Privacy Policy

Information you provide and why

First and last name are required for new registration and stored for account and event administration. Your username identifies you in the rivalry and lets other players find you. Your email address is used for email verification, sign-in and account support. Phone number is optional; when supplied it is stored as private contact information and checked for valid formatting and duplicates. The current app does not use phone numbers for SMS sign-in.

Your ZIP code is collected during registration to calculate regional team counts. We use saved ZIP codes, not IP-based location guesses, for the territory map. Your selected team and affiliation (such as Chris, Ben, FOC or FOB) identify your participation in the event. Signup progress is saved so verified users can resume an incomplete registration.

Participation, scores and social information

We store event registration and attendance responses to manage participation and calculate attendance totals. Creating an account or opening a ticket link does not by itself mark you as attending. Attendance is a separate response; ticket purchases occur separately.

Referral links and codes identify the recruiter. We retain referral attribution, registration qualification and reward history to credit exactly 100 recruiting points after a referred person completes verified registration and to prevent duplicate or self-referral rewards. Clicking a link or installing the app does not earn that reward. Recipients can choose either team.

We store poll choices and voting records to prevent duplicate voting and calculate results. Game sessions, submitted answers, attempts, results and awarded points support gameplay, streaks, comparisons and leaderboards. A server-side points ledger records scoring and reward history. These records also support abuse prevention and score integrity.

Friend requests, friendships and blocks support player search, friend management and friends-only leaderboards. Eligible friends can compare points and daily-game results; comparison details are restricted by the existing gameplay and friendship rules. Event announcements and content published by authorized event managers are displayed in the app.

What other people can see

Usernames, selected teams, affiliations, display/profile labels, points, ranks, streaks, successful recruit counts and recruiting scores may appear in player-facing profiles, search and leaderboards. Regional labels or city labels, where present in a public profile, may also be visible. Sharing your personal referral link or code reveals the recruiter’s public username and team.

Names collected as private registration names, email addresses, phone numbers and individual saved ZIP codes are not included in public player search or leaderboard responses. Public territory and attendance displays contain aggregate counts. Public poll totals contain counts rather than a list of voters and their choices.

You can access your own private account information. The authenticated Owner can read player contact details, names, affiliation, team, attendance and points through the protected Player Management dashboard and download matching records to Excel. Authorized service operators may access stored information to operate the service. Ordinary players and non-owner admins are not authorized to access that private directory or its exports. Blocking another player does not make your public leaderboard information private.

Services and external destinations

Supabase provides authentication, the database and storage, including saved account data, game records and game images. Vercel hosts the website and serves it to browsers and the iPhone app. Resend is the email delivery provider configured for the account verification emails. Email delivery necessarily involves your email address and the message being delivered. Messages sent to our Gmail contact address are handled through Gmail (Google). The operator’s project workspace uses Microsoft OneDrive; backup and review files in that workspace may be synchronized by Microsoft. Downloaded Owner spreadsheets can also be held on the operator’s devices.

Apple distributes the iPhone app through TestFlight and, when released, the App Store. The iPhone app displays the website in a WebView. Device sharing actions use the clipboard, Messages or the system share sheet when available; those actions do not give this app your contacts list.

Configured ticket buttons open FEVO purchasing destinations outside the app. FEVO handles information you provide during its checkout under its own policies. This app’s ticket-link feature does not collect payment-card details or infer attendance from a link click. Other external destinations, including Apple installation pages and your email or messaging app, have their own privacy practices.

Hosting, authentication and email services receive technical request information needed to deliver their services, such as network addresses and request metadata. The application source does not include an advertising SDK or a third-party behavioral analytics integration; this statement does not describe every provider’s infrastructure logging or your device’s own services.

Device storage

The website uses local storage to keep the Supabase sign-in session, appearance preferences and a pending referral code. The iPhone WebView uses persistent website storage. Referral information can be attached to a verified account and recovered when signing in in another browser or the app; a website link alone cannot guarantee attribution through an App Store or TestFlight installation. A pending deletion receipt is stored on the device to recover from a lost response and is cleared after confirmed deletion and session cleanup.

Logging out signs out the account but does not delete its database records. Clearing browser or app storage may remove local preferences or an invitation that has not yet been attached to a verified account.

Email communications and ticket offers

Email verification and sign-in codes are necessary account communications. Support correspondence is handled through the contact address below. Event information and announcements are available in the app; the current application code does not implement an automated event-email campaign.

