PuckPool
Theme
Sign InCreate Account

Privacy Policy

Last updated

What changed: Rewritten for Canada’s privacy law (PIPEDA): purposes and consent, your access and correction rights, how long we keep each kind of data, where it is stored (in Canada; only email delivery happens in the United States), and breach notification.

The short version

PuckPool collects only what it needs to run your hockey pools: your email address, your display name, and what you do in your pools. We do not sell your data, show ads, or use tracking cookies. You can see and correct your information, and delete your account, at any time.

Who is responsible for your information

Christian Bosse runs PuckPool from Canada and is responsible for the personal information it collects. We follow Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Privacy questions and requests go to the person accountable for privacy at hello@puckpool.ca.

What we collect

  • Account details: your email address, your display name, your password (stored only as a secure one-way hash, never in plain text), and the date you agreed to these terms and confirmed you are 16 or older.
  • Pool activity: the pools you create or join, your role, your entries, picks and draft selections, scores and standings, and a record of commissioner actions (for example role changes or score corrections).
  • Pool chat: the messages you post in your pools’ chats, your reactions, which messages you have read, members you have muted, and any reports you file.
  • Notifications: the in-app notifications we send you and your notification settings.
  • Sign-in and security data: for each signed-in device, a session record with its IP address and browser type, and a log of changes to your account (display name, password, email address, signing out other devices).
  • Email delivery records: which emails were sent to you and whether they were delivered, bounced, or marked as spam.
  • Invitations: if a pool member invites you by email, we use your address to send that invitation and keep its delivery record.

We don’t collect payment details, your location, your contacts, or anything from your device beyond what your browser sends with each request.

Why we use it

  • To create and run your account and your pools, and to calculate scores and standings.
  • To show your pool activity and chat messages to the other members of your pools.
  • To send account emails (email verification, password reset, email change) and pool emails (invitations, draft and pool updates) according to your notification settings.
  • To keep PuckPool secure, prevent abuse, handle chat reports, and fix problems.
  • To keep a record that you agreed to our Terms and this policy.

We use your information only for these purposes. We do not send marketing emails, use your data for advertising, or sell it.

When you create an account, you agree to us using your information for the purposes above. If we ever want to use it for a new purpose, we will ask you first. You can withdraw your consent at any time: turn off optional emails in your notification settings, or delete your account to stop everything else. Because PuckPool can’t run a pool without your account details and pool activity, withdrawing consent for those means closing your account.

Who can see it

  • Other members of your pools see your display name, your entries, your picks, your chat messages, and the standings. Commissioners of a pool also see its membership and history, and the chat reports members file. Your email address is not shown to other members.
  • Service providers who run parts of PuckPool for us, under contracts that only let them use your information to provide their service:
    • OVHcloud (servers in Canada), which hosts our servers and database and so stores everything described here;
    • Resend, our email delivery provider, which receives your email address and the content of each email we send you, and processes them in the United States.
  • Sports data: game schedules and statistics come from BALLDONTLIE, a sports data provider. Only public hockey data flows from them to us; we never send them any information about you. Player photos are loaded by your browser directly from the NHL’s public image servers, which, like any website, see your IP address and browser type but receive no account information from us.
  • When the law requires it: we may disclose information if we are legally required to, for example by a court order.

We do not sell or rent your personal information to anyone.

Where your information is stored

PuckPool is run from Canada, and your information is stored in Canada: our servers and database are hosted by OVHcloud (servers in Canada).

The one exception is email. To deliver the emails we send you, Resend processes your email address and the content of those emails (for example a verification link, a password reset link, or a pool invitation) in the United States. While it is there, it is protected by our agreement with Resend but is also subject to United States law, which may allow courts and authorities there to access it.

Pool chat

Messages you post in a pool chat are visible to that pool’s current members and stored with your name, the time, and any edits (we keep only the latest version). Removed messages are hidden and their text is deleted; if a member reports a message, a copy of the reported text is kept for the pool’s commissioners to review. We store which messages you have read, your reactions, and members you have muted so the chat works across devices. Chat content is not used for advertising.

Cookies

PuckPool uses a sign-in cookie to keep you signed in, which the app needs to work, and a small preference cookie (also saved in your browser’s local storage) that remembers whether you chose the light or dark theme. We do not use advertising, analytics, or tracking cookies.

How long we keep it

  • Your account: for as long as you have it.
  • Deleted accounts: your email address, name, password, and sessions are removed or anonymized the moment you delete your account. Copies in backups and server logs are gone within 30 days.
  • Pool history (entries, picks, standings, and the commissioner action log): for as long as the pool exists, so every member’s standings stay correct.
  • Chat messages: for as long as the pool exists. Messages from a deleted account stay but show as a deleted user.
  • Chat reports: 1 year after they are filed, then deleted automatically.
  • Sign-in sessions (device, IP address, browser): until you sign out, or deleted automatically once they expire, about a week after you last used PuckPool on that device.
  • Account security log: 90 days, then deleted automatically.
  • Notifications and email delivery records: while your account exists. When you delete your account, notifications are deleted and email records no longer show your address.
  • Invitations to people without an account: the email address and delivery record are deleted automatically 90 days after the invitation was sent.

Deleting your account

You can change your display name and email address, or delete your account, from My Account. When you delete your account:

  • Your email address, display name, password, sessions, notifications, and settings are removed, and you are signed out everywhere.
  • You leave every pool. Your entries, picks, and past results stay so that the standings of the other members remain correct; they are shown as “Former member” and are no longer linked to your email address.
  • Your past chat messages stay in the pools you were part of but are no longer linked to you and show as a deleted user; your chat read state and mutes are deleted.
  • Any pending emails to you are cancelled.

If you own a pool that is still active, archive it before deleting your account.

Security and breaches

Passwords are hashed, sessions are stored on our servers and protected with secure, HTTP-only cookies, the site is served over HTTPS, and account email links expire. Only the people who run PuckPool can access its systems. No system is perfectly secure, so please use a strong, unique password.

If a breach of security involving your information creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada as soon as possible, and we keep a record of every breach.

Your rights

  • Access: you can see your profile in My Account, and you can ask us for a copy of the personal information we hold about you.
  • Correction: you can fix your display name and email address yourself in My Account, or ask us to correct anything else that is wrong.
  • Withdrawing consent: change your notification settings or delete your account at any time.

Send requests to hello@puckpool.ca. We answer within 30 days and don’t charge for it. If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Children

PuckPool is for people 16 and older and is not directed at children under 16. We don’t knowingly collect their information; if we learn that an account belongs to someone under 16, we close it and delete its personal information.

Changes to this policy

When this policy changes, we update the date and the “What changed” note at the top of this page, and for important changes we tell you ahead of time, for example by email. See also the Terms of Service.

Contact

Questions about your privacy: Christian Bosse, hello@puckpool.ca.