MegaSquad Privacy Policy

1. About this policy

This Privacy Policy applies to both:

• megasquad.org, including its marketing pages and interest form; and
• app.megasquad.org, where the MegaSquad app is operated.

MegaSquad is a sports pick’em web app. Members predict the winners of scheduled games and compete in private groups.

A league is a competition for one season of one sport. A squad is a persistent group of people who play leagues together. Members make one pick per game before kickoff. Picks lock at kickoff and cannot be changed afterward. Standings are calculated from correct picks and shown to other members of the same league.

MegaSquad currently supports an NFL season and a completed college basketball tournament. The app is designed to support additional sports in the future.

MegaSquad is run jointly by two operators. It is a personal project rather than a company. There are no employees and no data protection officer.

In this policy, “MegaSquad,” “we,” “us,” and “our” refer to MegaSquad and its operators.

2. Personal information we collect

Information members provide at signup

At launch, signup is invite-only. A new account requires an invitation. The invited person enters a code that is emailed to the invited address to prove they control that address. This does not add any new categories of personal information beyond what is listed below.

When you create an account, we collect:

• Username. This is required and is shown to other members of leagues you share.
• Email address. This is required. It is used for sign-in and service notifications. It is not used for marketing to other members. It is not shown to other members of leagues or squads you share.
• Full name. This is optional. If provided, it may be shown in league standings.
• Password. Your password is required for account security. We store it only as a bcrypt hash. We do not store it in plain text.

Information members may provide later

You may choose to provide:

• Phone number. This is collected only if you choose to receive SMS notifications. The number is verified using a code.
• Notification preferences. These tell us which emails and text messages you want to receive.

Information created through use of MegaSquad

When you use the app, we create or receive information about:

• Your picks, including the team selected, the game, and the time of the pick.
• Standings and historical rankings.
• Squad and league memberships.
• Invitations sent or received.
• Your account and notification settings.

Your picks and standings may be visible to other members of the same league. Email addresses and phone numbers are not displayed to other members through the app’s screens.

Information from the interest form

The marketing site includes an interest form for people who want to start or join a squad.

The form collects:

• An email address; and
• An optional free-text message about starting or joining a squad.

The interest-form email address and message will be used only to contact the person about getting into MegaSquad. The form is not a subscription, and MegaSquad does not operate a newsletter.

We will not sell or share interest-form information. A person may ask us to remove their interest-form information by contacting us at the address in Section 17.

Information we do not knowingly collect

MegaSquad does not currently collect:

• Payment information;
• Date of birth;
• Home address;
• Precise location;
• Government identification numbers; or
• Health information.

MegaSquad is not directed to children, and we do not knowingly collect personal information from children.

3. How we use personal information

We use personal information to:

• Create and manage accounts.
• Allow members to sign in.
• Operate squads, leagues, picks, standings, and rankings.
• Send invitations.
• Send requested email notifications, including weekly reminders and season recaps.
• Send SMS notifications when a member has opted in.
• Verify phone numbers.
• Respond to interest-form submissions.
• Keep the service secure and prevent misuse.
• Understand how the sites and app are used.
• Maintain, troubleshoot, and improve MegaSquad.
• Respond to privacy requests and other messages.
• Meet legal obligations when applicable.

We do not use picks to make decisions about members outside the operation of the game and its standings.

4. Legal bases for processing

For users in places where privacy laws such as the GDPR or UK GDPR apply, we rely on the following legal bases, as applicable:

• Consent. We may rely on consent where we ask for it, such as for optional SMS notifications or certain analytics and cookie uses.
• Legitimate interests. We may process information where reasonably necessary to operate MegaSquad, keep accounts secure, prevent abuse, communicate about requested service features, and maintain and improve the service. We consider members’ privacy rights when relying on this basis.

5. When we share personal information

We do not sell, rent, or share personal information for advertising purposes.

We may provide personal information to service providers that help us operate MegaSquad. These providers may process information only to provide services to us or as otherwise permitted by law.

