Privacy Policy
This policy explains what information LIVEStats26 collects, how it is used, and the choices you have. Plain language; no dark patterns.
What we collect
Account information
When you sign in via Apple Sign-In, Google Sign-In, or magic-link email, we receive and store:
- Your Supabase user ID (an opaque UUID)
- Your email address
- The display name and avatar URL you authorize the provider to share
We do not receive your Apple/Google password or any other account credentials. Authentication is handled directly by Apple/Google/Supabase.
Scorecards and gameplay data
When you score a game, we store the contents of your scorecard:
- Inning-by-inning scoring entries (notations like
1B,K,6-4-3 DP) - Predictions you make in the Predict tab (pitch type and zone)
- Follow-along state (whether the scorecard mirrors MLB’s official data)
- Corrections you accept or dismiss
These are stored locally on your device first (offline-first via WatermelonDB) and synced to Supabase when you have connectivity.
Push notification tokens
If you opt in to notifications, we register your device’s push token (provided by Apple/Google) with our server so we can deliver alerts about your predictions, corrections, or favorited teams. You can revoke notification permission in your device settings at any time.
Analytics
We use PostHog to understand which features people use and where the app fails. We capture:
- Screen views (which screens you visit)
- Key actions (e.g., “scorecard created”, “prediction locked”)
- Device metadata (OS version, app version, anonymized device class)
We do not capture: notation contents, batter/pitcher names beyond their public MLB IDs, your location, your contacts, or any data from other apps on your device.
If you sign in, your analytics events are linked to your Supabase user ID. Before sign-in, events are linked to a per-installation anonymous identifier that PostHog generates.
Access request submissions
If you request access via the in-app form, we store the email and optional note you submit so the administrator can review and invite you. Requests are not shared outside the administrator.
How we use this information
- To run the app: render your scorecards, sync between devices, deliver notifications.
- To send invites and admin notifications: we use Resend to email the administrator when access requests come in.
- To improve the app: aggregate analytics tell us which features are working and where to focus.
We do not sell any data, share it with advertisers, or use it for any purpose unrelated to running and improving the app.
Third-party services
LIVEStats26 relies on the following services. Each has its own privacy policy that governs the data they receive:
| Service | What they receive | Privacy policy |
|---|---|---|
| Supabase | account, scorecard, prediction, correction data | supabase.com/privacy |
| Apple | sign-in (if used), App Store metadata, push delivery | apple.com/legal/privacy |
| sign-in (if used) | policies.google.com/privacy | |
| PostHog | analytics events | posthog.com/privacy |
| Resend | admin notification emails (no user-facing email goes through Resend) | resend.com/legal/privacy-policy |
| Expo | over-the-air update metadata, push notification routing | expo.dev/privacy |
| MLB Stats API | gamePks and player IDs (publicly available data, requested anonymously) | mlb.com/…/privacy-policy |
We do not transmit your account information, email address, or notation contents to MLB. The MLB API only sees anonymous, public gamePk and player ID lookups.
Data retention
- Scorecards, predictions, and corrections are retained for the lifetime of your account.
- Access request submissions are retained until the administrator resolves them, then are kept for audit purposes for 12 months and deleted.
- Analytics events are retained per PostHog’s default policy (currently 7 years).
- Push tokens are retained until the device unregisters or you sign out.
Your rights and choices
- See your data: email quentin.chu@gmail.com and we will export your account, scorecards, and predictions.
- Delete your account: open Settings → Delete Account in the app to immediately and permanently delete your account, scorecards, predictions, and all related data. You can also email quentin.chu@gmail.com if you prefer; we will delete your account within 30 days of an emailed request.
- Opt out of analytics: contact us; we will remove your installation’s events from PostHog.
- Disable notifications: revoke notification permission in your device settings.
Children’s policy
LIVEStats26 is not directed to children under 13 and is intended for ages 13 and up. We do not knowingly collect information from children under 13. If you believe a child under 13 has signed up, contact us and we will delete the account.
Security
- All network traffic uses HTTPS.
- Supabase Row Level Security policies ensure each user can only read and write their own scorecards, predictions, and corrections.
- Push tokens are stored in a database row keyed to the user.
- Service-role and webhook secrets are stored in Supabase Vault, not in source control.
Changes to this policy
If we make material changes, we will update the “Last updated” date above and notify users via in-app notification before the changes take effect.
Contact
Questions, deletion requests, or concerns:
quentin.chu@gmail.com