Privacy Policy

The short version

• We collect what it takes to run your account and your leagues, and to keep them secure.
• We don’t sell your personal information. We don’t use it for ads on the web.
• Ads in the iPhone app are personalized only if you allow tracking when iOS asks.
• Nothing is sold in Circled Hoops, so we never see a card number. Sponsored links and Buy Me a Coffee tips are handled on those sites.
• We never hold league money, so we don’t collect bank details for dues.
• You can download and delete your data yourself under Account, and correct it there too. Email [email protected] for anything else.

What we collect and why

Basic server logs (IP address, the page or API route requested, time and response) are kept briefly by our hosting and network providers to run and protect the service.

What we don’t collect

• Payment card or bank account numbers. Nothing is sold in the app.
• Who clicks a sponsored link or leaves a tip. Sponsors and Buy Me a Coffee see that on their own sites.
• Precise location, contacts, photos, or your fingerprint or face.
• Your NBA, social media or sportsbook accounts.
• Analytics trackers on the web.

NBA stats come from a data provider (balldontlie). We fetch stats from it; we don’t send it anything about you.

Legal bases (EU and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide your account, leagues, chat and the emails the service needs to send.
• Legitimate interests: to keep accounts and the service secure, prevent abuse, fix bugs, and keep league records consistent for other members. We balance these against your rights, and you can object (see your rights).
• Consent: for push notifications and for personalized ads on iPhone. You can withdraw it any time in your device settings.
• Legal obligation: to respond to lawful requests.

Who sees it

• Your leagues. Members of a league see your name, team names, rosters, lineups and picks (once games lock), trades, waiver moves, draft activity, chat messages, reactions and, if dues are on, your dues status. The commissioner also sees the commissioner tools and the league’s log.
• Reports and blocks. In league chat you can tap Report message or Block someone. The league’s commissioner sees the message, the reason and note, and how many people reported it, but not who, and can hide the message or dismiss the report. We get the same by email, with who reported it, so we can act on it. The person you reported isn’t told. Blocking hides that person’s messages and reactions from you and stops their @mentions notifying you; they aren’t told. Manage blocks under Account → Blocked people.
• Service providers that run parts of Circled Hoops for us, listed below. They may use your data only to provide their service to us.
• Legal reasons. If the law requires it, or to protect people, our users or Circled Hoops from harm or fraud.
• Business transfers. If Purplelink LLC or Circled Hoops is merged, sold or reorganized, your data may move to the new owner, who must keep this policy’s promises or tell you first.

We don’t sell personal information, and we don’t share it with data brokers.

Service providers

When we add or change a provider that gets personal data, we’ll update this list.

Cookies and local storage

We use what the app needs to work, plus Google’s cookies on the few web pages that show an ad. No analytics cookies.

• Sign-in cookies (names starting with lockin): keep you signed in and protect against cross-site attacks. Scripts on the page can’t read them. Without them you can’t sign in.
• Security cookies from Cloudflare may be set to tell people from bots.
• Local storage on your device remembers your light or dark theme, the last league you opened, and where to return after checkout. It stays on your device; clearing your browser data removes it.
• Advertising cookies from Google, on the home page, How to play, Standings and History only. Google uses them to deliver the ad, limit how often you see it and prevent fraud (see Ads and tracking).

The first three are needed for the service you asked for. For the advertising cookies, visitors in the European Economic Area, the UK and Switzerland see Google’s consent message first and can say no.

Push notifications

We send push notifications only if you allow them when your phone or browser asks. They cover things like lineup and pick reminders, trades and @mentions. You can turn them off any time in your device or browser settings. When you sign out or turn them off, we stop using that device’s token.

Ads and tracking on iPhone

On the web, four pages (the home page, How to play, Standings and History) show one ad from Google AdSense, and a few links are marked Sponsored, which load nothing from the sponsor until you click. The web ads are non-personalized: Google doesn’t choose them from your browsing or a profile of you, though it still uses cookies, device information and your IP address to deliver them, limit how often you see them and prevent fraud. Ad blockers are fine: nothing on the site breaks or asks you to turn one off. The iPhone app shows no web ads; it shows one banner ad on some screens, through Google AdMob. Ad-free subscribers see none of these, and the app doesn’t ask to track them.

