Privacy Policy

This Privacy Policy explains how LEAGUEBUCKET LLC ("LeagueBucket," "we," "us") collects, uses, and shares personal information through the LeagueBucket website and application (the "Service"). It covers everyone who interacts with the Service: league commissioners, Members (players, parents, spectators, officials, followers), people who submit the youth-league waitlist form, and visitors to our public pages.

This policy takes effect on {{EFFECTIVE_DATE}}.

For account and billing information you give us directly (your login email, your subscription plan, your support requests), LeagueBucket decides how and why that information is used, and is the controller (or, in CCPA terms, the business) for it.

For information a league's commissioner enters about that league's own Members -- rosters, contact details, results -- the commissioner and their league decide what gets entered and why. LeagueBucket processes that information on the league's behalf and instruction, as a processor (or service provider). This distinction, and what it means for how league data is handled, is spelled out fully in our Data Processing Addendum, which every league is subject to.

We collect information in three ways:

We use information to operate the Service: creating and running leagues, showing schedules and standings, sending the messages a league or its Members have asked for, processing payments, providing support, keeping the Service secure, and understanding usage well enough to fix problems and improve it.

We also use the agreement record described above, and our internal log of administrative changes, to resolve disputes -- including a dispute about a payment or about whether an account holder accepted these terms. This is the only purpose either record is used for.

We do not use Member information to build advertising profiles, and we do not use it for any purpose beyond running the Service for the league it belongs to. See the Ad-Free Pledge, both on its own page and as a binding term of the Terms of Service.

We do not sell, rent, or trade personal information to advertisers or data brokers, on any plan, for any reason. We do not run third-party advertising on the Service. This is written into our Terms of Service rather than living only in a policy page, and section 5a of those Terms commits us to 30 days' notice and an email before any of it changes -- so it cannot change quietly, even though we are not calling it permanent.

Mobile phone numbers and text-message consent are held to the same rule, stated separately because mobile carriers require it to be: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. A number given for text alerts is shared only with the provider that delivers the message, which is delivery and not marketing. The record of your consent to receive texts -- when you gave it, and from where -- is not shared with any third party for any purpose. Our Text Message Terms describe that program in full.

We share information only with the service providers ("subprocessors") that help us run LeagueBucket, and only to the extent needed for them to do that job, under contracts that restrict them from using it for anything else. As of {{EFFECTIVE_DATE}}, our subprocessors are:

We keep league and account information for as long as the account or league is active, plus a reasonable period afterward to handle disputes, comply with legal obligations (for example, financial records related to payments), and allow recovery of an accidentally-deleted league. {{PLACEHOLDER: a specific retention schedule, once decided, belongs here -- not invented in this draft.}}

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain uses of it. You can exercise any of these rights by emailing privacy@leaguebucket.com. We currently fulfill these requests manually; a self-serve export/delete tool is planned but not yet built, so please allow time for a human to process your request and expect us to verify your identity before acting on it.

If you are a Member of a league rather than its commissioner, some of your information (like your roster entry) may need to be corrected or removed by that league's commissioner rather than by us directly, since they control what's entered about their league -- we'll tell you which applies when you contact us.

LeagueBucket is an adult-only service at this time (see the Terms of Service, "Who can use LeagueBucket"). We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

The one deliberate exception is the "youth leagues coming soon" waitlist: it exists specifically so we can gauge interest from youth leagues without collecting anything about the children involved. That form asks only for the requesting adult's own name and contact details -- never a child's name, age, birthdate, or contact information. If you run a youth league, please do not enter anything about your players there.

LeagueBucket is operated from the United States, and information is processed and stored there. If you are accessing the Service from the European Economic Area, the United Kingdom, or elsewhere outside the United States, your information will be transferred to and processed in the United States.

{{PLACEHOLDER: whether GDPR/UK GDPR applies to LeagueBucket depends on facts not yet settled -- primarily whether the Service is considered to be "targeting" EU/UK users (marketing, currency, language) versus merely being passively accessible to them, and whether it is offered to consumers there at all. This section should not be relied on until a lawyer has assessed that question and, if it applies, this policy is updated with the legal basis for processing, a description of transfer safeguards (e.g., Standard Contractual Clauses), and EU/UK-specific rights language. Flagged as a jurisdictional assumption in progress/track-a3.md, not resolved here.}}

We use industry-standard measures to protect information in the Service, including encryption in transit and database access control (Postgres row-level security scoped per league). No system is perfectly secure, and we cannot guarantee absolute security.

We may update this policy from time to time. If a change is material, we will give notice before it takes effect, the same way described in the Terms of Service.

Questions about this policy, or requests relating to your personal information, can be sent to privacy@leaguebucket.com.