Privacy Policy
Last updated: May 16, 2026
Effective date: TBA (NFL Week 1, September 3, 2026)
Contents
This Privacy Policy describes how Touchdown Team ("we", "us", or "our") collects, uses, and shares your personal information when you use the Touchdown Team mobile application (the "Service") for iOS and Android.
By using Touchdown Team, you agree to the collection and use of information in accordance with this policy.
1. Who we are
Touchdown Team is a mobile pickem application focused on the National Football League (NFL). The Service is operated by an independent developer ("the Developer"). Touchdown Team is not affiliated with, endorsed by, sponsored by, or in any way officially connected with the NFL or any of its franchises.
For any privacy-related question, contact us at: [email protected]
2. Information we collect
2.1 Information you provide
When you create a Touchdown Team account, we collect:
- Email address (for email/password sign-in, magic link, or via Apple/Google Sign-In)
- Username (your unique handle in the app, e.g., `tom_picks`)
- Display name (the name shown to other users in your leagues)
- Favorite NFL team (your single selection from the 32 teams)
- Preferred language and content region (set explicitly or detected from device)
- Avatar image (optional, uploaded by you)
- Feedback messages (when you use the in-app feedback feature)
2.2 Information generated by your use of the Service
- Picks : your selections for each NFL game (winner, ATS, total, exact score)
- League memberships and standings : the private leagues you create or join, and your role
- Hot take reactions : your emoji reactions to editorial content (stored locally)
2.3 Information collected automatically
- Device and OS (iOS or Android version, app version)
- Crash reports and error logs (anonymized) to diagnose technical issues
- Approximate region (derived from IP address by our hosting provider for fraud prevention)
We do not collect your precise location, contacts, browsing history outside Touchdown Team, or any data unrelated to the Service.
2.4 If you continue as guest
You can use Touchdown Team anonymously without providing an email. In that case, an anonymous identifier is stored on our authentication system. Your picks and league memberships persist on your device and on our servers until you delete the app or your account.
3. How we use your information
We use your information only to:
- Provide the core Touchdown Team Service (manage your account, picks, leagues, standings)
- Display localized content (news, videos) in your preferred language
- Send transactional emails (magic link sign-in, password reset)
- Diagnose bugs and improve the app
- Comply with legal obligations
We never sell your personal data to third parties.
4. Sharing with third parties
We share limited information with the following processors solely to operate the Service:
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase (supabase.com) | Backend, database, authentication, file storage | All account and pickem data | EU (Zurich) |
| Google Sign-In (when you use Google auth) | Authentication | Your Google account ID and email | Worldwide (Google policy) |
| Apple Sign-In (when you use Apple auth) | Authentication | Your Apple account ID and email (or proxy) | Worldwide (Apple policy) |
| ESPN public API | News articles fetching (NFL) | None — read-only fetch from public endpoint | USA |
| YouTube public RSS | Videos fetching (NFL channels) | None — read-only fetch from public endpoint | USA |
| The Odds API (optional, future) | Betting line aggregation | None — server-to-server | USA |
We may also share your data:
- With other Touchdown Team users you choose to interact with (your username, display name, avatar, picks score, and favorite team are visible to members of leagues you join)
- If legally required by court order, subpoena, or regulatory request
- In case of acquisition or merger, in which case the acquiring entity will be bound by this Privacy Policy or notify you of changes
5. Your rights (GDPR / EEA / UK / Switzerland)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:
- Access your personal data — available in-app via Profile → Export my data
- Rectification of inaccurate data — edit in-app via Profile
- Erasure of your data ("right to be forgotten") — available in-app via Profile → Delete my account (permanent, cascade deletes all your picks and leagues)
- Data portability — the export feature provides your data in standard JSON
- Withdraw consent at any time for processing based on consent
- Lodge a complaint with your national data protection authority
To exercise these rights, use the in-app features or contact: [email protected]
We respond to data requests within 30 days as required by GDPR.
6. Data retention
- Active accounts : your data is retained for as long as your account is active
- Inactive accounts : if you do not sign in for 24 consecutive months, we may delete your account and associated data after a 30-day warning email
- Deleted accounts : data is removed from production systems within 7 days; backups are purged within 90 days
- Anonymous accounts : retained for 6 months after last activity, then deleted
7. Children's privacy
Touchdown Team is not directed to children under 13 (under 16 in the EEA). We do not knowingly collect personal information from minors below these ages. If you believe we may have inadvertently collected data from a minor, contact [email protected] and we will delete it promptly.
8. Security
We protect your data with industry-standard measures:
- Encryption in transit : all network traffic uses TLS 1.2+
- Encryption at rest : all database storage encrypted (AES-256 via Supabase)
- Row-level security (RLS) : enforced at the database level so you only see your own data and data you are entitled to (e.g., picks of league members after kickoff)
- Service-role keys : never exposed to client devices
- Authentication : passwords stored as bcrypt hashes (when applicable); OAuth tokens never persisted on our servers
No system is 100% secure. In the event of a data breach affecting your personal data, we will notify you and competent authorities within 72 hours as required by GDPR.
9. Advertising and tracking
In a future release, Touchdown Team may display advertisements through Google AdMob to support the free tier. When that happens:
- AdMob may use the iOS IDFA or Android Advertising ID with your explicit consent (via Apple ATT prompt on iOS 14.5+ and the Google UMP / consent form in EEA/UK/CH)
- You can opt out of personalized advertising at any time in your device settings
- If you decline tracking, you will still see ads, but they will be non-personalized (contextual only)
This Privacy Policy will be updated before advertising is enabled.
10. International transfers
Your data is primarily stored in the European Union (Switzerland, Zurich) by our hosting provider Supabase. Some processors (Google, Apple, ESPN, YouTube) may transfer data to the United States. These transfers are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the new policy in the app
- Sending an email to your registered address
- Displaying an in-app banner on the next launch
Continued use of Touchdown Team after the effective date of a change constitutes acceptance of the updated policy.
12. Contact
For any question about this Privacy Policy or your personal data:
- Email : [email protected]
- Postal : (to be added before launch)
For complaints, you may also contact your national data protection authority. In France: CNIL. In Germany: BfDI.
*This Privacy Policy is provided in English and French. In case of conflict, the English version prevails.*