Legal
Privacy Policy
The short version
We collect what the product needs to work and nothing else. We do not sell your personal information. We do not share it with advertisers. We have never run an ad network on this property and have no plans to.
You can delete your account yourself on the website (and in the iOS app once it launches), and you can ask for a copy of your data at any time by emailing privacy@nosebleedsportsmedia.com.
What we collect, and why
| Email address and account handle | To create and sign you into your account, and to attach the passes you buy to the right person. Handled by Clerk. Your handle is the name other members see on a leaderboard. |
| Onboarding answers | The teams and leagues you tell us you follow, so the site (and the iOS app, once it launches) opens on the sport you care about. |
| How you found us | If you arrive through a link we tagged, we record the source and campaign on your account, once for your first visit and again for your most recent one. It tells us which post or partner brought you here. It is never used to target you. |
| Purchase and pass status | To know which picks you are entitled to see. We record which product you bought, the email you bought it with, and when access expires. We never see or store your card details. |
| Network Takeover order details | If you buy a Network Takeover, we store your X handle with your order along with the X post you want pushed. We cannot run the takeover without them. They are used for that job and nothing else. |
| Simulator bets, units, XP and rank | The bet tracker is a scoring game played in units, not money. We store your selections, your unit balance, the XP you have earned and your prestige level so your record, your level and the leaderboards work. |
| Friends and groups | If you add a friend or join a group, we store that link so shared leaderboards work. |
| Reports and blocks | If you report a member's handle or a group's name, we store who reported it, the name as it read at the time, the reason and any note you add, so our team can review it within 24 hours. If you block a member, we store the block so they stay off your boards, feeds and groups. |
| Arcade results | Trivia, Higher or Lower and Guess the Player scores, so daily results and rankings persist. |
| Push notification tokens and alert settings | Only if you turn notifications on. We store the device token and what you asked to be told about: a team, a single game, a player. The token identifies a device, not a person, and you can revoke it in your phone settings. |
| Newsletter subscription state | Which of the two newsletters you are subscribed to, and your email address at beehiiv, which sends them. |
| Support messages | If you use the report form or email the support address, we store your message, your email address, and a snapshot of which pass you held, so we can answer you. |
| Discord account link | Only if you choose to link it. We store your Discord user id and username so a paid pass can grant the members role and losing the pass can remove it. Linking also asks Discord for permission to add you to our server. |
| Your agreement to the terms | When you agree to the Terms of Service and this policy, or tick the box agreeing that a pass renews, we record that you agreed, which version, when, where you agreed (this website, or the iOS app once it launches), and a short note of the browser or device you used. At checkout we also record which pass, the price it renews at and the currency, even if you are not signed in, and attach it to your account when you claim the purchase. It is our proof of what you agreed to. |
| Product analytics | Which screens get opened and which features get used, so we know what to build. Identified by an opaque account id only. |
| IP address, briefly | Used to rate-limit anonymous requests so one machine cannot flood a form, and read by our analytics to infer an approximate city. We do not build a profile from it. |
What we deliberately do not collect
Our analytics never receive your email address, your name, or your phone number. Events are attached to an opaque account identifier, which is meaningless outside our own systems. That is a deliberate constraint in the code, not a policy we ask people to remember.
We infer an approximate location (city level) from your IP address for analytics; we never collect precise location. Your device's location is never read, and once the iOS app launches it will ask for no location permission. We do not read your contacts. We do not track you across other companies' apps or websites, and once the iOS app launches it will ship with no advertising SDK of any kind.
We never take payment card details. Checkout is hosted entirely by our payments provider and card data never reaches our servers.
We do not accept file uploads. There is nowhere in the product to send us a photo, a document, or an attachment, and the support inbox drops attachments rather than storing them.
