Privacy policy

Pool Picks (poolpicks.ca) hosts NHL survivor pools. In this policy, “we” and “us” mean Pool Picks. We are responsible for the personal information described here and handle it in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Questions about this policy or about your information go through our contact page.

Your account

• Your name and email address.
• Your password, stored only as a one-way bcrypt hash. We cannot read it, and nobody at Pool Picks can tell you what it is.
• A profile photo, if you choose to add one.
• Whether your email address is verified, and the short-lived links we send to verify it or to reset your password.

Your pools

• The pools you create or join, and how many entries you hold in each.
• Your picks, week by week, and which entries have been eliminated.
• Whether you have paid, as recorded by your commissioner. Pool Picks never processes payments: entry fees and prizes are handled between members and their commissioner, outside the app.
• Whether you are a commissioner of a pool.
• A log of every pick a commissioner edits: who made the change, whose pick it was, and what changed.

Emails we send you

We send the emails the service needs: email verification, password resets, deadline reminders, the weekly recap, the tie notice if a pool ends in a tie, messages your commissioner writes to the pool, and the occasional message about the service itself. We keep a record of which of these was sent to whom, so nobody is emailed twice.

Pick reminders on your phone

If you turn on pick reminders, your browser gives us a push subscription for that device: an address at your browser maker's push service and the keys needed to encrypt messages to it. We store it with your browser's name and version and the date it was last used. Reminders are encrypted before they leave us and can only be read on your device. Turning reminders off deletes the subscription.

Messages you send us

When you use the contact form, we receive your name, email address, the topic and your message. When you send feedback from inside the app, we receive your message, the page you were on, your name, email address and account id, the names of your pools and your browser's name and version. Both arrive as an email to our support inbox, so we can reply; neither is stored in our database.

Security and error records

• Sign-in attempts are rate limited. After repeated failed attempts, that email address and IP address are locked out for 15 minutes, which means keeping a short-lived record of the failures.
• Request limits count requests by IP address, at Cloudflare's network edge.
• If a page crashes in your browser, a short report goes to our server log: the error, the page address and your browser's name and version.

• To run your pools: grade picks, keep the standings and work out the prize pool.
• To send the emails and reminders described above.
• To keep accounts secure and stop abuse.
• To find and fix problems.
• To answer you when you write to us.

We do not sell your information, rent it, or use it for advertising. We use it only for the purposes above, or where the law requires it.

• Members of your pool see your name, how many entries you hold, which are still alive, and your picks once the week has locked.
• Your commissioners also see your email address, whether you have paid, and your picks before the deadline, so they can run the pool and fix a pick that went wrong.
• Pool Picks site administrators can see what a commissioner sees in every pool, to support the service.

Nobody outside your pools sees your pool information.

We use a small number of service providers. They handle your information on our behalf and only to provide their service to us.

• Cloudflare hosts the site and the database, sends our email, and counts requests to enforce rate limits.
• Brevo delivers email when Cloudflare cannot.
• Your browser's push service delivers pick reminders if you turn them on: Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox. It only ever carries encrypted messages.

These providers may store or process information outside Canada, including in the United States, where it can be subject to the laws of that country.

NHL schedules and scores come from the NHL's public data. We send nothing about you to get them.

• Sign-in cookies. A session cookie keeps you signed in; it is set to last 24 hours. The sign-in system also sets short-lived security cookies while you sign in.
• pp_join remembers an invite code for 30 days, so an invite link still takes you to the right pool after you create an account.
• Browser storage on your device remembers your preferences: light or dark mode, a banner you dismissed, and the view you last chose on a few screens. It never leaves your device.

We do not use advertising cookies, and we do not track you across other sites.

We keep your account and pool information while your account exists, so your pools, picks and history stay available to you and to the other members of your pools.

• Password reset links expire after one hour, and verification links after 24 hours.
• Sign-in lockout records expire after 15 minutes.
• A push subscription is deleted when you turn reminders off, or when your browser's push service tells us it no longer exists.
• When a pool's creator deletes the pool, its entries, picks and email records go with it.

To have your account and your data deleted, ask us through the contact page.

The site is served over HTTPS. Passwords are stored as bcrypt hashes, never in a form we can read. Sign-in attempts are rate limited and repeated failures lock that email and IP address out for 15 minutes. Access inside a pool is checked on our server for every request, and email addresses are only ever sent to the people listed under “Who sees what”.

No system is perfectly secure. If we learn of a breach that creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada, as the law requires.

• See and correct your information. Your name, email address, password and profile photo can be changed on your profile page. For anything else, or for a copy of what we hold about you, contact us.
• Pick reminders. Turn them on or off at any time, device by device.
• Pool emails. Deadline reminders, recaps and commissioner messages go to the members of a pool. If you no longer want them, ask your commissioner to remove you from the pool, or contact us.
• Delete your account. There is no delete button yet. Ask us through the contact page and we will delete your account and your data.
• Complain. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Pool Picks is not directed at children.

When this policy changes, we will post the new version on this page and update the effective date at the top.

For any question about this policy, a request about your information, or a complaint, write to us through the contact page.