Privacy Policy

We try to keep what we collect to the minimum needed to run TakeZone:

• Account info you provide when you sign up — email address, password (hashed by our auth provider), and the home city you enter on your profile.
• OAuth profile info if you sign in with Google — your name, email, and avatar URL as returned by Google.
• Activity you create on the Service — your tier rankings, World Cup XI ballots, votes, and shared cards.
• Technical data — basic request logs (IP address, user agent, timestamps) that our hosting and backend providers retain to operate and secure the Service.

We do not knowingly collect information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

• To authenticate you and keep your session active.
• To save your rankings, ballots, and preferences across devices.
• To compute and display aggregate, anonymized consensus (e.g. “X% of users picked this player”). Individual ballots are not displayed publicly with your name attached.
• To operate, secure, debug, and improve the Service.
• To respond to you when you contact support.

We do not sell your personal information, and we do not show third-party advertising on the Service.

We use a small set of vendors to run the Service. They process information on our behalf under their own terms and security practices:

• Lovable Cloud / Supabase — authentication, database, and backend hosting.
• Cloudflare — edge hosting, DNS, and traffic delivery.
• Google — only when you choose to sign in with Google.

We use cookies and browser local storage that are strictly necessary to sign you in and keep you signed in. We do not use third-party advertising cookies. We may use basic, privacy-respecting analytics in the future; if we do, we'll update this page first.

We keep account data while your account is active. You can request deletion of your account and associated personal data at any time by emailing us — see “Contact” below. Aggregate, de-identified statistics (e.g. how often a player was picked across all users) may be retained after deletion.

• You can edit your home city and rankings any time from the app.
• You can reset your password from the sign-in page if you signed up with email.
• You can request access, correction, or deletion of your personal data by emailing us.

Connections to TakeZone are encrypted in transit (HTTPS). Passwords are stored as salted hashes by our authentication provider. No service can promise perfect security; if you believe you've found a vulnerability, please email us so we can address it.

If we make material changes to this policy, we'll update the date above and, where appropriate, notify signed-in users in-product.

Questions, requests, or security reports — use our contact form.