Privacy Policy

Who runs this

Wet Grass (wetgrass.app) is operated by an independent developer based in the United States. It is not a registered company. For anything in this policy — including a request to see or delete your data — write to hello@wetgrass.app.

What we collect

• Your email address. Required. It is how you sign in — we email you a link instead of asking you to invent another password — and it is the only way we can reach you about a league you are in.
• A display name. Chosen by you, shown to the other people in your league. Use a nickname if you like; nothing checks it against your real name.
• What you do in a league. Drafts, bids, rosters, results and the timestamps attached to them. This is the product — a pool with no record of who bid what is not a pool.
• Basic technical data. Our sign-in provider records the browser and device you signed in from, to spot suspicious logins. Our host processes IP addresses to serve requests and block abuse, as every web server must.

We do not ask for your real name, address, phone number, date of birth, or payment details, and there is nowhere to enter them. There is no payment of any kind on this site.

Why we are allowed to hold it

For anyone in the UK or EEA, where a lawful basis has to be named: we process your email and league activity to perform the service you asked us for (GDPR Article 6(1)(b)) — you cannot be in a league without an account and a record of your picks. The security and abuse-prevention data is processed under our legitimate interests in keeping accounts from being broken into (Article 6(1)(f)). We do not rely on consent, so there is no consent to withdraw; if you want out, delete your account.

Cookies

We set cookies that keep you signed in. That is all they do, and the site cannot work without them, so they are not the kind that require a consent banner.

We run no analytics and no tracking pixels. There is no Google Analytics, no Meta pixel, and no advertising cookie on this site today. If that ever changes, this policy changes first and this paragraph will say so.

Advertising

Wet Grass currently shows no advertising. If we ever do, it would be through a third-party network such as Google AdSense, and the following would apply:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this or other websites.
• Google's use of advertising cookies lets it and its partners serve ads to you based on your visits to this site and others. You can turn off personalised advertising at Google Ads Settings, or opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info.
• Visitors in the UK, EEA and Switzerland would be asked for consent before any advertising cookie is set.

We would never hand your email address or your league activity to an advertiser. We do not sell personal information, and we never have.

Who else touches your data

These companies process data on our behalf, and only on our instructions:

• Supabase — accounts, sign-in emails and the database. Your data is stored in Oregon, USA (AWS us-west-2).
• Cloudflare — serves the site and filters abusive traffic.

Nobody else receives your data. We do not share it with advertisers, data brokers or “partners”, and we would only disclose it if we were legally compelled to.

Where your data lives

On servers in Oregon, USA (AWS us-west-2). If you are in the UK or EEA, that means your data is transferred to the United States, which our providers cover through the standard contractual clauses in their data processing agreements.

How long we keep it

Your account and league history stay for as long as you have an account. If you have not signed in for 24 months we may scrub the account the same way a deletion does. Leagues created for testing get cleared out routinely.

Deleting your account

Go to your account page and press the button. It happens immediately, and it is not reversible. Concretely:

• Deleted outright: your login and email address, your draft preferences, and your presence and notification records.
• Anonymised, not deleted: the bids and picks themselves. A completed auction is a shared record that eight other people also played in, and pulling one person's bids out of it would rewrite their league too. Those rows stop being connected to you or your email and are relabelled “Former manager” — at which point they are no longer personal data.

If you would rather we did it by hand, or you want a copy of your data first, email hello@wetgrass.app.

Your rights

Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it — email hello@wetgrass.app and we will respond within 30 days. We will not charge you and we will not treat you differently for asking.

In the UK or EEA you also have the right to object to or restrict processing, the right to data portability, and the right to complain to your national data protection authority. In California, you have the right to know what we collect and to have it deleted; note that we do not sell or share personal information, so there is nothing to opt out of.

Children

This is not built for children. Do not create an account if you are under 13 (or under 16 in the UK or EEA). If you believe a child has an account here, email us and we will remove it.

Changes

If this policy changes in a way that matters, we will update the date at the top and, for anything significant, tell you by email before it takes effect.