Who we share it with
These are the only companies that handle your data, and each does one job. We do not sell it to any of them and none of them may use it for their own advertising.
| Clerk | Accounts and sign-in. Holds your email address and password. |
| Whop | Checkout, subscriptions and refunds. They handle card data; we do not. |
| Supabase | The database your account, passes, bets, scores and support tickets live in. |
| Vercel | Hosting for the website and the API, and the storage our nightly backup copy lands in. |
| beehiiv | Sends the two newsletters. Receives your email address and an internal account id so we can match a subscriber back to the right member. |
| Resend | Sends one-off account email, such as a newsletter confirmation, holds the older mailing list, and holds the member list we send service notices to. |
| PostHog | Product analytics, on an opaque account id. |
| Expo | Push notification delivery and app updates. |
| Google Workspace | Hosts our support and billing mailboxes, so it holds anything you email us. A service account reads unread mail in the support inbox and opens a ticket from it. |
| Linear | Where we track work. A support ticket becomes a card there, and the card carries your email address and what you wrote. If you delete your account, those are removed from the card within 30 days. |
| Discord | Only if you choose to link it. Linking is optional and never required to buy or use a pass. |
Sports data comes from public and commercial providers, including BallDontLie, ESPN, Sportskeeda, nflverse, Sleeper and Open-Meteo. Those requests go out from our servers and carry no information about you.
We will also hand over data when the law requires it, and we would pass it to a buyer if the business were ever sold. Nothing else.
How long we keep it
We keep your account data for as long as your account is open. After that, these are the periods the system actually runs on, not aspirations:
| Your account at Clerk | Deleted the same day you delete your account. That is the sign-in itself, so the account is closed from that moment. |
| Your profile, after you delete your account | Removed within 30 days. That covers your handle, your onboarding answers, your starred teams and leagues, and how you found us. |
| Alerts and push registrations | Removed within 30 days of account deletion. A device we have not reached in 90 days is dropped on its own, and a token the provider rejects is dropped immediately. |
| Support messages | Your email address and the text of your message are erased from our support system 12 months after the ticket closes. If you delete your account, they are erased from our support system and our task tracker within 30 days, if that comes sooner. Copies in our team email inbox are deleted on request. The empty ticket record stays so we can still count how much support we do. |
| Discord link | Removed within 30 days of account deletion, with your profile. |
| Newsletter subscription | Unsubscribed and removed from beehiiv when you delete your account. |
| Purchase records | Kept for 7 years. Tax and accounting law requires a record of who paid us and for what, and deleting an account does not remove it. |
| Your agreement to the terms | Kept with the purchase records, for the same 7 years. It is the record of what you agreed to, and deleting an account does not remove it. |
| Network Takeover X handle | Kept with the purchase record, for the same 7 years. |
| Backups | We copy the database to a second vendor every night so one lost account cannot end the business. Your data is deleted within 30 days; backup copies roll off within 30 more. |
Game history. Your simulated bets, arcade results, friendships and group memberships are deleted within 30 days too, except where a past day's published record needs the result, and then it is kept with nothing that links it to you.
Reports and blocks. Blocks you placed, and blocks other members placed on you, are deleted within 30 days. A report you filed, or one about you, is kept as a moderation record with your account id removed from it; a note you wrote on a report is deleted.
Your choices
Newsletters. Buying the Premium Pass turns both newsletters on. Both switches live on your profile page (and, once the iOS app launches, in its settings), you can turn either one off whenever you like, and every issue carries an unsubscribe link that takes effect straight away. Turning a newsletter off changes nothing about your pass.
Notifications. Alerts are off until you turn them on. You choose what you hear about, and you can switch the whole thing off in your phone's settings.
Analytics. Choose “Decline analytics” in the cookie banner and we do not start the analytics library at all. The Cookie Policy lists every cookie the site sets.
Discord. Linking is optional and you can unlink at any time. You keep your free community access either way.
Getting a copy of your data, or deleting it
Wherever you live, you can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. We extend these rights to everyone rather than checking your address first.
You can delete your account yourself. On the website, open your account page and use Delete account; in the app, use More > Settings > Delete account. Either way you confirm once, your account closes the same day, and pass access ends immediately. If you cannot sign in, email privacy@nosebleedsportsmedia.com from the address on your account instead.