• Before any personalized ad, iOS asks whether Circled Hoops may track you across other companies’ apps and websites (App Tracking Transparency). If you say no, ads are not personalized and your advertising identifier isn’t shared.
• If you say yes, Google may use your advertising identifier and app activity to choose ads and measure them. You can change your mind any time in iOS Settings → Privacy & Security → Tracking.
• Even non-personalized ads use some device information and your IP address to deliver ads, limit how often you see them, and prevent fraud.
• We never give advertisers your name, email or league data.

How long we keep it

Your rights and choices

Wherever you live, you can ask us to:

• See the personal data we have about you, and get a copy in a common format (export).
• Correct it. You can change your name and email under Account yourself.
• Delete your account and personal data.
• Object to or restrict some uses, and withdraw consent (for push and personalized ads, in your device settings).

How to ask

Email [email protected] from the address on your account, so we know it’s you. We’ll answer within 30 days (45 days where U.S. state law allows), and we won’t charge you or treat you differently for asking. If you use an authorized agent, we may ask them for proof.

Deleting your account

Go to Account → Delete account, in the app or on the web. You’ll confirm it’s you, and if you run a league you pick who takes it over (the longest-tenured manager is suggested). A league with nobody else in it is deleted. Deletion happens at once, and we email you to confirm. It removes your profile, email, password, sign-ins, two-factor settings, passkeys, push devices, notifications, reactions, blocks and any waitlist entry, and clears your account ID from league logs and dues records. Your teams stay in their leagues, played by a bot, until someone new joins and takes one over, and shared league records (results, trades, drafts, history) stay with the league. Messages you posted stay in league chat as “Former manager”; delete any you want gone first.

If you can’t use the app, email [email protected] from the address on your account and we’ll delete it within 30 days.

Exporting

Account → Download my data gives you a copy of everything tied to your account as a JSON file. Any member can also export league history (JSON for everything, or CSV one table at a time) from History.

U.S. state privacy laws

Several U.S. states, including California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon, give residents specific privacy rights. Some of these laws may not apply to a business our size yet, but we give everyone the same rights anyway. In those laws’ terms:

• Categories we collect: identifiers (name, email, IP address, device IDs), account credentials, activity in our app, approximate location, and the content of your league chat. The sections above give the purposes and providers.
• Sensitive data: account credentials only, used just to sign you in. We don’t use it to infer anything about you.
• We don’t sell personal information and haven’t in the past 12 months.
• Targeted advertising (“sharing”): only in the iPhone app, and only if you allow tracking. You opt out by choosing “Ask App Not to Track” or turning tracking off in iOS Settings. We don’t knowingly do this for anyone under 16.
• Global Privacy Control: we have no tracking on the web, so there’s nothing for a GPC signal to switch off there.
• Appeals: if we turn down a request, reply to our answer to appeal. If you’re still unhappy, you can contact your state attorney general.

Visitors from the EU and UK

• You have the rights listed above, plus the right to data portability and to object to processing based on legitimate interests.
• We store and process data in the United States. When we transfer personal data from the EEA or UK, we rely on our providers’ safeguards, such as the EU-U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
• You can complain to your local data protection authority. We’d appreciate the chance to fix it first.

Children

Circled Hoops is not for anyone under 16, and we don’t knowingly collect data from children under 16. If you believe a child has an account, email [email protected] and we’ll delete it.

Security

Passwords are stored as one-way hashes. Authenticator secrets and backup codes are encrypted. Sign-in cookies are secure and hidden from page scripts, every connection uses HTTPS, the database sits on a private network, and repeated failed sign-ins lock the account for a while. You can add two-factor authentication or a passkey and sign out other devices under Account. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.

Changes

We’ll update this policy as Circled Hoops changes, and change the date at the top. If a change matters, we’ll tell you by email or in the app before it takes effect. See also our Terms of Service.

Contact

Purplelink LLC, Georgia, USA. Email: [email protected].