What we keep, and what we do not

Who runs Bird's Eye

Bird's Eye is run by Noa Berger, a private individual in France, who is the data controller for the personal data described on this page. Contact: nb@noaberger.com, or the support page. The full legal notice is on the legal page.

What we store

• League data. The display names the host enters, draft picks, trades, squads, rules and who agreed to them, chat messages and reactions, and the standings derived from results. Stored on the server that runs the app, keyed by the league's six-character code.
• Cookies, all functional. A league cookie (bc-league) that remembers which league this browser is in; a signed member cookie (bc-member) set when you open your personal link, which proves which seat is yours; a signed person cookie (be-person) that joins your seats across leagues so one record can follow you; and, for hosts, a host cookie (bc-host). They are strictly necessary for the app to work, so there is no consent banner, and none of them is read by anyone else.
• Your person. A record of the calls you made and how they settled, the teams you starred, the colour you chose, the paper bankroll and its wagers, every table round (the cards or dice drawn and the result), the fairness seeds that prove those draws, and any assistant tokens you minted (stored hashed). All of it hangs off the person cookie and is deleted together.
• Email, if you give one. For reminders, the address sits with your seat in that league. For saving your record, the address sits with your person and is verified by a one-time link. It is used for those two things only: reminder emails you turned on, and sign-in links you asked for. Every email carries a one-click unsubscribe.
• Push notifications, if you switch them on. The browser gives us a push address for your device. Notifications are delivered through your browser maker's push service (Google, Apple or Mozilla).
• Support messages. If you write to us through the support form, we keep the message, and the email address if you gave one, so we can reply.
• On your device. Your chosen display name is kept in your browser's local storage so the app knows who you are on that phone. It never leaves the device.
• No passwords, no profiles. There is no sign-up form, no password, no phone number and no profile to fill in.
• No trackers. No Google Analytics, no advertising pixels, no fingerprinting, no third-party analytics of any kind. Our own server counts a few steps (a league made, an invite opened, a seat taken, picks saved, a result copied). These counts are pseudonymous, not anonymous: the league and the person are replaced by a keyed one-way hash, which is the same every time for the same person, so their steps can be linked to each other, but the count holds no name, cookie, IP address or device details. They are deleted after 13 months, and at once when you delete your data.

How we use it

• To run your league. Show the draft, the table, rivalries, trades, rules and chat to the people you invited.
• To tell members apart. The signed member cookie is what lets the app trust that a pick or a trade came from the right person.
• To keep your record and bankroll. Settled picks, wagers and table rounds are kept so your record, your paper book and the fairness proofs stay complete. They are yours to delete.
• To keep the site healthy. The pulse that updates results writes a short run log (timings and error counts, no personal data) and can email the operator when something breaks. Rate limits keep a short record of request counts to stop abuse.

Why we can use it

Running your league, your record, your book and the reminders you switch on is the service you asked for (contract, art. 6(1)(b) GDPR). The run log, rate limits and security checks are in our legitimate interest in keeping the site working and free of abuse (art. 6(1)(f)). Tip records are kept in our legitimate interest in knowing who to thank and in keeping simple accounts.

How long we keep it

• League data until the host deletes the league, or until 24 months have passed with no activity in the league and none of its members seen on Bird's Eye, whichever is sooner.
• Your person, record, book, table rounds and games until you delete them, or 24 months after you were last seen. Live tables that nobody has played at for 24 months are deleted too.
• The history of each pick you change (kept so a disputed result can be checked) for 12 months; your current picks and record stay with the league.
• Sign-in links expire after 30 minutes and are deleted after 30 days.
• Support messages for 12 months.
• Tip records for 12 months.
• Server run logs for 30 days; rate-limit counts for two days.

Who can see your league and your record

Anyone with your six-character code can join the league and see its data, including chat. Treat the code like an invite and share it only with people you trust. Personal links are better: each one opens a single seat. If you share your record, anyone with the link can see your display name and record. Nothing else.

Tips

Tips are a thank-you and unlock nothing. When you tip on Ko-fi, Ko-fi sends us your Ko-fi display name, your email address, the amount, the currency, a transaction id and your message. We keep the display name, the amount, the currency, the transaction id and the message. We do not keep your email address. Ko-fi is a separate controller for your payment, and its own privacy policy applies; Bird's Eye never sees card numbers or payment details. The tip page links out to Ko-fi and loads no Ko-fi code. The paper book and the tables involve no payment of any kind; see the play money page.

Where the sport comes from

Fixtures, results and prices are pulled on a schedule from public sports data feeds. The server only reads from them; nothing about you is sent with those requests.

Club crests and fighter photographs are loaded directly from ESPN's image servers, so your browser sends your IP address and the page address to ESPN (The Walt Disney Company) when it shows them, as it would for any image on the web.

Who processes it, and where

The app runs on Vercel (hosting) with its database on Neon, and email is sent through Resend. They may keep standard request and connection logs for a limited period, and they act on our instructions and for nothing else. All three process data in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in each provider's data processing agreement. Push notifications go through your browser maker's push service, and Ko-fi handles tips as a separate controller.

Your rights and deleting your data

You can delete everything about you yourself, from the profile page: record, bankroll, wagers, table rounds, favourites, tokens and email, in one step, immediately. The host can delete a whole league from Settings, which removes its picks, chat, trades and history. League seats keep the display name the host entered until the league is deleted.

You can access, correct, delete, restrict, object to and take a copy of your data. Write to nb@noaberger.com or use the support page; we answer within a month, usually much sooner. You can also complain to the CNIL (cnil.fr), the ICO (ico.org.uk, if you are in the UK) or your own supervisory authority.

Age and children

You must be 13 or over to use Bird's Eye. The paper book and the tables are for adults only, behind a declaration that you are 18 or over. If you are under 18, check with a parent before you add an email address. We do not knowingly collect data from children under 13; if we learn that we have, we delete it. A parent can delete a child's person from the profile page or by writing to us.

Changes

This page will change as the app does. For a material change we will show a notice in the app before it applies, and the date at the top changes.