Privacy policy
Last updated: Sep 22
Endzoned is a free pick'em run by one fan. This page explains what personal data we keep, why, who else handles it and what you can do about it, under the GDPR in Europe and the privacy laws of the US, the UK and Canada.
1. Who is responsible
Endzoned is published by Olivier Leonardi, a private individual living in France who runs it as a non-commercial fan project. He decides how your data is used (the “controller” under the GDPR). Contact: nflpredictions@olileo.fr. Full details are in the legal notice.
2. What we collect
Your account: email address, username, password (stored hashed, never readable), language, time zone, avatar, favorite teams and notification settings. If you sign in with Google or Apple, we receive the email address and identifier they share. What you do in the game: picks, bonus answers, tier lists, brackets, Survivor and player-of-the-week picks, the groups you join, your franchise names, chat messages and reactions, achievements, and the feedback you send us. Supporter badge: the date it was granted, if you support the project and ask for it. Technical data: IP address and browser in your sessions and in the server logs, the push subscription of each device where you turned on notifications, and anonymous error reports.
3. Why we use it, and on what legal basis
• Running the game and your account (picks, scores, standings, groups, chat, account emails, the reminders you can turn off): to provide the service you signed up for (GDPR art. 6(1)(b)). • Keeping the site secure, fighting spam and abuse, moderating, fixing bugs (logs, error reports, moderation records): our legitimate interest in a safe, working site (art. 6(1)(f)). • Audience statistics: only if you accept them in the cookie banner (art. 6(1)(a)). You can change your mind at any time in the “Cookies” section below. • Supporter badge: because you asked for it (art. 6(1)(b)). We show no ads, build no advertising profile and never sell your data.
4. Who can see what
Other players see your username, avatar, favorite teams, franchise names, points, achievements, your Supporter badge if you have one and, once a game has kicked off, your picks for it. Nobody sees your picks for a game that has not started. Your email address is never shown to other players. Group chat is visible to the members of that group only.
5. Service providers
• Hetzner Online GmbH (Germany, EU) hosts our servers, the database and its backups. • OVH SAS (France, EU) sends our emails. • Umami, an open-source statistics tool we host ourselves on the same servers: it runs only if you accept statistics, sets no cookie and does not store your IP address. • Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser) delivers notifications if you turn them on. They are encrypted, so the push service cannot read them. These providers only act on our instructions. We do not use any advertising or social media tracker.
6. Error tracking
To fix crashes we send technical error reports (message, stack trace, page URL without its parameters, browser version) to GlitchTip, an open-source tool we host ourselves in the EU. No cookie is set, your email address and your session are never included, and the reports are deleted after 90 days.
7. Data outside the EU
Our servers, database and emails stay in the EU. Scores, schedules and news are fetched by our server from ESPN's public feeds: no personal data is sent to ESPN that way. However, team logos, player photos and news pictures are loaded by your browser straight from ESPN's image servers (in the US), which therefore receive your IP address and browser details, like any website you visit. Other transfers only happen if you choose them: signing in with Google or Apple, turning on push notifications, or making a donation through the platform behind the Support button (for example Ko-fi). Each of these companies handles your data under its own privacy policy.
8. Cookies and local storage
We only use first-party cookies needed for the site to work: • the Better Auth session cookies (“better-auth.session_token” and a short-lived “better-auth.session_data” copy) keep you signed in, up to 30 days; • “nfl_lang” (language), “nfl_theme” (theme) and “nfl_tz” (time zone) remember your settings for one year; • “nfl_consent” remembers your cookie banner choice for six months. Your browser's local storage also keeps a few display settings (selected franchise, list density, folded sections, last chat message read); they never leave your device. No advertising or tracking cookie, ever.
Your statistics choice
You have not made a choice yet: statistics stay off until you accept them.
9. Retention
Account data is kept while your account exists. When you delete it (account page, “Danger zone”), it is erased immediately; your chat messages stay in their groups, signed “Deleted account”, and backup copies disappear within 30 days. An account whose email address was never verified is deleted after 30 days. Sessions (IP address, browser) are erased when they expire, server logs after 30 days, the history of sent emails and notifications after one year (one season), invitations 30 days after they expire, handled join requests and rejected feedback after 6 months, and push subscriptions that keep failing after 30 days. If an administrator suspends your account or excludes you from the Open League, the date and the reason are kept while the measure lasts, and in the moderation log for one year. The Supporter badge stays until you ask us to remove it or delete your account; the donation platform keeps its own records.
10. Your rights
You can access, rectify, export or delete your data, object to processing, and lodge a complaint with the CNIL. It all happens on your account page: “Your data” downloads everything we keep about you (JSON file, one export per hour) and “Danger zone” deletes your account for good. For anything else, or if your account is suspended, write to nflpredictions@olileo.fr. We answer within one month. You can also restrict processing and withdraw your consent to statistics at any time. The supervisory authority is the CNIL (France, cnil.fr), and you can also contact the authority of the country where you live.
11. Players in the US, the UK and Canada
United States (California and other states): you have the right to know what personal information we collect and why (this page), to get a copy, to have it corrected or deleted, and not to be treated differently for using these rights. We do not sell or share your personal information, we do not use it for targeted advertising and we collect no sensitive information. Endzoned is a small non-commercial project that is most likely below the thresholds of these laws, but these rights apply to everyone anyway. United Kingdom: you have the same rights under the UK GDPR and can complain to the ICO (ico.org.uk). Canada: you can access and correct your information and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). To use any of these rights, use your account page or write to nflpredictions@olileo.fr; someone acting for you can do it too if they show us they are allowed to.
12. Age
Endzoned is for people aged 15 and over. If you are younger, please do not sign up. If we learn that an account belongs to someone under 15, we delete it. Parents can write to nflpredictions@olileo.fr.
13. Changes
We will update this page when what we do with your data changes, and change the date at the top. For an important change (a new purpose, a new kind of provider), we will also tell players on the site or by email before it applies. Advertising is not on the table today; if that ever changes, it will be announced here first and any ad tracking will need your consent.