Privacy Policy

Last updated: September 18, 2026

Effective date: September 9, 2026 (opening day of the NFL season)

This Privacy Policy describes how Touchdown Team ("we", "us", or "our") collects, uses, and shares your personal information.

It covers two services, referred to together as "the Service":

• the Touchdown Team mobile application, an NFL pick'em game for iOS and Android;
• the THE SNAP website, published at `thesnap.touchdownteam.app`, which carries our daily edition, the NFL news wire and the season's data.

Both share the same account: signing in on the website uses your app credentials, and the other way round. Where a practice applies to only one of the two, this policy says so explicitly.

By using the application or the website, you agree to the collection and use of information in accordance with this policy.

---

1. Who we are

Touchdown Team is a mobile pickem application focused on the National Football League (NFL). THE SNAP, published at `thesnap.touchdownteam.app`, is its editorial counterpart: a daily edition, a news wire and the season's data, free to read and without an account.

Both are operated by an independent developer ("the Developer") and are not affiliated with, endorsed by, sponsored by, or in any way officially connected with the NFL or any of its franchises.

For any privacy-related question, contact us at: [email protected]

---

2. Information we collect

2.1 Information you provide

When you create a Touchdown Team account — from the application or from the website — we collect, as applicable:

• Email address (for email/password sign-in in the application, a sign-in link sent by email on the website, or via Apple/Google Sign-In)
• Username (your unique handle, e.g., `tom_picks`)
• Display name (the name shown to other users in your leagues)
• Country (optional): the country you choose yourself. It is shown, as a flag next to your username on the global leaderboard, only if you agreed to it; you can change or hide it at any time in the settings
• Favorite NFL team (your single selection from the 32 teams)
• Preferred language and content region (set explicitly or detected from device)
• Avatar image (optional, uploaded by you)
• Feedback messages (when you use the in-app feedback feature)

The last five items are specific to the application: the website only asks for an email address and a username (see 2.4).

2.2 Information generated by your use of the Service

• Picks : your selections for each NFL game (winner, ATS, total, exact score)
• League memberships and standings : the private leagues you create or join, and your role
• Connection country: the country your device connects from, derived from the network address by our hosting provider. It is used only for internal statistics (where players come from) and is never shown to other users
• Hot take votes : your votes on editorial content, linked to your account. Only the aggregated totals are visible to other users — never your individual vote
• Live game tracking (iOS only) : if you start tracking a game (Live Activity / Dynamic Island), an Apple device token (APNs) is recorded for that game so score updates can be pushed to you. It is linked to your account and deleted with it
• Pick reminders : these are scheduled locally by your device — no notification token is collected for them and nothing leaves your phone

2.3 Information collected automatically

• Device and OS (iOS or Android version, app version)
• Crash reports, error logs and performance measurements, to diagnose technical issues. They are linked to your account identifier — that is what makes it possible to see that the same player keeps hitting the same bug. They contain neither your email address nor your username, both stripped before sending.
• App usage measurement (screens viewed, actions taken), only if you have consented. Without consent, nothing is collected.
• Approximate region (derived from IP address by our hosting provider for fraud prevention)

We do not collect your precise location, contacts, browsing history outside Touchdown Team, or any data unrelated to the Service.

2.4 On the THE SNAP website

Reading is free and anonymous. Browsing the edition, the news wire, the games, the standings or the stats requires no account and creates no profile.

If you choose to sign in (Google, Apple, or a link sent by email — there is no password on the website), we collect:

• your email address, passed on by the provider you chose;
• the username you pick on first sign-in, the only thing shown publicly next to your messages.

Once signed in, you can:

• comment on an edition — your message and username are visible to every reader;
• vote in the daily debate — only the vote totals are published, never your individual vote;
• report a comment, which records the reason and your account identifier.
• block a user — their comments disappear from your feed immediately; we record the block (your identifier and the blocked account's) and are notified of it.

Moderation. These comments are available in the app as well as on the website. Before publication, every comment is screened automatically by a content-classification service (Mistral AI — see section 4) that receives the text only, never your identity; a rejected comment is not published. On request, a comment can be translated into your language (DeepL — section 4), again without your identity. If content breaches our Terms of Service, we remove it and may exclude the account that posted it: we then record the date and reason of the exclusion, which remains reversible.