Our service providers include:

• Amazon Web Services. We use AWS, including DynamoDB in us-east-1, as the primary data store for account, pick, league, and squad information.
• Amazon Simple Email Service (Amazon SES). We use SES to send emails such as invitations, weekly reminders, season recaps, and invite-only signup codes.
• Amazon Simple Notification Service (Amazon SNS). We use SNS to send SMS notifications to members who have opted in. This may involve US telephone numbers.
• Vercel. Vercel hosts the marketing site and the app. Vercel also provides its own first-party web analytics, which is the only analytics provider used on megasquad.org and app.megasquad.org.
• Resend. Resend delivers interest-form submissions by email to the operators’ inboxes and may retain delivery logs for a limited period.
• Cloudflare Turnstile. We use Cloudflare Turnstile on the interest form to stop automated submissions. Turnstile loads only if a visitor starts filling out the form. Cloudflare receives the visitor’s IP address and browser signals directly from the visitor’s browser, and our server sends Cloudflare only the Turnstile token needed to validate the check. We use Turnstile to prevent abuse, not to track visitors or build advertising profiles.
• Squarespace (domain registrar) and Mailgun (mail forwarding). Our domain registrar uses Mailgun to forward mail sent to privacy@megasquad.org to the operators.

MegaSquad handles authentication in-house. The backend issues its own signed tokens and hashes passwords with bcrypt. We do not use a third-party identity provider for MegaSquad authentication.

Service providers may change. If they do, we will update this policy when appropriate.

6. Email and SMS notifications

We use email to provide service messages, including invitations, invite-only signup codes, weekly reminders, and season recaps. We may also use email to respond to an interest-form submission.

Members may choose which available notifications they want to receive.

If you choose SMS notifications, we collect and verify your phone number. We will send texts only for the notification types you select, subject to applicable law. You may turn off SMS notifications through the app or by contacting us.

Message and data rates may apply to SMS messages under your mobile plan. Text-message consent is not a condition of creating an account.

7. Analytics

We use analytics to understand how people use the marketing site and app. Analytics may measure information such as pages viewed, general interactions, technical information, and site performance. We use this information to maintain and improve MegaSquad.

Analytics run for all visitors to the marketing site and app, not only members and not only signed-in people. For example, the sign-in page loads analytics before someone has an account.

Our analytics are provided by our host, Vercel. Vercel Analytics is first-party and cookieless.

We strip identifiers from URLs before sending URLs to Vercel Analytics. This is intended to prevent league IDs, invitation tokens, and similar identifiers from being included in analytics data.

Google Analytics was used on the app until September 25, 2026, when it was removed.

8. Cookies and similar technologies

MegaSquad intends to use a cookie across the megasquad.org subdomains.

Once the sign-in-state feature is live, the app will write a cookie scoped to megasquad.org that contains only the member’s username. The cookie:

• Will be readable by JavaScript.
• Will not grant access to the account.
• Will not authenticate the member.
• Will be used only to change a link on the marketing site from “Sign in” to “Open the app.”
• May contain only information that is already public in the app.

Current status as of the effective date (September 26, 2026): As of the effective date, the app does not yet write this cookie. We intend to update this section when the app begins writing the cookie.

We currently treat this cookie as necessary for displaying the correct sign-in-state link requested by the visitor. We will provide any notice or consent choice required by applicable law. If the purpose or contents of this cookie change, we will update this policy and reassess whether consent is required.

We also use a bot check (Cloudflare Turnstile) on the interest form, which loads only when a visitor starts filling out the form. It is used to prevent automated submissions, not to track visitors across sites or to build advertising profiles.

Analytics and other technologies may also be used as described in Section 7. Non-essential technologies will be handled according to applicable consent requirements.

9. Interest form

When someone submits the interest form, we use the email address and any optional message only to contact the person about getting into MegaSquad. The form is not a mailing list and does not create a subscription.

We do not sell or share the address or message.

A person may ask us to remove their interest-form information by emailing the privacy contact in Section 17. We will also delete interest-form addresses and messages when they are no longer needed for managing interest and invitations, subject to limited retention that may be needed for security, legal, or recordkeeping purposes, including limited retention in service-provider delivery logs.