Promotional ticket offers are different from verification codes and necessary account or event administration messages. The current app does not include a marketing-consent control or an automated promotional-email campaign. This policy does not create a marketing opt-in through registration. Contact chrisbenteam@gmail.com with questions or requests about promotional messages you receive and your communication preferences.

Retention and deletion requests

Account information, incomplete signup progress and participation history remain stored to support accounts, event operations, score integrity and historical records until an account is deleted or records are otherwise removed. No general automatic retention schedule is implemented. Backups and previously downloaded Owner Excel files can contain older copies.

To initiate deletion in the app, open Settings and select Delete Account. Type DELETE, verify a fresh six-digit code sent to your registered email, then confirm permanent deletion. Verified users with incomplete registration can also initiate deletion from the registration screen. Owner/admin accounts and accounts with protected event content cannot use deletion until an authorized, verified transfer of responsibilities and protected content is complete. Contact chrisbenteam@gmail.com to arrange that transfer; removing a role alone does not clear protected historical relationships.

Successful deletion removes your personal account and Auth identity, leaderboard entry, points, game attempts, votes, attendance, friendships and referral activity from the live database. Referral rewards connected to your registration are removed from your recruiter. Other players keep unrelated accounts and legitimate points. Your email, phone and ordinary username can be used for a new registration; reserved official usernames remain subject to the existing reservation rules.

The deletion transaction removes server sessions and refresh tokens, and the app clears its saved session and account-related device storage. Previously issued access tokens can remain cryptographically valid until their original expiry, but the deleted identity cannot refresh them and the removed account cannot access its former private records or protected player operations.

If the connection fails during deletion, use Check deletion status before trying again. An opaque request digest, derived from the account identifier and a random request nonce, supports confirmation for 24 hours without storing the raw account identifier in the receipt table. Expired receipts are removed when the receipt/deletion routines next run. A missing or expired receipt does not prove that deletion failed.

Our approved policy targets 30-day retention for backups and exports under our control. A separate operator register and disposal procedure cover original snapshots, downloaded spreadsheets, synchronized copies, version history and recycle bins. These controls require operator action; the app does not automatically erase existing files. Third-party systems may require longer retention under their actual recovery windows, legal holds or other documented provider rules. We do not promise universal deletion within 30 days. Until the operator controls are activated and verified, existing copies remain until manually removed.

To prevent an older database backup from restoring a deleted account, the deletion transaction keeps a restricted recovery journal containing the former account’s internal authentication identifier and deletion time, without names, email, phone, ZIP, scores or authentication credentials. Operators use an encrypted, independently held journal to reconcile an isolated restoration before making it accessible. If a complete authoritative journal cannot be verified, the restored service must remain inaccessible. These minimal recovery identifiers are retained for at least 30 days and longer while a related backup remains restorable, including any required provider exception. They can be retired through a restricted operator process only after all related copies are verified to be irrecoverable; retirement is not automatic.

Provider retention is separate from live account deletion. Supabase recovery windows depend on the project plan and backup configuration. Vercel retains hosting logs and deployment resources under its own settings. Resend publishes 30-day email/log retention on standard plans and a separate seven-day backup window; the exact expiration of a deleted player’s information across those copies has not been confirmed for this service. Provider logs, recipient messages, independent FEVO records and Apple-held information are not erased by the app’s database deletion. Contact chrisbenteam@gmail.com about retained copies or privacy requests. Logging out or uninstalling alone does not delete your account.

Security and privacy choices

The app uses email verification, server-side authorization and database access policies to limit access and protect account ownership, private player data and score updates. Production website traffic uses HTTPS. These controls do not guarantee that every security incident can be prevented.

You can edit saved names and private registration details in Profile Settings where the existing controls allow it. Phone is optional and can be left blank or removed through those controls. Usernames and finalized team selections are permanent in the current registration system; email changes are not available in the current app. Contact us about information you cannot change yourself.

You can choose whether to submit an attendance response, participate in polls or games, use referrals, or add friends. You can remove or block friends using the existing controls. Attendance updates remain subject to event registration restrictions. Optional participation does not remove information already recorded. Use Settings to log out on shared devices.

Contact and policy updates

For privacy questions, requests and communication preferences, contact the Chris vs Ben team at chrisbenteam@gmail.com. This policy applies to the Chris vs Ben website and its iPhone website wrapper. We may update this page as the service changes; the effective date identifies the version of the policy.