What we collect
- Your email address, to create the account, confirm it and reach you if you win. We also store a normalised form of it, which is how one person is kept to one account.
- Your handle, and a display name if you set one. The handle is public.
- How you played — the packs you were dealt, the lineups you built, the scores they produced and how far each entry advanced.
- The random seed your browser contributed to your deal, and whether it came from your browser or was derived. This is what lets you verify your own packs on Provably fair.
- That you accepted the rules, when, and which version — because the Official rules are a binding agreement and we have to be able to say what you agreed to.
If you sign in with Apple or Google we receive the email address they release to us and nothing else. Apple’s relay addresses work normally here.
Our host keeps ordinary server logs, which include IP addresses. We may use technical signals of that kind to detect duplicate accounts and abuse, because a free sweepstakes with a real prize attracts both.
What we do not collect
- No advertising trackers, and no analytics that identify you. We count page views with Vercel’s analytics, which uses no cookies and keeps no profile — a tally of which pages are read, not a record of who read them.
- No date of birth. Age is a statement you make when you sign up.
- No payment details, ever — Peffercorn is free and there is nothing to buy.
- No social security number or tax documents. At this prize value none is required; if that ever changes the Official rules will say so before it does.
Why we hold it
To run the tournament, to score it, to show you and everybody else how it went, to reach a winner, and to keep the game honest. That is the whole of it. We do not sell your information, and we do not share it for anyone else’s marketing.
Who else touches it
Five services process data on our behalf, each under its own agreement, and none of them may use it for their own purposes:
- Supabase — the database and the sign-in system
- Vercel — hosting and delivery, and the page-view count above
- Inngest — the scheduled jobs that deal packs and score each week
- Resend — sends the sign-in codes and any email we send you, so it sees your address
- Cloudflare — the bot check at sign-up, which sees your IP address and browser signals and nothing you type
We may also disclose information where the law requires it, or to protect the integrity of the sweepstakes.
Cookies
Only the ones that keep you signed in, plus your light or dark preference. No advertising cookies, no third-party cookies, and nothing that follows you off the site — which is why there is no banner asking about them.
How long we keep it
Account and play data are kept while the account exists, and a season’s results are kept afterwards so a past tournament can still be looked up — the bracket is a public record of what happened. Ask us to close your account and we will delete or anonymise what is not needed for that record or by law.
Your choices
Write to hello@peffercorn.com and you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. We will not make you use the service on worse terms for asking.
Children
Peffercorn is not for children. You must be an adult where you live to hold an account — the ages are in the Official rules. We do not knowingly collect anything from a child, and if we learn we have, we will delete it.
Changes
If this changes in a way that matters, we will say so on the site rather than rely on you noticing. Questions go to hello@peffercorn.com.