What we collect
- Your email address, to create the account, confirm it, email you about the tournament, and reach you if you win. We also store a normalised form of it, which is how one person is kept to one account.
- Your handle, and a display name if you set one. The handle is public.
- How you played — the packs you were dealt, the lineups you built, the scores they produced and how far each entry advanced.
- The random seed your browser contributed to your deal, and whether it came from your browser or was derived. This is what lets you verify your own packs on Provably fair.
- That you accepted the rules, when, and which version — because the Official rules are a binding agreement and we have to be able to say what you agreed to.
- Whether you have asked us to stop emailing you, and when, so that we do.
If you sign in with Apple or Google we receive the email address they release to us and nothing else. Apple’s relay addresses work normally here.
Our host keeps ordinary server logs, which include IP addresses. We may use technical signals of that kind to detect duplicate accounts and abuse, because a free sweepstakes with a real prize attracts both.
One page keeps a record of its own. If you are shown a pack before you have an account, we store a scrambled fingerprint of your network address — a keyed hash, from which the address cannot be read back — beside the random value your browser made for that pack and, if you go on to sign up, which account came of it. That is what holds one network to one preview per series and one pack to one account. It is deleted when the season ends.
If you buy something
The Shop sells shirts, printed to order. Buying one is separate from playing: a purchase is never an entry and changes nothing about your account, and you do not need an account to buy. One shirt is sold only to players with a live entry, which is the one place the shop looks at the game — and it only looks.
You pay on Stripe’s page, which collects your name, shipping address, email, phone number and card, and holds them under its own privacy policy. Stripe tells us the payment was made. We then pass your name, address, email and phone number to Printify, which prints the shirt, ships it and emails you the tracking number. What we keep is the order itself — what was bought, for how much, and Stripe’s and Printify’s references for it. We do not keep your address, your phone number or your card, and if you bought without an account we do not keep your email either.
What we do not collect
- No advertising trackers, and no analytics that identify you. We count page views with Vercel’s analytics, which uses no cookies and keeps no profile — a tally of which pages are read, not a record of who read them.
- No date of birth. Age is a statement you make when you sign up.
- No card numbers. Playing is free, and if you buy a shirt the card is entered on Stripe’s page and never passes through us.
- No social security number or tax documents. At this prize value none is required; if that ever changes the Official rules will say so before it does.
Why we hold it
To run the tournament, to score it, to show you and everybody else how it went, to reach a winner, and to keep the game honest. That is the whole of it. We do not sell your information, and we do not share it for anyone else’s marketing.
Who else touches it
Seven services process data on our behalf, each under its own agreement, and none of them may use it for their own purposes:
- Supabase — the database and the sign-in system
- Vercel — hosting and delivery, and the page-view count above
- Inngest — the scheduled jobs that deal packs and score each week
- Resend — sends the sign-in codes and any email we send you, so it sees your address
- Cloudflare — the bot check at sign-up and on the pack preview, which sees your IP address and browser signals and nothing you type
- Stripe — takes payment in the shop, so it sees what you enter on its checkout page: your name, address, email, phone number and card
- Printify — prints and ships what you buy, so it receives your name, address, email and phone number for the order
We may also disclose information where the law requires it, or to protect the integrity of the sweepstakes.
Cookies
Only the ones that keep you signed in, plus your light or dark preference. No advertising cookies, no third-party cookies, and nothing that follows you off the site — which is why there is no banner asking about them.
How long we keep it
Account and play data are kept while the account exists, and a season’s results are kept afterwards so a past tournament can still be looked up — the bracket is a public record of what happened. Ask us to close your account and we will delete or anonymise what is not needed for that record or by law. An order is kept as the record of a sale for as long as the law asks that of a business’s books; as above, it names no one.
Your choices
Every email about the tournament has an unsubscribe link. Using it changes nothing about your account or any entry; the sign-in codes are not affected either way, because they are how you get in.
Write to hello@peffercorn.com and you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. We will not make you use the service on worse terms for asking.
Children
Peffercorn is not for children. You must be an adult where you live to hold an account — the ages are in the Official rules. We do not knowingly collect anything from a child, and if we learn we have, we will delete it.
Changes
If this changes in a way that matters, we will say so on the site rather than rely on you noticing. Questions go to hello@peffercorn.com.