Privacy Policy

1. Information we collect

Information you provide

When you create or use an account, we may collect:

• your username and email address;
• a securely hashed representation of the password for a locally created account—we do not store your plaintext password;
• account-security information, including verified-email status, connected login providers, optional authenticator configuration, and recovery-code state;
• profile and interface preferences, including time zone, default model, and football cursor or tap-effect choices;
• saved model names, selected factors, weights, behavior settings, rankings, predictions, evaluations, and related application records; and
• support categories, subjects, messages, and other communications you send to us.

Google and other third-party sign-in

If you choose Google Sign-In, My CFB requests the email and profile scopes. Information returned may include your Google email address, provider account identifier, name, profile image, and other basic profile fields supplied within those scopes. We use it to authenticate you, create or connect your My CFB account, and provide the Service.

My CFB does not request access to Gmail messages, Google Drive, Google Calendar, contacts, or unrelated Google content. The application is configured not to retain Google OAuth access or refresh tokens for ongoing account access. A configured OpenID Connect provider may process comparable identity information if you choose that provider.

Our use of information received from Google is intended to comply with the Google API Services User Data Policy, including applicable Limited Use requirements.

Technical and security information

The application processes an IP address to enforce rate limits on login, signup, password-reset, admin-login, and support submissions. The IP address is included in a SHA-256 digest used for a short-lived rate-limit counter; the raw address is not stored in that counter.

My CFB's structured application access log records the HTTP method, named application route, response status, request duration, and a random request ID. It intentionally avoids raw request URLs, query strings, authentication links, IP addresses, and browser details. Separate security events or application errors may include a non-public account identifier or other limited diagnostic context, but support message contents and authentication secrets are intentionally excluded from error logs.

Cloudflare, the server host, container runtime, operating system, email provider, and other infrastructure used to operate the Service may separately process IP addresses, timestamps, requested host or URL, browser or device metadata, response information, and suspected-abuse signals under their own operational practices.

2. Cookies and browser storage

My CFB uses essential, first-party browser technologies for authentication and application operation:

• a server-side session identified by a secure session cookie;
• cross-site request-forgery protection associated with the session;
• authentication and account-security state used by Django and django-allauth; and
• short-lived session storage containing only a page path, scroll position, and timestamp so same-page navigation can restore your position.

These technologies are used for essential functionality, not behavioral advertising. My CFB does not currently include third-party advertising cookies, cross-site behavioral trackers, or third-party product-analytics scripts. If that changes, we will update this Policy and provide any notice or choice required by applicable law.

3. How we use information

We may use information to:

• create, maintain, verify, secure, and authenticate accounts;
• provide private saved models, rankings, predictions, preferences, and historical results;
• send verification, password-reset, account-security, and other transactional messages;
• deliver and respond to support requests;
• operate, troubleshoot, secure, and improve the reliability and performance of the Service;
• prevent abuse, fraud, unauthorized access, and attacks;
• enforce our Terms of Service; and
• comply with legal obligations and protect legal rights.

We do not use Google account information for advertising or for purposes unrelated to providing and securing My CFB.

4. Models and user-generated application data

My CFB stores the model names, selected factors, weights, modes, bounded behavior settings, revisions, generated rankings and predictions, timestamps, evaluations, and contribution records needed to provide your account features.

Ranking runs, prediction runs, individual predictions, contributions, evaluations, feature snapshots, and retained source observations are designed as immutable or protected historical evidence. This prevents a past prediction from being silently rewritten after a game starts or finishes.

The current Service does not provide a feature for users to publish or share their private models. User-owned model data is restricted to its owner in application queries. Public pages use a separate ownerless My CFB baseline model and public sports data; they do not use a private user's model as public content.

5. How we disclose information

We do not sell or rent personal information, and we do not currently disclose it for cross-context behavioral advertising or targeted advertising.

Authentication providers

If you use Google or another configured identity provider, information is exchanged with that provider as necessary to complete authentication and account connection. Your use of the provider is also governed by its terms and privacy policy.

Email provider

Our configured SMTP provider processes recipient addresses, sender information, message contents, and delivery metadata for verification, password reset, account-security, test, and support emails. A support request sent through the signed-in form includes your account ID, username, email address, selected category, subject, and message so the operator can respond.

