Privacy Policy

The short version

• We collect only what your pool needs to work: your email, your display name, and what you create while playing.
• We do not sell anything, we do not rent anything, and we do not run targeted advertising. Ever.
• We use no advertising cookies and no third-party trackers.
• You can delete your account yourself, from inside the app, without writing to us and without giving a reason.
• Our infrastructure providers are located outside Quebec; every one of them is named below.

Who is responsible for your information

Podium is operated from Quebec, Canada. The person responsible for the protection of personal information is the operator of the service, reachable at the address below. Send any access, correction or deletion request there.

For any privacy matter: podium.confidentialite@gmail.com. We reply within 30 days at the latest, as the law requires.

What we collect

What you give us

Your email address, your display name and, if you sign in with Google, the profile picture attached to that account. If you create an account with a password, it is encrypted by our authentication provider: we never see it and we cannot recover it.

What playing creates

Your leagues, teams, rosters, lineups, trades, draft picks and standings, along with the posts, reactions, polls and predictions you publish on your pool’s social wall.

What is measured automatically

On the public home page only: the page viewed, the site you arrived from, the language, and a temporary visit identifier. That identifier lives in memory for the life of the tab and is never written to your device — so two visits from the same browser cannot be linked together. This measurement is stored in our own database, not with a third party.

Technical logs

For security and troubleshooting, our hosting providers keep connection logs that may contain your IP address. We do not use them to profile you.

Why we need it

We use your information for the following purposes, and for no other:

• Authenticating you and keeping your session open.
• Running your pool: computing scores, standings, lineups and transactions.
• Sending you service emails: a league invitation, a password reset, a warning before a lineup lock or a deadline.
• Showing the other members of your pool what a pool has to show: your team name, your display name, your roster, your transactions and your posts.
• Understanding whether the home page is clear, from measurements that do not identify you.
• Protecting the service: detecting abuse, acting on a report from the social wall, and complying with the law.

We make no automated decision producing legal effects for you, and we do no advertising profiling.

Who else can access it

We neither sell nor rent your information. We rely on providers that process it on our behalf, solely for the purposes above. Here they all are, and what each one receives:

Supabase

Database, authentication and server functions. This is where your account and your pool data live.

Vercel

Website hosting. Receives requests from your browser and the related technical logs.

Resend

Delivery of the service’s emails. Receives your email address and the content of the message sent.

Google

If — and only if — you choose “Continue with Google”: Google sends us your email address, your name and your profile picture. We receive nothing else from your Google account.

Google (Gemini) and Anthropic

If your commissioner turns on the AI-written coverage module, the content needed to write it — team names, results, and public posts from your league’s wall — is sent to these services to produce the text. The module is off by default.

Giphy

If you search for an animated image for a wall post, your search term is sent to Giphy. Your identity is not.

Sports data providers

We read statistics and schedules from the NHL, ESPN and an odds provider. That exchange goes one way only: we receive sports data, we send them nothing about you.

We may also have to disclose information where the law requires it, for example under a court order. If the service were ever transferred to someone else, you would be told before your information changed hands.

Your information leaves Quebec

This needs to be said plainly: the providers named above operate their infrastructure outside Quebec, primarily in the United States. Your information is therefore stored and processed there, and may be subject to the laws of those countries.

We choose established providers that contractually undertake to protect the information they process on our behalf and not to use it for their own purposes. By using the service, you accept this communication outside Quebec.

What other members of your pool can see

A pool is a group activity: part of what you do is visible to the other members of your leagues, and that is the point. Specifically, they see your display name, your team name and logo, your roster, your lineups, your trades, your draft picks, your standing, and your posts, reactions and predictions on the league wall.

Your email address is NOT shown to other members. Only your league commissioner sees it, because they are the one who invited you. Members of other leagues see nothing of yours: each league is isolated at the database level itself, not merely on screen.

How long we keep it

• Your account and your pool data: for as long as your account exists.
• A league’s history (standings, trades, past seasons): for as long as the league exists, because it is the group’s shared memory.
• Home page measurements: they do not identify you and are kept in aggregate form.
• Our providers’ technical logs: according to their own retention periods, generally a few weeks.
• After your account is deleted: see the next section.

Your rights

Quebec’s Law 25 and Canada’s Personal Information Protection and Electronic Documents Act give you the following rights, which you may exercise free of charge:

• Access — obtain a copy of the information we hold about you.
• Correction — have inaccurate or incomplete information corrected.
• Deletion — have your account and your information erased (see below).
• Portability — receive your information in a structured, commonly used technological format.
• Withdrawal of consent — stop using the service and close your account, at any time.
• Complaint — contact Quebec’s Commission d’accès à l’information if our answer does not satisfy you.

To exercise any of these rights, write to podium.confidentialite@gmail.com. We may have to verify your identity before answering, so that we do not hand your information to someone else.

Deleting your account and your data

You do not have to write to us or justify yourself: deletion is in the app. Sign in, open the “My account” page, then the “Delete my account” section. You will have to confirm by typing an exact phrase, so that an unlucky click erases nothing.

The direct shortcut: the My account page (you need to be signed in).

What deletion erases: your authentication account, your profile, your personal settings, your reactions, your votes and your predictions. What it cannot erase on its own: a league of which you are the acting commissioner. Deleting that account would remove the league from every other member — so the platform refuses the deletion until you have handed the league to someone else or deleted the league yourself.

Deletion is immediate and irreversible in our active systems. Backup copies may persist for up to 30 days at our host before being overwritten in turn.

Cookies and local storage

We use no advertising cookies, no tracking pixels and no trackers belonging to another company. You will therefore not see a cookie consent banner on this site: there is nothing to consent to.

We use your browser’s storage for two strictly necessary things only: keeping your session open after you sign in, and remembering display preferences such as your language or the tab you had open. That information stays on your device.

How we protect it

• All traffic is encrypted in transit (HTTPS), and data is encrypted at rest by our host.
• Passwords are never stored in clear text; we never see them.
• Isolation between leagues is enforced by the database itself, row by row, not by the interface. A display bug therefore cannot expose another league’s data.
• Administrative access is limited to the operator of the service.

No system is infallible. In the event of a confidentiality incident presenting a risk of serious injury, we would inform you and notify the Commission d’accès à l’information, as the law requires.

Children under 14

The service is not intended for children under 14. In Quebec, the consent of a person having parental authority is required below that age. If you find that an account was created by a child without that consent, write to us and we will delete it.

If this policy changes

We will update the date shown at the top of this page. If a change is significant — a new purpose, or a new recipient of your information — we will tell you in the app or by email before it takes effect.

Contact us

A question, a request, a doubt: podium.confidentialite@gmail.com. A real person reads that inbox.

If our answer does not satisfy you, you may file a complaint with Quebec’s Commission d’accès à l’information, at cai.gouv.qc.ca.