduct regular security audits and vulnerability assessments
• Database Security: Supabase provides enterprise-grade database security with Row Level Security (RLS)

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will delete such information from our systems.

If you are between 13 and 18 years old, you may only use our Service with the involvement and consent of a parent or guardian.

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ.

Our database and authentication services are hosted in Canada. Other service providers may process data in other countries, including the United States.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about the personal data we collect and how we use it
• Right to Delete: You can request deletion of your personal data (subject to legal exceptions)
• Right to Opt-Out: We do not sell personal information, so there is nothing to opt-out of
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at CitrusFantasySports@Gmail.com

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on contract performance, legitimate interests, and consent
• Right to Access: Request access to your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation on how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Lodge a Complaint: File a complaint with your local data protection authority

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying an in-app notification upon your next login

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

Our Service may contain links to third-party websites or services (such as NHL.com for player information). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

We use analytics tools to understand how users interact with our Service:

• First-Party Analytics: Firebase Analytics collects product interaction data only after you accept optional analytics. When signed in, this data may be linked to your user ID
• No Third-Party Tracking: The iOS and Android apps do not load advertising networks. The website may load Google AdSense. We do not use app data for cross-app advertising tracking
• No Cross-Site Tracking: We do not track your activity outside our Service
• Performance Monitoring: We do not currently collect crash or diagnostic reports from the apps. If we turn this on, we will update this policy and our Google Play Data safety declaration before it takes effect

By using our Service, you consent to our Privacy Policy and agree to its terms.