Privacy notice

Information we handle

• Account details: email address, display name and password hash.
• Optional profile details: country, favourite team and biography.
• Game activity: squads, transfers, chips, league memberships, picks and scores.
• Essential session records and administrator audit events.
• Short-lived one-way digests for email verification and password recovery links.
• First-party product events such as completing a squad, joining a league or opening a recap.
• Notification preferences, delivery status and read state.
• Beta feature grants and non-sensitive billing-event identifiers/digests; raw billing webhook payloads are not retained.

Authentication throttling uses short-lived pseudonymous fingerprints in application memory. Commissioner Discord webhook credentials are encrypted at rest and are never displayed after saving. Raw passwords are never stored.

Why we use it

We use this information to provide the game, authenticate users, calculate results, prevent abuse, investigate corrections and operate the closed beta. We do not use fantasy decisions for automated decisions with legal or similarly significant effects.

Signed-in managers can disable first-party product analytics from their profile. Backseat also honours browser Do Not Track and a local opt-out before the analytics beacon sends. Opting out deletes events already linked to that account.

Cookies and public information

Backseat currently uses one essential, HTTP-only session cookie. It does not use advertising cookies or third-party advertising analytics. A random first-party browser identifier may be used to understand public-page and activation journeys. Display names, team names, scores and fantasy decisions may appear to league members or on a share page when a commissioner enables public sharing. Public leaderboards are separate and off by default: only managers who explicitly opt in from their profile are included. An opted-in manager's display name, squad name, scores, country/region and favourite-team community may be shown on indexable leaderboard pages. Turning the setting off removes their squads from those tables. Email addresses and session tokens are not displayed publicly.

Sharing and retention

We may use hosting, database and security providers to operate the service; those providers should receive only what is necessary to perform their role. We do not sell personal data. Account and fantasy history are retained while the account is active and as needed for league integrity, security and legal obligations. Sessions expire after 30 days. Operational backups may take additional time to cycle out.

Your choices

You may ask for access, correction or deletion of personal information, or object to certain processing where applicable. Some score and league records may need to remain under a “Deleted manager” label to preserve competition history. Account deletion removes profile details, sessions, communication records and analytics identifiers from the live database. Use the contact page for privacy requests. Backseat is not directed to children under 13.