Privacy Policy
Effective Date: June 22, 2025
Last Updated: June 22, 2025
1. Who We Are
Palo Alto Fantasy Football League (also "PAFFL" or "PAFFL‑OG," and collectively "we," "us," or "our") operates *.paffl.com and paffl.vercel.app (the "Site") and related mobile, email, and SMS services (together, the "Services").
2. Scope — When This Policy Applies
This Policy explains how we collect, use, disclose, and protect your information when you:
- visit or use the Site;
- register for an account or league;
- post or comment on the Site;
- upload photos or documents on the Site;
- complete transactions on the Site;
- engage with the Site's AI systems and content;
- receive SMS, email, or push notifications; or
- otherwise interact with us.
3. Information We Collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, username, postal address, email, phone number, IP address, device ID | From you; cookies & similar tech |
| League Data | Team name, roster moves, scoring settings, league chat posts | From you & league mates |
| Usage Data | Pages viewed, clicks, referral URLs, time‑in‑app | Automatically |
| Payment Data | Card type, last 4 digits, transaction ID (League Dues & management fees) | Payment processor |
| Location Data | Approximate city/state (derived from IP) | Automatically |
| Communications | Email/SMS content, support tickets, survey responses | From you |
| Inferred Insights | Interests or preferences derived from activity | Ours & analytics partners |
We do not knowingly collect personal information from children under 13 (see §11).
4. How We Use Your Information
| Purpose | Lawful Basis* |
|---|---|
| Account creation & league management | Contract |
| SMS/email notifications about drafts, scores, or chat activity | Contract / Consent |
| Marketing newsletters & product updates | Consent |
| Fraud prevention & security monitoring | Legitimate interest |
| Analytics & product improvement | Legitimate interest |
| Compliance with law (e.g., TCPA opt‑out logs) | Legal obligation |
* GDPR terminology; comparable concepts apply under U.S. state privacy laws.
5. SMS and Email Communications
We comply with the Telephone Consumer Protection Act (TCPA) and CAN‑SPAM Act.
- Opt‑In – Supplying your mobile number or email during registration authorizes us to send transactional messages (e.g., draft reminders). You may separately opt‑in to promotional messages.
- Frequency – Typically 5–10 texts per week during the season, but volume varies with league activity.
- Opt‑Out – Text STOP or uncheck the relevant boxes in your account settings to stop further messages.
- Help – Contact the league commissioner if you have questions about this.
- Carrier Notice – Message & data rates may apply; carriers are not liable for delayed or undelivered messages.
6. Cookies & Tracking
We and our analytics/advertising partners use cookies, pixels, and local storage for authentication, preferences, and measurement (e.g., Google Analytics). Assume that anything you do on the internet — and especially on this Site — is publicly visible. Please conduct yourself accordingly.
7. Sharing & Disclosure
We share data with partners and providers to enhance your experience on this Site. Examples include, but are not limited to:
- Service Providers – cloud hosting, SMS gateway, payment processor, analytics tools;
- League Participants – your display name, roster, and chat posts;
- Advertising & Social Media Partners – hashed identifiers for ad measurement and reach;
- Legal or Regulatory Authorities – when required by law;
- Successors – if we merge, sell, or transfer assets, with notice to you.
We do not sell personal information for money, though some sharing for targeted advertising may be considered a "sale" under certain state laws.
8. Data Retention
We retain account data forever and reserve the right to use it however we'd like. SMS opt‑out logs are kept for 4 years in accordance with TCPA requirements.
9. Security
No system is 100% secure; please choose a strong password (> 10 characters, including at least one special character and one number) and change it monthly. Report any suspected security incident to the commissioner immediately.
10. Your Privacy Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your data, and to opt‑out of sale/sharing for advertising purposes. Exercise these rights by emailing the Commissioner.
11. Children's Privacy (COPPA)
We do not knowingly collect or solicit personal information from children under 13. If you believe a child has provided personal data, contact the Commissioner and we will delete it.
12. International Transfers
If you access the Services from outside the United States, you understand and agree that your information may be processed and stored in the U.S., which may have different privacy protections than your home jurisdiction.
13. Changes to This Policy
We will post any changes on this page and update the "Last Updated" date. Please review this section quarterly to stay up to speed.