Privacy Policy

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include:

• Name and email address
• A password, which we store only in hashed form, or a Google account identifier if you sign in with Google
• A phone number and time zone, if you choose to add them
• Your notification preferences, and, when you accept our Terms, which version you accepted, the date, and how the acceptance was given (for example a checkbox at signup or in the app)
• Your pool membership and role, your entries, your weekly picks, and the standings and results derived from them
• Answers to any custom questions your pool's commissioner adds to their join form
• Votes you cast in a commissioner's poll
• Comments and reactions you post on a pool's Activity feed
• For shop orders: the email address and shipping address you give at checkout, and what you ordered
• A record of actions taken on your account and entries, such as picks made, entries renamed, and commissioner actions affecting you
• If an email to you bounces or is marked as spam, your email address and the reason, so we stop sending to it

Information Provided by Commissioners or Other Users. Some information about you is written by someone else rather than by you, and you may not see it. This includes commissioner-recorded off-platform payment status: a mark a commissioner sets for their own bookkeeping. Sunday Survivor does not receive, process, hold, verify, or have any record of the payment itself, its amount, its purpose, its method, or whether any transfer occurred:

• A mark your commissioner can set to record that you have settled up with them, and how many entries or mulligans they have noted it against. This is their own bookkeeping about money arranged directly between the two of you. Sunday Survivor does not collect, hold, or transfer it, and we hold no record of any amount
• A private note your commissioner may keep against your membership, which they write and you do not see

Content you post in a pool. If your pool's commissioner turns on the Activity feed, anything you post there is visible to the other members of that pool alongside your name. It is not public, and it is not shown to anyone outside your pool. Your commissioner can delete any comment in their own pool.

Sensitive Information. We process account-login credentials solely to authenticate and secure accounts. Depending on applicable law, those credentials may be classified as sensitive personal information. We do not ask for government identifiers, financial-account credentials, precise location, health information, racial or ethnic origin, religious beliefs, sexual orientation, or other sensitive personal information. Commissioners and participants must not enter such information in custom questions, private notes, comments, or any other free-text field. Because users control those fields, we may receive sensitive information that they submit contrary to this instruction. If we learn of such information, we may restrict or delete it as appropriate and otherwise process it only as necessary to provide and protect the Services or comply with law.

Payment Data. Card details are entered on a payment page hosted by Stripe and are never sent to, or stored on, our servers. We do not receive your card number or its security code. What we receive and keep is limited to the payment status, the amount, the pricing tier or items purchased, and Stripe's transaction identifiers. You may find their privacy notice here: https://stripe.com/privacy.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information, such as your IP address and browser/device characteristics, is collected automatically when you visit our Services.

When the Analytics category is enabled under your Privacy Choices, we use Google Analytics, a web analytics service provided by Google LLC. Google Analytics may collect information including your IP address, browser type, device type, pages visited, time spent on pages, and referring URLs, and may use analytics cookies or similar identifiers to distinguish visits. This is pseudonymous analytics data rather than anonymous data. We use it to analyze traffic patterns and improve our Services. Google Analytics does not load before you enable this category.

Google may use this data in accordance with its own privacy policy, available at https://policies.google.com/privacy. You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on.

Referral attribution

In Short: When Attribution is enabled under your Privacy Choices and you arrive through a referral or tagged link, we set a first-party cookie so we can credit that source if you later sign up.

We operate a referral program in which partners (such as content creators) may share links to our Services. When Attribution is enabled under your Privacy Choices and you visit through one of these links, we store a first-party cookie in your browser recording which partner referred you. If you later create an account, we associate your account with that partner so we can attribute the referral and calculate any commission owed to them. This cookie lasts up to one year, is used only for referral attribution, and is not shared with the referral partner. We do not share your name, email address, or other personal information with referral partners; they see only aggregate counts and earnings. Separately, when Attribution is enabled under your Privacy Choices and you arrive from an advertisement or tagged link, we store a first-party cookie containing the campaign labels in that link (for example the source, medium and keyword). If you later create an account, those labels are saved with it so we can tell which campaigns bring people to the site. Those labels can include an advertising click identifier supplied by the ad platform. This cookie is readable only by our server and lasts up to one year. Once the labels are saved against an account they are personal information, because they are linked to you; we treat them that way and they are never shared with or sent back to any advertiser.