Storage in your browser. The website places a session token in your browser's local storage so you stay signed in between visits. It is strictly necessary for sign-in to work, is used for no tracking whatsoever, and disappears when you sign out or clear the site's data.

Advertising cookies. The THE SNAP website carries advertising and Google places advertising cookies there — in the European Economic Area, the United Kingdom and Switzerland, only after you agree. Section 9 sets out what is stored, what you see and how to change your mind. The touchdownteam.app showcase site places no advertising cookie and has no analytics tool.

2.5 If you continue as guest

You can use Touchdown Team anonymously without providing an email. In that case, an anonymous identifier is stored on our authentication system. Your picks and league memberships persist on your device and on our servers until you delete the app or your account.

---

3. How we use your information

We use your information only to:

• Provide the Service (manage your account, picks, leagues and standings in the application; publish your comments and count your votes on the website)
• Display localized content (news, videos) in your preferred language
• Send transactional emails (sign-in link on the website, password reset in the application)
• Diagnose bugs and improve the application and the website
• Comply with legal obligations

We never sell your personal data to third parties.

---

4. Sharing with third parties

We share limited information with the following processors solely to operate the Service:

We may also share your data:

• With other Touchdown Team users you choose to interact with (your username, display name, avatar, picks score, and favorite team are visible to members of leagues you join)
• Publicly, on the THE SNAP website: your comments and the username attached to them are readable by anyone, including without an account. What you voted never is — only the totals are published
• If legally required by court order, subpoena, or regulatory request
• In case of acquisition or merger, in which case the acquiring entity will be bound by this Privacy Policy or notify you of changes

---

5. Your rights (GDPR / EEA / UK / Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access your personal data — available in-app via Profile → Export my data
• Rectification of inaccurate data — edit in-app via Profile
• Erasure of your data ("right to be forgotten") — available in-app via Profile → Delete my account (permanent, cascade deletes all your picks and leagues)
• Data portability — the export feature provides your data in standard JSON
• Withdraw consent at any time for processing based on consent
• Restriction of processing of your data in the cases provided for by GDPR
• Object to processing based on legitimate interest, on grounds relating to your particular situation
• Lodge a complaint with your national data protection authority

Quebec / Canada. If you reside in Quebec, Law 25 grants you equivalent rights of access and rectification, exercised through the same channels. The Developer acts as the person in charge of the protection of personal information and can be reached at the address below.

To exercise these rights, use the in-app features or contact: [email protected]

We respond to data requests within 30 days as required by GDPR.

---

6. Data retention

• Active accounts : your data is retained for as long as your account is active
• Inactive accounts : if you do not sign in for 24 consecutive months, we may delete your account and associated data after a 30-day warning email
• Deleted accounts : data is removed from production systems within 7 days; backups are purged within 90 days
• Anonymous accounts : retained for 6 months after last activity, then deleted
• Comments published on the website: kept as long as they are online; deleting your account removes them
• Reports, blocks and exclusions: kept as long as the account concerned exists; a lifted exclusion stays on record for 12 months, then is erased

---

7. Children's privacy

Touchdown Team is not directed to children under 13 (under 16 in the EEA; in Quebec, the law additionally requires parental consent for any minor under 14). We do not knowingly collect personal information from minors below these ages. If you believe we may have inadvertently collected data from a minor, contact [email protected] and we will delete it promptly.

---

8. Security

We protect your data with industry-standard measures:

• Encryption in transit : all network traffic uses TLS 1.2+
• Encryption at rest : all database storage encrypted (AES-256 via Supabase)
• Row-level security (RLS) : enforced at the database level so you only see your own data and data you are entitled to (e.g., picks of league members after kickoff)
• Service-role keys : never exposed to client devices
• Authentication : passwords stored as bcrypt hashes (when applicable); OAuth tokens never persisted on our servers

No system is 100% secure. In the event of a data breach affecting your personal data, we will notify the competent authority within the legal deadlines — 72 hours under GDPR where notification is required — and we will inform you directly where the breach is likely to result in a high risk to your rights (GDPR) or a risk of serious injury (Law 25).

