Privacy Policy
Effective Date: July 1, 2026 · Last Updated: July 29, 2026
Mat Bracket Challenge LLC (“we,” “our,” or “us”) operates Mat Bracket Challenge. This policy explains what we collect, how we use and share it, and your choices. It applies to our website and mobile apps.
1. Information we collect
You provide:
- Account: email address; username (public); nickname (visible to your groups); password (handled by our authentication provider, Supabase); your 13+ age affirmation.
- Profile & cosmetics: emblem selections (public); a location you choose — state (US) or country (public); celebrity/verification application (including a social handle you give us so we can contact and verify you) and, for verified accounts, a public bio and optional social media links you choose to display (public).
- Contests & content: your picks, pool/league participation, lineups, and drafts; feature suggestions you submit; chat messages, and safety data including reports you file, users you block, and related moderation records (visible to your group and our moderators).
- Communications: support messages and preferences.
Collected automatically:
- IP address, device/browser information, and operational logs.
- Approximate geolocation derived from IP (used for aggregate/analytics reporting), plus the location you self-select.
- Push tokens and notification preferences (for app users).
- Cookies / local storage for session, theme, and app-mode (see §7).
From third parties:
- Google OAuth profile info (name, email) if you sign in with Google.
- Sign in with Apple: the name and email you choose to share (or an Apple private-relay email if you hide it), plus the authentication tokens needed to keep you signed in and to revoke Apple authorization if you delete your account. Apple typically provides your name/email only on your first sign-in.
- Payment/transaction metadata from Stripe (we do not receive full card numbers).
- Purchase, subscription, entitlement, renewal/expiration, and transaction status from RevenueCat for in-app purchases. RevenueCat receives your internal account (user) identifier as its App User ID; it does not receive your password or full payment-card details.
Generated by the Service:
- Purchase, gift, entitlement, and RideTime Points (RTP) ledger history; leaderboard standings and scores (standings are public).
2. How we use your information
To operate and provide the Service; authenticate you; process payments and unlock paid features; administer contests, leaderboards, pools, and RTP/entitlements; deliver push notifications; send account and (subject to your choices) marketing emails; moderate content and enforce our Terms; detect, prevent, and investigate fraud, abuse, and security incidents; produce aggregate geolocation/usage analytics; and comply with legal obligations.
3. What’s public vs. group-visible vs. private
- Public (may be seen by anyone and copied, cached, or indexed by search engines): username, picks and leaderboard standings, active emblems, celebrity verification status and public bio, any social media links a verified account chooses to display, self-selected location.
- Group-visible (seen by members of a shared pool/league/draft/chat): nickname, chat messages, and your participation in that group.
- Private (not shown publicly): email, password, IP/device data, notification tokens/preferences, purchase/RTP history.
- Gifts: the recipient can see the sender’s identity and the item gifted.
4. Payments
Web payments are processed securely by Stripe. We do not store full card numbers. Stripe’s handling of payment data is governed by Stripe’s own privacy policy. In-app purchases are billed by Apple or Google under their policies, and we use RevenueCat to validate receipts and manage purchase/subscription status, restoration, and renewals for the app.
5. Service providers & data sources
We share limited information only with providers that help us run the Service:
- Supabase — authentication & database.
- Stripe — payments.
- Vercel — website/app hosting & delivery.
- Apple Push Notification service & Firebase Cloud Messaging (Google) — push notification delivery (device tokens).
- Resend — transactional email delivery (e.g., alerts and receipts).
- Google (Gmail / Workspace) — bulk/marketing email delivery and OAuth sign-in.
- Apple — Sign in with Apple, mobile app distribution, and in-app billing.
- Apple / Google — mobile app distribution and in-app billing.
- RevenueCat — in-app purchase & subscription processing (receipt/entitlement validation, subscription management, restoration).
- Sentry (Functional Software, Inc.) — crash & error diagnostics.
We do not sell, rent, or trade your personal information. Contest scoring may use manually entered data and authorized third-party roster, schedule, and results sources, which may include TrackWrestling when available; we do not send your personal data to those sports-data sources.
Crash & diagnostic reporting. Our website and mobile apps use Sentry to detect crashes and technical errors and improve reliability. When an error occurs, we may send the app version, device and operating-system type, the time of the error, a crash/stack trace, and a limited set of technical events leading up to it. We do not intentionally attach your account identity, cookies, request bodies, or URL query strings, and we configure Sentry to limit and scrub such information; we do not use it for advertising or tracking. Sentry processes this information on our behalf as a service provider, and we retain it only as long as reasonably necessary to investigate and fix reliability problems.
6. Marketing emails
By creating an account you agree we may send account/service emails (e.g., season or tournament announcements). Marketing emails include an unsubscribe link and our postal address. We do not sell your email. You may opt out of non-essential email anytime.
7. Cookies & local storage
We use only strictly-necessary cookies and local storage — for sign-in/session, your theme choice, and app-mode. We do not use third-party advertising or analytics trackers.
8. International users & data transfers
We operate globally, and our providers process data in the United States and elsewhere. If you access the Service from the EU/UK or California, additional rights may apply (§9).
9. Your rights & choices
Depending on where you live, you may have rights to access, correct, delete, or port your data, to opt out of marketing email and push, and to object to or restrict certain processing. You can manage notification preferences on your profile, unsubscribe from emails, and request access or deletion by emailing support@matbracketchallenge.com. We may need to verify your identity before acting. EU/UK (GDPR) and California (CCPA/CPRA) residents have additional statutory rights.
Deleting your account. You can delete your account in the app or on the website viaProfile → Delete Account (details at /account-deletion). Deletion disables your login and removes or anonymizes your profile information, and deletes your chat messages, reactions, push tokens, and notification preferences. To keep leaderboards, leagues, and archives coherent, past contest records are retained in de-identified form (no longer publicly associated with your identity). We may also retain payment/tax, fraud/security, moderation, and legal records for appropriate periods, and isolated backups until their normal expiration. If you use Sign in with Apple, we revoke your Apple authorization as part of deletion. Deleting your account does notautomatically cancel an Apple or Google subscription — cancel that in your store account settings.
10. Children’s privacy (COPPA)
The Service is not directed to children under 13, and children under 13 may not register or use it. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact support@matbracketchallenge.com and we will promptly delete it.
11. Data retention
We retain information for as long as your account is active or as needed to provide the Service, then delete or de-identify it, except where longer retention is required for payment/tax records, transaction/RTP ledger entries, contest results, moderation or security evidence, legal compliance, or backups (which expire on our normal backup cycle).
12. Data security
We take reasonable measures to protect your information, but no system can be guaranteed to be 100% secure.
13. Changes to this policy
We may update this policy; changes are posted here with a new effective date.
14. Contact
Mat Bracket Challenge LLC
5013 S Louise Ave #1311, Sioux Falls, SD 57108
support@matbracketchallenge.com
