Privacy notice
Draft, pending legal review. This describes what the site does today. We'll update it before anything about other families' kids is collected.
What we collect today
- Sign-in identity for parents and coaches. When a grown-up signs in, Firebase Authentication (a Google service) keeps the sign-in identity: the email address for an emailed sign-in link, or, for Google sign-in, the Google account's name, email address, profile photo link and Google account ID.
- The age question. Before it shows any way to sign in, the sign-in page asks for a birth month and year. The answer isn't saved or sent anywhere. If it's under 18, the page shows no sign-in options, and this browser keeps a "not now" marker for a day (just that and when it was set, never the date of birth). Until the question is answered 18 or over, the page loads nothing from Google, unless you're finishing an emailed link or a Google sign-in, or this browser already holds a saved sign-in (or its storage is too slow to tell, when the page loads Firebase to check). A browser where a grown-up is already signed in isn't asked: the page finds the saved sign-in in the browser's own storage, then loads Firebase from Google (www.gstatic.com) and checks it with Google's sign-in service, the same as any page that needs a signed-in grown-up.
- Your sign-in session, in your browser. Firebase Authentication keeps you signed in by storing your session in this browser until you sign out.
- Settings in your browser. The league and age group you pick is saved in this browser only. When you ask for a sign-in link, your email is kept in this browser until you finish signing in.
- Technical data. Like any website, our hosting and sign-in providers (Google Firebase) receive technical data such as your IP address to deliver the pages. Fonts are served from our own site; the home page and this notice contact no other server.
- Google's sign-in service. The pages kids play on (the practice pack, My view, steal signs and the library) contact no other server: they find the saved sign-in in the browser's own storage without loading anything from Google. Only if that storage is too slow to answer do they load Firebase (www.gstatic.com) to check it instead. The app home (the page with the Sign out button), and the sign-in page once the age question is answered 18 or over (or when you open an emailed sign-in link, come back from Google sign-in, or this browser already holds a saved sign-in), load Firebase Authentication's code from Google's servers (www.gstatic.com). The app home checks the sign-in with Google's sign-in service (identitytoolkit.googleapis.com) each time it opens while a grown-up is signed in, and renews it through securetoken.googleapis.com when it runs out (about once an hour). The sign-in page also contacts identitytoolkit.googleapis.com to send and finish an emailed sign-in link. For Google sign-in it loads Google's sign-in helper (apis.google.com, which also contacts www.googleapis.com): on phones and in Safari right after the age question is answered 18 or over (or while finishing an emailed link or a Google sign-in), elsewhere when you choose Google. The pages kids play on never load that helper.
What we don't collect
- Nothing about your kids. Teams and kid profiles are being tested by the site operator's own family, and nothing is collected about anyone else's children. Your kids never sign in, and we don't collect anything about them. If the age question is answered under 18, the sign-in page keeps only a "not now" marker in this browser, never a birth date, and sends nothing anywhere. Your kids' scores and answers aren't saved.
- No ads, and we don't sell anything about you.
- The early-access form sends nothing. It's a preview: what you type there isn't sent or saved.
Contact and deletion
Privacy contact: jariniskala@gmail.com
To have your sign-in record deleted, email us at the address above. You can sign out at any time.