Privacy Policy

Touchline ("Touchline," "we," "us") is a football app covering live scores and fixtures, league tables, club and national team profiles, statistics, news, and community engagement, including fantasy football leagues you can create and join. Touchline is operated by Touchline LLC, a Virginia limited liability company. This Privacy Policy explains what personal data we collect when you use Touchline (on our web or mobile apps, or through our official social media accounts), why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to everyone who creates a Touchline account, regardless of where you're located, and it's incorporated into our Terms of Service by reference.

We collect the following categories of personal data:

• Account information: email address, display name, and country, which you provide when you create an account. Country is used to personalize your experience and, where relevant, to determine which regional legal rights apply to you.
• Fantasy activity: the leagues you join or create, your roster and draft history, transactions (trades, waiver claims, free-agent moves), followed leagues, favorited clubs, and any profile photo you upload for your fantasy team.
• Authentication data: session and auth tokens issued by our authentication provider (Supabase Auth) so you can stay signed in securely. We don't receive or store your password in plain text — that's handled entirely by Supabase Auth.
• Usage data: pages viewed, features used, IP address, and general device/browser information, collected via our product analytics provider (PostHog) and standard server logs, to understand how the app is used, fix bugs, keep the service secure, and inform which features we build or prioritize next and how we tune the product experience. If you use our mobile app, this also includes basic device identifiers needed to run the app and any information the app marketplace (Apple App Store / Google Play) requires us to receive.
• League invitations:if you invite someone to a league by email, we process the invitee's email address solely to deliver that invitation — we don't add it to any mailing list or use it for any other purpose unless they go on to create their own account.

We don't collect payment information, precise location, or government-issued identifiers, and Touchline doesn't currently involve any real-money entry fees or payouts.

Depending on the data and the purpose, we rely on one of the following:

• Contract: we need your account and fantasy activity data to provide the service you signed up for (running your leagues, rosters, and drafts).
• Legitimate interests: we use aggregated and per-account usage data to keep Touchline secure, diagnose bugs, understand how features are used, and decide what to build or improve next, in ways that don't override your own privacy interests.
• Consent: where required by your local law (for example, for non-essential cookies), we rely on your consent, which you can withdraw at any time.

• To operate the core product: leagues, rosters, drafts, and trades.
• To show your activity to other members of leagues you belong to (for example, your team name and roster are visible to your leaguemates — that's inherent to a shared fantasy league).
• To keep your account secure and to detect fraud or abuse.
• To understand product usage, prioritize new features, and optimize the product experience, via aggregated and per-account analytics events.
• To respond when you contact us for support.

We do not sell your personal data to anyone, under any circumstances.

We share data only with the service providers that help us run Touchline, each acting on our instructions and bound to protect your data:

• Supabase — hosts our database and handles authentication.
• Vercel — hosts the application and provides infrastructure-level analytics.
• PostHog — product analytics (page views and feature usage). We do not enable session replay or share analytics data with advertisers, and PostHog does not receive your email or display name in event payloads.
• Google AdSense — serves advertising on Touchline. Google and its partners may use cookies and similar technologies to show and measure ads. See how Google uses information from sites that use its services.

Other members of a fantasy league you join can see the fantasy-related information that league membership inherently exposes (team name, roster, trade history within that league). We do not share your email address with other users. We may also disclose information if required by law, or to protect the rights, property, or safety of Touchline, our users, or the public.

Some of our service providers process data on servers located outside your country, including in the United States. Where that applies, we rely on the provider's own safeguards (such as standard contractual clauses) for cross-border transfers.

We use cookies and local storage for three purposes: keeping you signed in (via Supabase Auth), product analytics (via PostHog, to recognize repeat visits and measure feature usage), and advertising (via Google AdSense, which may set third-party cookies to show and measure ads). We don't sell data collected through our own cookies. You can manage Google's ad personalization at Google Ads Settings. You can block or delete cookies through your browser settings, though doing so may prevent you from staying signed in.

The sign-in cookie is essential to the service and always on. Analytics cookies are not — whether they load for you depends on your consent choice. When you sign up, you'll see a standalone, optional checkbox to allow analytics cookies; if you're visiting from the EU, UK, or Switzerland it starts unchecked, and elsewhere it starts checked, reflecting the applicable local rules on non-essential tracking. This choice is never a condition of creating an account or using Touchline, and PostHog will not load until your consent is granted. You can change your choice anytime from your account settings (Profile → Settings → Privacy) — the change applies immediately.

Advertising cookies are a separate choice from analytics cookies. If you're visiting from the EU, UK, or Switzerland, a consent message from Google asks for your choice before Google sets advertising cookies or personalizes ads, and if you decline you may see limited or no ads. That choice is also never a condition of using Touchline, and it is managed by Google rather than through your Touchline account settings.

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymize your personal information as described below, except where we're required to retain it — for example, to comply with a legal obligation, resolve a dispute, or prevent fraud or abuse.

Depending on where you live, you have rights over your personal data.

If you're in the EU, UK, or another jurisdiction with similar data protection law:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data, subject to the league-data carve-out below.
• Object to or restrict certain processing.
• Receive your data in a portable, machine-readable format (data portability).
• Lodge a complaint with your local data protection authority.

If you're a California resident (CCPA/CPRA):

• Know what personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information — we don't sell or share your data, so there's nothing to opt out of, but you can still confirm that with us.
• Not be discriminated against for exercising any of these rights.

We honor Global Privacy Control (GPC) browser signals as a valid request to opt out of the sale or sharing of personal information, consistent with CCPA/CPRA — again, there's nothing to opt out of today since we don't sell or share your data, but we'll recognize the signal going forward if that changes.

If you live in another U.S. state with its own privacy law:

States including Virginia, Colorado, Connecticut, and Utah (among others) give residents similar rights to access, correct, delete, and port their personal data, and to opt out of certain processing. Contact us and we'll honor your request under whichever law applies to you.

Account deletion and data export

• Export: you can request a copy of your personal data (profile, teams, and transaction history) in a portable format.
• Deletion:you can delete your account and associated personal data at any time from account settings (Profile → Settings → Danger Zone) — no need to contact us. If you belong to an active league, some records tied to that league (for example, past trades or roster moves involving other members) will be anonymized rather than deleted outright, so the league's history stays intact for the members who remain in it. If you commission a league, you'll need to transfer ownership (or delete a league with no other members) before you can delete your account.

To request a data export, or for anything else in this section, contact us at admin@touchline-app.com. We'll verify your identity before acting on a request and respond within 30 days.

We use industry-standard measures to protect your data, including encryption in transit and access controls on our database. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but we work to protect your information and to respond quickly if something goes wrong.

Touchline is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we'll delete it.

We'll update this page if our data practices change, and update the "Last updated" date above. If a change is significant, we'll let you know directly (for example, by email).

Questions about this policy or your data? Email admin@touchline-app.com.