Deleting your account removes your profile, your onboarding answers, your starred teams and leagues, your alert settings and your push registrations within 30 days, along with your game history and the text of your support messages. Read the retention table above for what stays: the purchase records tax law makes us keep, the record of what you agreed to (kept with those purchase records for 7 years), and a result a past day's published record needs, kept with nothing that links it to you.
For a copy of your data, or for anything you would rather we did by hand, email privacy@nosebleedsportsmedia.com from the address on your account. We answer within 30 days. We will never charge you for a request or make you give a reason.
Children
Nosebleed Sports is built for adults. You must be at least 18 to create an account or use the product, and at least 21 to use Premium (paid) features, including picks, Premium Discord and newsletters. We do not direct any part of it at children.
We do not knowingly collect personal information from anyone under 13, which is the line the Children's Online Privacy Protection Act draws. If we learn that we hold data from a child under 13, we delete it and close the account. If you are a parent or guardian and think we have your child's information, email privacy@nosebleedsportsmedia.com and we will remove it.
California, and other state privacy rights
California, Colorado, Connecticut, Virginia, Utah, Texas and a growing list of other states give residents privacy rights by law. The rights differ a little state to state, and they generally include the right to know what we hold, to get a copy of it, to correct it, to have it deleted, and not to be treated worse for asking.
We do not sell or share your personal information, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We run no ad network, we pass nothing to data brokers, and we do no cross-context behavioural advertising. There is no sale to opt out of. The Do Not Sell or Share statement says the same thing, and the site footer links it from every page.
We do not use your data to make an automated decision that has a legal effect on you, and we collect none of the categories the law calls sensitive: no government identifiers, no precise location, no health data, no biometrics, no racial or religious information.
To use any of these rights, email privacy@nosebleedsportsmedia.com from the address on your account, which is how we confirm a request is really yours. We answer within 30 days, and we will tell you if we need longer. An authorised agent may file for you; we will ask for written proof that you asked them to.
If you are in the EU or the UK
You have the same rights listed above, plus the right to take a portable copy of your data elsewhere and the right to object to how we use it. Our lawful basis is the contract between us for anything the product needs to work, your consent for analytics and the newsletters, and our legitimate interest in keeping the service up and free of abuse.
Our systems and our providers are in the United States, so using Nosebleed Sports means your data is handled there. You can complain to your national data protection authority if you think we have got this wrong; we would rather you emailed us first.
How we protect it
Sign-in, card handling and the database all run on providers that specialise in them, and our own servers never see a card number or a password. The specific things we do, rather than the usual adjectives:
- The public key cannot read your data. Our app and our website carry a public key, the way every app does. Every table that holds personal information is locked at the database itself, with no rule that lets that key in, so it is refused rather than filtered. We check this automatically on every change, and we tested it directly against the live database.
- Only our servers read it, with a private key. That key lives on the server and nowhere else. It is not in the app, it is not in the website, and it is not in anything we publish.
- It is encrypted on the way to us and while it sits there. Our hosting providers, Supabase and Vercel, encrypt traffic in transit and data at rest.
- Almost nobody can get to it. Access to the live database is limited to the founders.
- We keep a backup, and we do not keep it forever. The database is copied to a second provider every night, and those copies are deleted after 30 days.
No system is perfect, and we will not pretend otherwise. If you find a hole, tell us at security@nosebleedsportsmedia.com.
Changes to this policy
When this policy changes, we post the new version on this page and put a new effective date at the top. If the change is material, meaning it affects what we collect or who handles it, we will also show a notice in the app once the iOS app launches, so you see it without going looking.
Carrying on using Nosebleed Sports after the effective date means you accept the new version. If you do not, you can delete your account, and the section above tells you how.
Contact
Nosebleed Sports LLC
105 Broadway, Rockville Centre, NY 11570
Privacy and data requests: privacy@nosebleedsportsmedia.com
Security reports and vulnerability disclosure: security@nosebleedsportsmedia.com