---

9. Advertising and measurement

Touchdown Team and THE SNAP are free, and funded by advertising. Both go through Google, but through two different ad platforms: the app through Google AdMob, the THE SNAP website through Google AdSense. The rules are not the same — so we separate them, rather than leaving you to work out which one applies.

The touchdownteam.app showcase site, the one you are reading right now, carries no advertising.

9.1 In the app

Touchdown Team shows banners at the bottom of some screens. There are no full-screen ads, no forced video, no interruption of what you were doing.

Personalized advertising. AdMob may use the IDFA on iOS or the Advertising ID on Android to personalize ads. This only happens with your agreement:

• on iOS, Apple's App Tracking Transparency prompt is shown to you before any personalization;
• in the European Economic Area, the United Kingdom and Switzerland, the Google UMP consent form is shown in addition.

If you decline, or for as long as you have not answered, you see non-personalized ads: they are served without an advertising profile, although Google may still use technical identifiers to cap how often an ad repeats, produce aggregated measurements and fight fraud. You therefore lose no access to the Service, and we never show personalized advertising "by default".

Changing your mind. At any time, from Profile → Manage advertising consent. The change takes effect immediately, with no need to restart the app.

9.2 On the THE SNAP website

What follows concerns thesnap.touchdownteam.app only.

What you see. Banners, and nothing else: one above the footer on every page, and depending on where you are, one at the top of the page or partway through the reading. As in the app: no full-screen format, no video, nothing that covers what you are reading.

What it stores. Ads are served by Google. Like all third-party vendors, Google uses cookies to serve ads based on your prior visits to this site and to other websites. These advertising cookies enable Google and its partners to tailor the ads shown to you. In plain terms: this is profiling — your interests are inferred from your browsing in order to choose what you are shown. We would rather write it down than let you work it out.

In the European Economic Area, the United Kingdom and Switzerland, none of this starts without you. A Google consent message is shown to you before anything is stored. Until you accept, no advertising cookie is placed — neither to personalize, nor to cap how often an ad repeats. You can change your mind at any time from that same message.

Elsewhere, including Québec and the rest of Canada, ads are served with those cookies. You stay in control, and here is where:

• turn off personalized advertising at Google: Google Ad Settings;
• understand what Google collects and why: How Google uses data;
• opt out across participating ad networks: Your Online Choices or aboutads.info.

Opting out closes no door: the site stays fully accessible, the ads simply become less relevant.

Audience measurement. The website uses no analytics tool. If we add one, it will be a tool with no cookie and no browser fingerprinting, and this section will say so beforehand.

9.3 Usage measurement and crash reports

Usage measurement. Our measurement tool (PostHog) follows exactly the same rule as advertising in the app: it starts only if you have consented. A refusal, or no answer at all, means nothing is collected.

Crash reports. These are the exception, and we say so plainly: Sentry always starts, on the basis of legitimate interest. Without them, an app that crashes stays broken, and nobody gains from that. They contain neither your email nor your username.

---

10. International transfers

Your data is primarily stored in Switzerland (Zurich) by our hosting provider Supabase — a country recognized as providing adequate protection by the European Commission and by Canada. Our two technical tools stay in Europe: Sentry in Germany, PostHog in the European Union. Some processors (Google, Apple, ESPN, YouTube) may transfer data to the United States. These transfers rely on the mechanisms provided for by GDPR depending on the provider: an adequacy decision (EU-US Data Privacy Framework) or Standard Contractual Clauses.

---

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy in the application and on the website
• Sending an email to your registered address
• Displaying a banner on the application's next launch

Continued use of the application or the website after the effective date of a change constitutes acknowledgement of the updated policy. Where new processing legally requires your consent, it will be requested explicitly — continued use does not replace it.

---

12. Contact

For any question about this Privacy Policy or your personal data:

• Email : [email protected]
• Postal : (to be added before launch)

For complaints, you may also contact your national data protection authority. In France: CNIL. In Germany: BfDI.

---

*This Privacy Policy is provided in English and French. In case of conflict, the English version prevails.*