Privacy Policy
Effective [EFFECTIVE DATE]
We collect only what we need to run Basketball 9CatLab, we never sell your personal information, and you can delete your account and data at any time. This policy explains what we collect, why, who we share it with and your choices. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). [LEGAL NAME] (ABN [ABN]), based in Queensland, Australia, is responsible for your data; contact support@basketball9catlab.com.
1. What we collect and why
- Email address (and name, if you sign in with Google). From you, or from Google when you choose Google sign-in. Used for your account, email confirmation, password-reset emails and service emails. Kept until you delete your account.
- Yahoo access and refresh tokens. From Yahoo, when you connect. Used to read your league data on your behalf. Kept until you disconnect Yahoo or delete your account.
- Yahoo Fantasy league data (teams, rosters, standings, matchups, stats). From the Yahoo Fantasy Sports API. Used to show analysis and recommendations. Deleted within 24 hours and pulled fresh when you refresh.
- Your settings and saved items (chosen league, custom player stats, trade offers you track). From you. Kept until you delete them or your account.
- Technical logs (IP address, browser, requests, errors). Collected automatically by our hosting provider for security and fixing bugs. Kept for [LOG RETENTION, e.g. 30 days].
- Support messages. From you, to answer you. Kept up to 2 years.
You sign in with your email and a password, or with Google. Your password is stored only as a salted hash by our sign-in provider, Supabase; we never see or store it in plain text. We never see your Yahoo or Google password. Our Yahoo access is read-only, so we cannot change your league. We do not knowingly collect data from anyone under 18.
2. Why we are allowed to use it
We collect personal information only when it is reasonably necessary to run the Service. Where the law of the place you live requires a legal basis, we process data to perform our contract with you, for our legitimate interests in running and securing the Service, to meet legal obligations, and with your consent where needed (for example, marketing emails).
3. Who we share it with
Only service providers that help us run Basketball 9CatLab, under contracts that limit their use of your data:
- Vercel: website hosting.
- Supabase (US East region): sign-in, password storage (as salted hashes) and database.
- Resend: sending account emails such as email confirmation and password resets.
- Yahoo: your Yahoo sign-in and league data, under Yahoo's privacy policy.
- Google: optional Google sign-in, under Google's privacy policy.
We may also disclose data if the law requires it, to protect rights and safety, or to a buyer if the business is sold (we would tell you first). We do not sell personal information, we do not use it for targeted advertising, and we do not run ads. We only send marketing emails if you agree, and every one has an unsubscribe link.
4. Your choices and rights
You can view your account details in Settings, disconnect Yahoo at any time, unsubscribe from marketing emails with the link in each email, and ask us to delete your account by emailing support@basketball9catlab.com. Deleting your account erases your data within 30 days. You can ask to access or correct the personal information we hold about you, and depending on where you live you may have further rights, such as getting a copy of your data. Email support@basketball9catlab.com; we reply within 30 days and will not treat you differently for asking. If you are not happy with how we handle a privacy request or complaint, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the privacy regulator where you live.
5. Security
All traffic uses HTTPS. Yahoo refresh tokens are encrypted with AES-256-GCM before they are stored, access to the database is restricted, and we rely on providers with strong security programs. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.
6. Where data is stored
Your data is stored and processed overseas, mainly in the United States, by the providers listed in Section 3 (Supabase in its US East region, Vercel, Resend, Yahoo and Google). We choose providers with strong security and privacy commitments and take reasonable steps so they handle your information consistently with the Australian Privacy Principles.
7. Cookies
Basketball 9CatLab uses only the cookies needed to keep you signed in and to secure sign-in steps. We do not use analytics, advertising or cross-site tracking cookies.
- sb-…-auth-token (Supabase sign-in): keeps you signed in. Strictly necessary. Ends when you sign out or the session lapses.
- ncl_yahoo_state: protects the Yahoo connect step from forgery. Strictly necessary. Expires after 10 minutes.
Strictly necessary cookies cannot be turned off, because the site will not work without them. You can block or delete cookies in your browser settings, but you may be signed out. If we ever add optional cookies, we will ask first where the law requires and update this page.
8. Changes
We will post updates here with a new effective date and email you about material changes.
9. Contact
[LEGAL NAME] (ABN [ABN]), [BUSINESS ADDRESS], Queensland, Australia, support@basketball9catlab.com. See also our Terms of Service.