Hosting, network, security, and backups

My CFB uses Cloudflare for public network delivery and security. The application and PostgreSQL database run on operator-controlled server infrastructure. Infrastructure, hosting, network, and security providers may process limited technical information as needed to deliver and protect the Service. Database and media backups may be stored on protected local or encrypted off-site backup infrastructure and can contain the application data present when a backup is created.

College football data provider

My CFB's offline server jobs request schedules, teams, scores, statistics, recruiting and roster-related data, team logos, and betting-line information from CollegeFootballData.com (CFBD). Page views read persisted data and do not make a CFBD request from your browser. We do not intentionally send your My CFB account information to CFBD merely because you view a schedule, ranking, matchup, or prediction.

Legal, safety, and business reasons

We may disclose information when reasonably necessary to comply with law or legal process; investigate fraud, abuse, or unlawful activity; protect My CFB, our users, or others; enforce the Terms; or complete a merger, acquisition, financing, reorganization, asset sale, or similar transaction, subject to applicable law.

6. Email communications

We send transactional messages needed to operate accounts, including email verification, password reset, and available account-security notices. Support messages are sent when a signed-in user submits the support form, and an operator may respond using email.

My CFB does not currently send newsletters, promotional campaigns, or weekly marketing summaries. If optional promotional email is introduced, we will provide appropriate controls. Necessary account and security messages may still be sent.

7. Data retention

We retain information for as long as reasonably necessary to maintain accounts, provide the Service, preserve legitimate historical model and prediction evidence, maintain security and operational records, resolve disputes, enforce agreements, and satisfy legal obligations. Different records may have different retention periods.

Short-lived rate-limit counters ordinarily expire with their configured windows. Application and infrastructure logs are retained according to operational configuration. Backups can retain information after it is removed from the primary application until the relevant backup expires or is overwritten; configured off-site backup policies may retain versions for an extended recovery period.

Historical analytical records receive special treatment because My CFB is designed to prove what evidence and model configuration existed before an event. Those records may need to remain intact even when ordinary account data is removed.

8. Account deletion and privacy requests

My CFB does not currently offer self-service account deletion. You may request deletion, access, correction, or other privacy assistance by emailing [email protected]. We may need to verify that you control the account before acting.

The current data model protects historical ranking and prediction evidence from deletion or retroactive alteration. A deletion request therefore may require manual review, and some historical analytical records, security records, legally required information, and backup copies may be retained. Where required and technically appropriate, identifying account information may be disassociated from retained analytical evidence rather than changing the evidence itself.

Depending on where you live, applicable law may provide rights concerning personal information. We will respond to valid requests as required by applicable law.

9. Data security

We use safeguards intended to protect information, including HTTPS, secure password hashing, server-side sessions, access controls, account verification, rate limiting, restricted production access, database separation, and backups. No Internet service or storage system can be guaranteed completely secure.

You are responsible for protecting your credentials and recovery codes. Contact [email protected] if you believe your account has been compromised.

10. Children

My CFB is not directed to children under 13, and the Terms require users to be at least 13. The Service does not collect a birth date or technically verify age during signup. We do not knowingly collect personal information from children under 13.

If we learn that a child under 13 provided personal information in a manner prohibited by law, we will take appropriate steps. A parent or guardian may contact [email protected].

11. Sports betting information

My CFB may display market lines, point spreads, odds-related information, model comparisons, and experimental predictions. My CFB does not operate a sportsbook, accept or place wagers, hold gambling funds, process bets, or collect sportsbook-account information.

The current Service has no sportsbook affiliate links or referral program. If this changes in a way that affects personal information, this Policy will be updated.

12. Third-party websites and services

The Service may link to third-party websites, including identity providers and sports-data sources. We do not control their privacy, security, or content. Review their policies before providing information directly to them.

13. International users

My CFB is operated from the United States. If you access it elsewhere, information may be processed or stored in the United States or other locations where service providers operate, whose laws may differ from those where you live.

14. Changes to this Policy

We may update this Policy as the Service or legal requirements change. We will update the effective date and may provide additional in-service or email notice when appropriate. Continued use after an update constitutes acknowledgment to the extent permitted by law.

15. Contact