Privacy Policy

Last Updated: October 10, 2026

Not Playing Games LLC ("we," "us," or "Company") operates DeckLeague. References to "DeckLeague" mean the game and service; legal obligations in our Terms and Privacy Policy apply to Not Playing Games LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use DeckLeague.

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Phone number
• Username
• Display name
• Authentication credentials, handled by Firebase Authentication; we do not store your password in plain text

Game Data

During gameplay, we collect:

• Team names, colors, and icons you create
• Match participation and results
• Player selections and lineup decisions
• Cards used
• Scoring and performance statistics

Match Feed Reactions

Match feeds contain system-generated updates only — there is no user-to-user messaging. We store the reactions you add to feed updates (chosen from a fixed set of icons), associated with your account.

Purchase Data

If you make optional purchases (such as card faces), we collect transaction records including the item purchased, date, and payment confirmation. Payment processing is handled securely by Stripe (web) or the applicable app store. We do not store your credit card number or full payment details.

Support Communications

If you contact support, we collect the name, email address, message, and related account or troubleshooting information you provide so we can respond and resolve the issue.

Technical Information

When you use DeckLeague, we may automatically collect:

• Device type and operating system
• Browser type and version on the web
• IP address for security and abuse prevention
• Crash reports, app performance data, and technical diagnostics
• Product interaction data used to diagnose app failures
• Optional web analytics, only when you enable them
• How you arrived at DeckLeague when you sign up on the web: the name of the referring website or app (never the full page you came from), any campaign tags in the link you clicked, and the page you landed on. We record this once, at signup, only to understand how people find DeckLeague.

When you are signed in, diagnostic reports include your internal DeckLeague account ID so we can investigate account-specific failures. This makes those diagnostics linked to your account. We do not include your email address, phone number, username, or advertising identifier in diagnostic reports.

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide game functionality and features
• Calculate scores and determine winners
• Enable matches and invitations between players
• Send important notifications about your matches
• Improve our service and develop new features
• Understand roughly where DeckLeague players are located, using the area code or country code of your phone number if you have provided one. This produces only aggregate counts by state or country; we do not use it to determine your current location.
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. Third-Party Services

We use the following third-party services:

Firebase (Google)

For authentication, database storage, and hosting. Firebase may collect device information and usage data. View Firebase's privacy policy at: https://firebase.google.com/support/privacy

Firebase Analytics (Optional)

On the web, we offer optional anonymous usage analytics to help us understand which features get used. This is OFF by default and only fires if you explicitly enable it under Account > Anonymous Analytics. When disabled, no Firebase Analytics cookies are set and no usage events are sent. Firebase Analytics does not run in the iOS or Android app. View Firebase's privacy policy at: https://firebase.google.com/support/privacy

Expo Updates

For delivering app updates and checking whether an update is available. Expo may receive technical information such as the app version, update channel, device platform, and update-request data needed to provide this service. View Expo's privacy policy at: https://expo.dev/privacy

Firebase App Check

For helping protect our backend from unauthorized clients and abuse. Firebase App Check may process app and device integrity signals and issue attestation tokens used to validate requests. View Firebase's privacy policy at: https://firebase.google.com/support/privacy

Google reCAPTCHA

For fraud and abuse prevention during phone authentication and, on the web, Firebase App Check. Google reCAPTCHA may collect device, application, and interaction information needed to provide its security checks. View Google's privacy policy at: https://policies.google.com/privacy

Sentry

For crash reporting, performance monitoring, and technical diagnostics. Reports may include device and operating-system information, app version, error context, product interactions related to a failure, and your internal DeckLeague account ID when you are signed in. The account ID makes diagnostic data linked to your account and is used only to operate, secure, and troubleshoot DeckLeague. We configure Sentry not to collect your email address, phone number, username, IP address, authorization headers, or cookies. View Sentry's privacy policy at: https://sentry.io/privacy/

Stripe

For processing card face purchases on the web. Stripe collects payment information directly; we never see or store your full card number. View Stripe's privacy policy at: https://stripe.com/privacy

SendGrid

For sending transactional and notification emails (account, match invites, lineup reminders, weekly results, and support messages). Every notification email includes an unsubscribe link, and you can manage email preferences in your account settings. View SendGrid's privacy policy at: https://www.twilio.com/legal/privacy

Expo Push Notifications

For delivering push notifications in the iOS app (match invites, lineup reminders, nudges from opponents, weekly results, and pal requests). If you allow notifications, we store a device push token linked to your account; it is deleted when you sign out or delete your account. Each notification type can be turned off in your account settings, or all of them in iOS Settings. View Expo's privacy policy at: https://expo.dev/privacy

Twilio

For sending match invitation texts. We do not send lineup reminders or match results by text. Invitation texts are only sent if you opt in, you can reply STOP to any message to unsubscribe, and you can manage text preferences in your account settings. View Twilio's privacy policy at: https://www.twilio.com/legal/privacy

Sports Data Provider

For retrieving NFL player statistics and game data. We do not share your personal information with data providers.

4. Information Sharing

We may share your information:

• With other players in your matches (username, team name, scores)
• With all signed-in players on the global leaderboards, if you rank (username, avatar, team name, and weekly scores)
• With service providers who help us operate DeckLeague
• If required by law or to protect our legal rights
• In connection with a business transfer or acquisition

We do NOT sell or share your personal information with third parties for marketing purposes.

No mobile information will be sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except with service providers acting on our behalf solely to deliver the messages you opted in to receive.

5. SMS / Text Messaging Program

If you opt in to text notifications, we collect and store your mobile phone number, your opt-in status, and the date and time of your consent. We use this information solely to send the messages you opted in to receive: match invitations.

Message frequency varies based on invitations. Message and data rates may apply. Reply STOP to any message to cancel, or HELP for help. You can also manage text notifications in your account settings at any time.

We do not share, sell, rent, or provide your mobile phone number, text messaging originator opt-in data, or messaging consent data to any third parties or affiliates for marketing or promotional purposes. Mobile information is shared only with service providers acting on our behalf solely to deliver the messages you opted in to receive.

6. Cookies and Tracking

On the web, we use essential cookies and local storage to maintain your login session and remember your preferences. Local storage also briefly holds the arrival details described in Section 1 until you finish signing up. The iOS and Android apps use local device storage for the same functional purposes.

We do NOT use advertising or marketing cookies, advertising identifiers, or cross-app tracking, and we do NOT share your data with third-party advertisers.

Optional web usage analytics (Firebase Analytics) are OFF by default. Web users can enable them under Account > Anonymous Analytics and disable them again the same way. We never tie those analytics events to your name, email, or other identifying information.

You can also control cookies through your browser settings.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes. Transaction records (for example, optional card-pack purchases) and support correspondence may be retained in anonymized form for tax, accounting, and fraud-prevention purposes.

8. Your Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and data
• Export your data
• Opt-out of marketing communications
• Object to data processing

To exercise these rights, please contact us or use the account deletion feature in your profile settings (see how to delete your account).

9. Children's Privacy

DeckLeague is not directed at children. If we become aware that we have inadvertently collected personal information from a child, we will promptly delete it.

10. Security

We implement reasonable security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. International Users

Not Playing Games LLC operates DeckLeague in the United States. If you are accessing our service from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from your jurisdiction.

12. GDPR Compliance (EU Users)

If you are located in the European Economic Area, we process your data based on:

• Your consent
• Performance of our contract with you
• Our legitimate business interests
• Compliance with legal obligations

13. CCPA Compliance (California Users)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination

Note: We do NOT sell or share your personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of DeckLeague after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at info@deckleague.com.