Privacy Policy

What we collect

• Account details: your email address, display name and a securely hashed sign-in credential (or your Google sign-in identifier, if you use it).
• League content: league, team and game information, rosters, player names, jersey numbers, optional birth year and photos, scores, stats and news that organizers and managers enter.
• Billing: which plan a team has, payment status, amount and country. Card details go straight to our payment partners and never touch our servers.
• Site analytics: page views with the page, the referring website, rough location (country, region, city), device type, browser, operating system and language.

Cookies

We use only the essential cookies needed to keep you signed in and secure. We use no advertising cookies and no tracking cookies, so there is no cookie banner to accept.

What we do not collect or do

• We do not sell or share personal data for advertising.
• Visitor analytics store no IP addresses and no user agents. A visitor is a hash that changes every day, so we cannot follow a person across days. We respect Do Not Track.
• We do not publish contact details for players, and we do not publish a minor’s email, phone or address.

Players and children

Player profiles are private by default. A profile appears on a public league page only when the organizer or manager chooses so, and a league can show initials instead of full names. Adults who add a minor confirm they have the verifiable permission of a parent or guardian, which is needed before a profile is made public or a photo is added. A parent, guardian or player can ask us to hide, correct or delete a profile at mail@bucketstats.com. If a player appears in recorded games, the profile is anonymized so the official box scores keep their numbers.

We do not knowingly create accounts for children, and we do not knowingly collect personal information from a child under 13 without a parent’s or guardian’s permission. If you think we have, tell us and we will delete it.

Why we use your data

• To run the service you asked for: leagues, scoring, standings, public pages and notifications (needed to provide the contract).
• To take payments and keep subscriptions accurate (contract and legal obligations).
• To keep BucketStats secure, prevent abuse and fix problems (our legitimate interest).
• To understand, in aggregate, how the site is used so we can improve it (our legitimate interest).
• Where we rely on your consent, such as a public player profile, you can withdraw it at any time.

Who we share it with

Only the service providers that help us run BucketStats, under their own privacy and security commitments:

• Supabase, for our database, sign-in and file storage.
• Vercel, for hosting.
• Creem and PayMongo, for payments.
• An email provider, for sign-in and invitation emails.

Public league pages are visible to anyone, including search engines. We share information with authorities only when the law requires it.

Where your data goes

We operate from the Philippines, and our providers may store and process data in other countries, including the United States and Europe. When data moves across borders we rely on the safeguards the law provides, such as standard contractual clauses, and we choose providers that commit to protecting it.

How long we keep it

We keep data while your account or league is active. When you delete an account or league, the related data is deleted, except records we must keep (such as payment records) or anonymized game history that keeps a league’s results correct. Analytics events are kept only as long as they are useful and can be cleared.

Your rights

Whatever country you live in, you can ask to see, correct, export or delete your data, restrict or object to how we use it, and withdraw consent, by writing to mail@bucketstats.com. We will answer within 30 days. These match the rights in the Philippine Data Privacy Act, the EU and UK GDPR, and laws such as California’s CCPA, and we honor them for everyone. You may also complain to your data protection authority, such as the National Privacy Commission in the Philippines.

Security and breaches

Access is restricted by role at the database level, connections are encrypted, and administrator actions on sensitive data are logged. No system is perfectly secure, so please use a strong, unique password. If a breach puts your data at risk, we will notify you and the authorities as the law requires.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app. The date at the top shows the latest version. See also our Terms of Service.

Contact

MANCreatives, Philippines. Privacy questions and requests: mail@bucketstats.com.