10. Retention

We intend to keep personal information while an account is active and for a limited period afterward when reasonably necessary for security, legal, fraud-prevention, dispute-resolution, or recordkeeping purposes.

When an account is deleted, we intend to delete or de-identify the account’s personal information, picks, and standings information. We may retain information that no longer identifies the person, such as aggregate or de-identified historical results.

Interest-form addresses and messages will be deleted when the person asks us to remove them or when they are no longer needed for managing interest and invitations, subject to limited exceptions. Some service providers (such as email delivery providers) may retain limited delivery logs for a limited period.

We are developing specific retention periods and may update them as the service develops. We will update this policy if the retention approach materially changes.

11. Deleting an account and personal information

MegaSquad does not currently have a self-service deletion flow.

Until a deletion flow is available, you may request deletion by contacting the operator at the privacy contact in Section 17. We will review and act on deletion requests after taking reasonable steps to verify the request.

When an account is deleted:

• The account and associated personal details will be deleted.
• Picks and standings connected to the account will be removed or de-identified.
• Where necessary, affected league standings may be recalculated.
• Other members’ historical standings may be affected because a deleted member’s picks or results may no longer be included.
• We may preserve de-identified historical totals or results that cannot reasonably be connected back to the deleted member.
• We may retain limited information where necessary to comply with law, prevent fraud or abuse, resolve disputes, or protect the service.

12. US state privacy rights

Some US states provide privacy rights to residents, including rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), where applicable.

Depending on the law that applies, you may have the right to:

• Know or access the personal information we collect, use, disclose, or retain about you.
• Delete personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Avoid discrimination for exercising privacy rights.

MegaSquad does not sell, rent, or share personal information. MegaSquad does not share personal information for cross-context behavioral advertising or targeted advertising.

To exercise a privacy right, contact us using the information in Section 17. Please identify the right you are exercising and provide enough information for us to understand and process the request.

We may need to verify your identity before completing a request. Verification may include confirming information associated with your account or email address. We will not use information provided for verification for an unrelated purpose.

We will not discriminate against you for exercising a privacy right. We will respond according to the requirements of the law that applies to your request.

This policy does not state whether MegaSquad meets or does not meet any particular state-law threshold.

13. International users and GDPR

MegaSquad is operated from the United States. The primary data store is AWS in us-east-1, and personal information may be processed in the United States.

The sites are publicly reachable. Whether the GDPR, UK GDPR, or another international privacy law applies may depend on factors including where a person is located, whether MegaSquad is directed to that location, and the nature of the service.

If the GDPR or UK GDPR applies, you may have rights to:

• Access your personal information.
• Correct inaccurate information.
• Delete your personal information.
• Receive certain information in a portable format.
• Object to certain processing.
• Restrict certain processing.
• Complain to a data protection supervisory authority.

To exercise these rights, contact us at the address in Section 17. We may verify your identity before responding.

Our intended legal bases are consent where we ask for it and legitimate interests such as operating the service, keeping accounts secure, preventing misuse, and maintaining MegaSquad. Additional legal bases may apply depending on the processing and the law.

14. Security

We use reasonable measures intended to protect personal information, including:

• Passwords stored only as bcrypt hashes, not in plain text.
• In-house sign-in using signed tokens.
• Access to production data limited to the operators and automated deployment systems.

No online service is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed through a security incident.

If we become aware of a legally reportable security incident, we will provide any notices required by applicable law.

15. Fees and payment information

As of the effective date, MegaSquad is free to use. We do not currently charge members, and MegaSquad does not process payments.

We currently have no plan to charge for MegaSquad. This statement describes the present situation and is not a promise that the service will always be free. If that changes, we will update this policy and tell members in advance where required.

16. Changes to this policy

We may update this Privacy Policy as MegaSquad, its data practices, or applicable laws change.

For material changes, we may announce the update on the site, in the app, by email, or through another reasonable method. The updated policy will include a new effective date.

Your continued use of MegaSquad after an updated policy becomes effective means that the updated policy will apply to future use, to the extent permitted by law.

17. Contact

For privacy questions, deletion requests, access requests, correction requests, or other privacy rights requests, contact:

Privacy contact: privacy@megasquad.org