Privacy Policy

Introduction

At BragRights, we respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we look after your personal data when you visit our website and tell you about your privacy rights and how the law protects you.

This privacy policy applies to all users of our platform, including those who register to use our services, participate in competitions, or simply browse our website.

Information We Collect

How We Use Your Information

We use the information we collect for various purposes, including:

• Providing, operating, and maintaining our platform
• Improving, personalizing, and expanding our platform
• Understanding and analyzing how you use our platform
• Developing new products, services, features, and functionality
• Communicating with you about updates, security alerts, and support
• Sending you marketing and promotional communications (with your consent)
• Finding and preventing fraud
• For compliance purposes, including enforcing our Terms of Service

Data Sharing and Disclosure

At BragRights, we are committed to protecting your privacy. We do not sell or trade your personal information. We share, transfer, or disclose Google/YouTube user data only as described below.

What We Share Within Our Platform

• Your YouTube channel name is used to generate or display your username/identity on BragRights in creator contexts.
• When you sign up using YouTube OAuth, we automatically use your YouTube username to generate your username on our platform. This username becomes visible to all users across our platform in league tables, standings, and social features, regardless of whether you are in creator mode.
• Your YouTube-derived username is visible to all users on our platform in league contexts, leaderboards, and public areas.
• When you create a subscriber-only league, we pre-fill the league name field with your YouTube channel name. You can modify this before creating the league.
• League pages show channel/owner context for creator leagues.
• Only basic, publicly available channel information is shown to other users.

Visibility Scope

• Your YouTube-derived username is visible to all users on our platform in league contexts, leaderboards, and public sections.
• Channel information for league creators is visible to members of those leagues and to users on join flows.
• The information shown is limited to what is already publicly available on your YouTube channel.

Data Storage

• Channel ID and channel name (for identification and display)
• Subscriber count and avatar URL (for creator mode eligibility and profile display)
• OAuth access credentials (encrypted, for ongoing verification)
• Channel verification status and connection timestamps

This data is retained in our secure database to provide ongoing platform functionality.

When We Share Your Data

• Google Services: We use Google OAuth for authentication and YouTube API services to verify channel ownership and subscriptions. Your YouTube data is accessed only to provide our core functionality.
• Platform and hosting: Our web platform and hosting infrastructure may process logs (e.g., IP address, user-agent) for security and performance. This does not include your YouTube subscription details.
• Google AdSense: We display advertisements via Google AdSense, which may use cookies to show relevant ads. Ad serving is governed by Google's policies.
• We securely store encrypted OAuth credentials to maintain your YouTube connection and provide ongoing verification services. These credentials allow us to verify your channel ownership and subscription status as needed for platform features without requiring repeated authorization.

Legal Requirements

• Comply with legal obligations, court orders, or government requests
• Protect and defend our rights or property
• Protect the safety of our users or the public
• Prevent or investigate possible wrongdoing

Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

What We Don't Share

• We do not sell your personal information to third parties.
• We do not share your individual YouTube subscription status or the list of channels you subscribe to with other users.
• We do not transfer your data to marketing companies or data brokers.
• We do not disclose your league performance or prediction data to external parties without your consent.
• We do not share private YouTube data beyond what is necessary for core features.

YouTube Data Specific Disclosures

• Verifying channel ownership for content creator features.
• Confirming subscriptions for subscriber-only leagues.
• Displaying your channel information (such as channel name) within our platform in creator contexts.
• We periodically verify YouTube subscriptions for users in subscriber-only leagues through automated background processes to ensure league integrity and access control. These processes run without user interaction to maintain accurate league membership.

This data is not shared with other users beyond what you explicitly allow (for example, league names using your channel name).

Data Retention

YouTube data retention policy: Data is retained while your YouTube account remains connected to BragRights. Upon disconnection, YouTube identifiers are removed within 7 days. Upon account deletion, all associated YouTube data is permanently deleted within 30 days. You can revoke access through your Google Account settings at myaccount.google.com/permissions.

Google User Data Sharing Disclosure

BragRights does not share, transfer, or disclose Google user data to third parties except as explicitly described in this privacy policy. All use of Google user data adheres to Google's Limited Use Policy and is restricted to providing and improving our platform features.

Cookies and Tracking Technologies

We use the following types of cookies:

Essential Cookies

• BraggingRightsToken: JWT authentication token for secure user sessions and API access (expires when you log out or session ends)
• NEXT_LOCALE: To remember your language preference (persistent until manually changed, not used on Privacy Policy or Terms of Service pages)

Browser Storage (localStorage and sessionStorage)

In addition to cookies, we use browser storage (localStorage and sessionStorage) to enhance your experience. These are stored locally in your browser:

Match Predictions (sessionStorage)

• prediction_[matchId] (e.g., prediction_123): Temporarily stores match predictions you make before logging in, allowing you to save your predictions after authentication. The [matchId] is replaced with the actual match ID number.
• auto_saved_[competitionId]_[seasonId] (e.g., auto_saved_1_2) or auto_saved_global: Tracks whether your predictions have been automatically saved after you log in or sign up. The [competitionId] and [seasonId] are replaced with actual ID numbers, or 'global' is used if no specific competition/season context exists.

Email Verification (localStorage)

• pendingVerification: Stores your email and account information temporarily during the email verification process

Presenter Functionality (sessionStorage)

• presenterConfig: Stores configuration for the presenter window used to display match results
• presenterData: Stores data displayed in the presenter window

YouTube OAuth (localStorage and sessionStorage)

• oauth_state (localStorage): Temporary OAuth state token used during YouTube account connection for security
• youtube_connected (sessionStorage): Flag indicating your YouTube account connection status
• youtube_signup (sessionStorage): Flag used during YouTube signup flow
• youtube_login (sessionStorage): Flag used during YouTube login flow
• post_connect_redirect (sessionStorage): Stores the redirect path after YouTube account connection

Banner Dismissals (localStorage and sessionStorage)

• match_previews_english_banner_dismissed (sessionStorage): Remembers if you've dismissed the English-only content banner
• server-load-dismissed-[level] (e.g., server-load-dismissed-high or server-load-dismissed-critical) (localStorage): Remembers if you've dismissed the server load notification banner. The [level] is replaced with 'high' or 'critical' depending on the server load level.

League Settings (localStorage)

• league-customization-draft-[id] (e.g., league-customization-draft-123) (localStorage): Temporarily stores draft league customization settings while you're editing them. The [id] is replaced with the actual league ID number.

Third-Party Cookies

• Google AdSense: For displaying relevant advertisements which may use cookies to show relevant ads (managed by Google's policies)

Note: When you connect your YouTube account, your authentication credentials are securely stored in encrypted form within our authentication system, not as separate cookies.

Children's Privacy

Our platform is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.

YouTube API Services

This app uses YouTube API Services.

You can revoke access at any time in your Google Account: myaccount.google.com/permissions.

See YouTube Terms of Service and Google Privacy Policy.

Changes to This Policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the ''Last updated'' date at the top of this policy. You are advised to review this privacy policy periodically for any changes.