Privacy Policy

Last updated: September 25, 2026

Super Bowl Squares ("we", "us" or "our") operates the website at https://www.superbowlsquares.org (the "Service"), which lets people set up and run football squares pools online. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. By using the Service you agree to the practices described here.

Who This Policy Covers

Three kinds of people use the Service, and we collect different information from each:

Hosts create an account, buy a grid and run a pool.
Players claim squares on a host's grid, or are entered on a grid by the host.
Visitors browse the public pages, printable grids and other free tools.

Information We Collect

From hosts

Your name, email address and a password, which we store only as a one-way hash.
Billing details for purchases. Card numbers go directly to our payment processor and never touch our servers.
Everything you put on your grids: titles, team names, rules, payouts, payment instructions, welcome text, uploaded images, and the players you enter or edit.
Messages you send us through the contact and feature-request forms.

From players

Your name, email address and, where the host asks for it, your phone number.
The squares you claim, any square icon you choose, and the payment status the host records for you.

This information is provided either by you, when you claim a square, or by the host, when they add or edit you on their grid.

Collected automatically

Usage data such as your IP address, browser type, device type, the pages you visit and when, and the page that referred you.
Cookies and similar technologies, described below.
Email engagement. Some emails we send about a grid contain tracked links, so we can tell when a link in that email was clicked.

How We Use Information

To run your pool: to display the grid, record picks, assign numbers, track scores and record winners.
To send grid emails: pick confirmations, payment updates, winner notifications and messages a host writes to their players are sent on the host's behalf. These emails may include a short note about our Service.
To manage your account: receipts, login links, password resets, renewal reminders and service notices.
To help you: to answer support requests and feature requests.
To draft text for hosts: when a host uses the optional AI drafting feature, the grid's title, teams, cost, settings and whatever instructions the host types are sent to our AI provider to produce a draft. We do not send player names or contact details to the AI provider.
To keep the Service safe: to detect fraud, abuse and security incidents, and to enforce our Terms of Service.
To improve the Service: to understand how the site is used and to measure the effect of changes.
To market to hosts: we occasionally email hosts about site updates and offers, but only hosts who have told us that is welcome. You can change that choice at any time by contacting us.
To comply with the law and to protect our rights.

Information About Players

Most personal information on the Service belongs to players rather than hosts, so it deserves its own section.

Your name is shown on the grid you joined, so everyone who can view that grid can see it. The host controls who can view the grid, including whether it needs a password.
Your email address and phone number are visible to the host and any secondary admins they appoint, but not to other players.
We email you about that grid on the host's behalf. We do not send players separate marketing emails.
The host is your point of contact for entry fees, prizes and anything else about the pool itself. To correct or remove your entry, ask the host or contact us.

Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

Essential cookies keep you signed in, protect forms against forgery and remember which grid you have unlocked. The Service does not work without them.
Preferences such as your light or dark appearance are stored in your own browser.
Analytics is provided by Google Analytics, loaded through Google Tag Manager. It uses cookies to report how visitors use the site. You can opt out with the Google Analytics opt-out browser add-on.
Email link tracking on certain grid emails, as described above.

We do not show third-party advertising and we set no advertising cookies. You can set your browser to refuse cookies or to warn you before a cookie is set, but parts of the Service that depend on essential cookies will stop working. Because we neither sell nor share personal information for advertising, "Do Not Track" and Global Privacy Control browser signals do not change how the Service treats you.

Service Providers

We share information with companies that help us run the Service. They may only use it to provide their service to us:

Amazon Web Services hosts the Service, stores our database and uploaded images, and delivers our email.
Braintree, a PayPal service, processes payments. We never store or see your full card number. Braintree's practices are described in its privacy policy.
Google provides analytics and tag management, as described in the cookies section. Google's practices are described in its privacy policy.
Freshdesk (Freshworks, Inc.) stores support and feature requests you send us. Its practices are described in its privacy policy.
Anthropic provides the AI model behind the optional drafting feature for hosts, receiving only the grid details described above.
Sports data providers supply live scores for automatic winner tracking. They receive no personal information.
Internal monitoring and alerting tools that notify us of errors may occasionally contain an email address from the request that failed.

How Else We Share Information

We do not sell personal information and we have not sold it in the past twelve months. Beyond the service providers above, we share information only:

With other people on your grid, as described in the players section.
For legal reasons, when required by law, subpoena or a valid request from a public authority, or when we believe in good faith it is necessary to protect the rights, property or safety of the Service, our users or the public.
In a business transfer, if the Service is involved in a merger, acquisition or sale of assets. We will post notice before your information becomes subject to a different privacy policy.
With your consent, for any other purpose you agree to.

We also do not "share" personal information for cross-context behavioral advertising as California law defines it, because the Service carries no third-party advertising.

How Long We Keep Information

Host accounts are kept while they are active. You can ask us to close your account at any time.
Grid contents and player entries are kept while the grid is active and for a period after it expires. Renewing a grid resets it for a new season: the previous season's picks are removed from the grid and kept in an archive for about a year, then deleted.
Records of the emails we send are kept for about two years. The audit log of changes to a grid is kept with the grid.
Purchase records are kept as long as tax and accounting rules require.
Usage data is kept for a shorter period unless we need it for security or to meet a legal obligation.

Security

We use commercially reasonable safeguards to protect your information, including encrypted connections, hashed passwords and restricted access to production systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your Choices and Rights

Whoever you are and wherever you live, you can contact us to:

Ask what personal information we hold about you and receive a copy of it.
Correct information that is inaccurate. Hosts can edit their own profile and their players directly.
Delete your information, subject to the exceptions below.
Opt out of marketing email, using the link in any marketing message or by contacting us.

We may keep information we need to complete a transaction you asked for, to detect and prevent fraud or abuse, to fix errors, to comply with a legal obligation, or for internal uses that are reasonably expected given your relationship with us. Because player entries also belong to the host's grid, we may confirm a removal request with the host.

California residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the right to know what personal information we collect, use and share; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising those rights. We do not collect sensitive personal information as defined by that law.

In the past twelve months we have collected the following categories of personal information, as the law defines them: identifiers (name, email address, phone number, IP address, account name); customer records (name, phone number, billing details); commercial information (products purchased); and internet activity (interactions with the Service and its emails). We collect it from you, from the host of a grid you joined, and automatically as you use the Service. We use and disclose it for the business purposes described in this policy, and we do not sell it.

To exercise these rights, contact us by email at the address below. We will verify the request by matching the details you give us against the information we hold, and we will respond within 45 days, which we may extend once by a further 45 days with notice. You may use an authorized agent if the agent can show your written permission. We will not deny goods or services, charge a different price, or provide a different level of service because you exercised a right.

California's "Shine the Light" law lets California residents ask once a year whether we disclosed personal information to third parties for their direct marketing. We do not. California residents under 18 who are registered users may ask us to remove content they posted publicly, though removal may not be complete or possible in every case.

Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

Where Information Is Processed

We are based in California and the Service is hosted in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

Links to Other Websites

The Service links to websites we do not operate, and hosts may add their own links to a grid. We are not responsible for the content or privacy practices of those sites, and we encourage you to read their policies.

Changes to This Policy

We may update this policy from time to time. We will post the new version on this page and update the "Last updated" date above. For a material change we will also notify hosts by email or with a notice on the Service before the change takes effect. Changes are effective when posted.

Contact Us

Questions about this policy, or requests about your information, can be sent to Super Bowl Squares:

By email:
Through our contact page.