Your storage and tracking choices

We use storage that is necessary to provide features you request, including account authentication and security, shopping-cart contents, interface preferences, and remembering which of our own messages you have closed so we can avoid showing them to you again. None of it is used for third-party advertising or shared with any advertiser. Our privacy panel separately asks whether we may use Analytics and Attribution, and where those two categories START depends on your location, because the law does. In the EEA, the UK and Switzerland, and wherever we cannot determine your country, both are OFF until you turn them on, and Google Analytics does not load before you do. Everywhere else, including the United States, both start ON, and you are shown a notice telling you how to turn them off rather than a panel that blocks the page. That follows a difference in the underlying law: those regions require permission before optional storage is used, while several US state privacy frameworks are instead built around a right to opt out. Which rights you actually have depends on your state, and the section on US residents below sets them out. We store your choice in a first-party preference cookie for up to six months so we do not ask on every visit. You can review or withdraw your choices at any time using the Privacy choices button in the corner of the screen. Withdrawing Attribution deletes its browser cookies; withdrawing Analytics stops Google Analytics from loading on later page views and attempts to remove its first-party cookies.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To operate user-created pools. We process account information, pool membership, entries, picks, pool rules, standings, results, and related activity to provide pool-management features to commissioners and participants. Sunday Survivor provides software for private pools. We do not set, collect, hold, escrow, verify, transfer, or distribute participant entry fees, buy-ins, pool funds, or prizes, and we do not take a percentage of them. Any such arrangement is made independently and off-platform by the commissioner and participants, must comply with applicable law, and is not sponsored or approved by Sunday Survivor.
• To show you our own offers and product news inside the Services. We may use your pool's settings to decide which of our own messages to show you on your pool home page, for example an offer on merchandise. Which message you see can depend on whether your pool is on a paid plan, and a message can be addressed to particular pools. Your account is used only to sign you in and to remember which of these messages you have already closed. These are our own products, shown by us, on our own site. We do not use your information to show you third-party advertising, we do not allow advertisers to collect information through the Services, and every one of these messages can be closed.
• To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them. We use Google Analytics for this purpose.
• To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.
• To generate personalized communications using AI. We use AI (powered by Anthropic Claude) to compose weekly results emails and other pool-related updates sent to you. To do this, pool activity data (such as the number of surviving entries, teams selected, and weekly outcomes) is sent to Anthropic's API, together with your pool's name and, when a pool is decided, the names of the winning entries. Entry names are written by users and may contain a person's name. We do not send your email address, phone number, or password to Anthropic. These communications are only sent if you have enabled the relevant notification preferences in your account settings.

3. What Legal Bases Do We Rely On to Process Your Information?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations

4. When and With Whom Do We Share Your Personal Information?

Inside your pool

A pool is a private group, and joining one means some of your information is visible inside it. Pool information is not listed publicly by default. A participant can choose to create or share a Survivor Card containing an entry name, picks, results, and season summary; anyone who receives or can access that shared card may see that information.

Your pool's commissioner can see:

• Your name, email address, and phone number if you have added one
• Your entries and your results
• Whether you have made your pick for a week, but not which team you chose. A commissioner sees your picks on exactly the same terms as anyone else in the pool: once the pool's rules make them visible, which depends on the deadline they set and on whether they hide results until it passes
• Your answers to any custom questions on their join form
• Whether they have marked you as having settled up with them, which is their own record and not a payment we handled
• A private note they can write about your membership, which you cannot see

Other members of your pool can see:

• Your entry names and their standing in the pool
• Your picks, once the pool's rules make them visible, which depends on the deadline your commissioner set and on whether they hide results until it passes
• Anything you post on the Activity feed, shown alongside your name

Other members cannot see:

• Your email address or phone number
• Your answers to the commissioner's custom questions
• Your commissioner's settled-up mark for you. No member can see another member's. If your commissioner turns this on, each member sees only their own.
• The commissioner's private note about you

If you belong to more than one pool, each pool sees only its own membership. Commissioners of one pool cannot see your entries, picks, or membership in another.

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Service Providers. We rely on a small number of companies to run the Services, and they process your information only to provide those functions to us, not for their own purposes. These are our website and application hosting provider, our database provider, our email delivery provider (which receives the email address and the contents of any message we send you), our error monitoring provider (which receives technical diagnostic information when something goes wrong, and may incidentally include an email address in an error message), and, when you place a shop order, our print and fulfillment partner (which receives your name, shipping address, and order details in order to make and ship your item). We may change any of these providers over time.
• Analytics Providers. When Analytics is enabled under your Privacy Choices, we disclose pseudonymous usage and device data (such as pages visited, device/browser type, and IP address) to Google LLC through Google Analytics to help us understand how our Services are used. Google's privacy policy is available at https://policies.google.com/privacy.
• AI Service Providers. We use Anthropic (Claude API) to generate personalized weekly results emails. Anthropic receives pool activity data (such as pick counts, surviving entries, and weekly outcomes), your pool's name, and the names of winning entries when a pool is decided, solely for the purpose of generating these communications. Entry names are written by users and may contain a person's name. Anthropic does not receive your email address, phone number, or password, and does not use this data to train its models. You can learn more about Anthropic's data practices at https://www.anthropic.com/privacy.

5. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Most of what we hold is tied to your account and is removed when the account is deleted. Some categories are kept on their own schedule, and some outlive the account because we are required or need to keep them:

• Account, pools, entries and picks: for as long as you have an account.
• Payment and shop records: kept after account deletion where tax and accounting rules require it. Stripe keeps its own records under its own policy.
• Suppression records: if an email to you bounced or was marked as spam, we keep that address and the reason indefinitely. Deleting it would let us start emailing you again, which is the opposite of what it is for.
• Referral and campaign cookies: up to one year in your browser.
• Privacy-choice cookie: up to six months in your browser.
• Closed-message flags: kept in your browser until you clear its site data. They stay on your device and are never sent to us.
• Backups: our database keeps a twelve-hour change history for point-in-time recovery, so deleted data can persist for up to twelve hours before it is no longer recoverable from it.
• Analytics: held by Google, not by us. Event data is retained for 2 months and user data for 14 months, with the 14-month window resetting on new activity by the same user.
• Text sent to our AI provider to generate a weekly recap is ordinarily deleted by them within 30 days, under their own policy. They may keep it longer where the law requires it, or where it is needed to investigate or enforce compliance with their usage policies.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible, we will securely store your personal information and isolate it from any further processing until deletion is possible.

Comments and reactions on the Activity feed are kept for a much shorter period than anything else described here. The feed covers one week at a time, and when it moves to the new week, at 3:00 AM Eastern each Wednesday, the previous week's comments and reactions are deleted rather than archived. The deletion runs the next time that pool's feed is loaded, so for a pool nobody opens it happens whenever somebody next does. The exception is the NFL postseason, when the feed holds every playoff round and they are kept for its duration.

6. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

7. Do We Collect Information From Minors?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 years of age and have reached any greater minimum age required by the laws applicable to you. A parent or guardian cannot consent to a minor's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at admin@sundaysurvivor.com.

8. What Are Your Privacy Rights?

In Short: Depending on your state of residence in the US or in some regions, such as Canada, you have rights that allow you greater access to and control over your personal information.

In some regions (like Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. You can make such a request by contacting us using the contact details in section 12 below.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. For Analytics and Attribution, use the Privacy choices button in the corner of the screen. You may also contact us using the details in section 12 below.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account
• Contact us using the contact information provided

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

International Users

Sunday Survivor is operated from the United States. If you access the Service from another country, your information may be transferred to, processed, and stored in the United States and other countries where our service providers operate. Where applicable law provides you with rights concerning your personal information, you may exercise those rights by contacting us using the information below.

9. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform standard for recognizing and implementing DNT was ever finalized and browsers never agreed on what the signal means, so we do not respond to DNT.

Global Privacy Control is a different thing, and we do honor it. GPC is a universal opt-out signal named in the privacy laws of several US states, including California, Colorado, and Connecticut. If your browser or an extension sends a GPC signal, we treat it as an opt-out on every request that carries it: the Analytics and Attribution categories are both OFF for you, whatever your location would otherwise default to and whatever you may have chosen before, and Google Analytics does not load. While your browser keeps sending the signal this cannot be switched back on, including from the Privacy choices panel. If your browser stops sending the signal, Analytics and Attribution remain off unless you update your choices using the Privacy choices panel.

If another opt-out signal becomes legally recognized and applies to us, we will honor it and describe it here.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

10. Do United States Residents Have Specific Privacy Rights?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have specific privacy rights.

You may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

When Analytics is enabled under your Privacy Choices, we disclose pseudonymous usage and device data to Google LLC through Google Analytics for analytics purposes as described in Section 4. We have not sold personal information to third parties and do not intend to do so in the future.

Your Rights

You have rights under certain US state data protection laws, including:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

How to Exercise Your Rights

To exercise these rights, you can contact us by emailing us at admin@sundaysurvivor.com or by referring to the contact details at the bottom of this document.

California "Shine The Light" Law

California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please submit your request in writing using the contact details in section 12 below.

11. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

12. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at admin@sundaysurvivor.com or by mail at:

Sunday Survivor LLC

903 Montauk Hwy, Unit C #3342

Copiague, NY 11726

United States

13. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us at admin@sundaysurvivor.com.