Privacy policy

1. Person in charge of the protection of personal information

Joel Vandal, Joel Vandal Inc. — [email protected]. For any question, access request or complaint about your personal information, write to this address.

2. Information we collect

• Account: name, email address, password (stored only as a one-way hash), preferred language and, if you add one, a profile photo.
• Pool activity: the pools you take part in, draft picks, rosters, trades, trophy predictions, watch list and messages posted on message boards.
• Companies: company name and logo, departments, prizes and messages, when your organization uses a company plan.
• Invitations: the email addresses you enter to invite people to a pool, with the date sent.
• Payments: amount, taxes, status and transaction identifiers. Card details are entered directly with our payment provider; we never see or store them.
• Mobile app: one access token per signed-in device and, if you accept notifications, the device's notification identifier.
• Security: for sign-in attempts, the IP address and the identifier used, to block brute-force attacks.

3. Why we use it

• To create and manage your account and let you take part in pools.
• To show standings, teams, trades and messages to the members of your pools.
• To send Service emails: welcome, membership requests, approvals, password reset, pool activation, invitations you send.
• To process payments and keep the records required by law.
• To send the notifications you have accepted (for example: it is your turn in the draft).
• To protect the Service and its users against fraud and abuse.

We do not sell your personal information, we do not do targeted advertising and we do not use any advertising tracking tools.

4. Who can see your information

Members of a pool see the name, photo, team, results and messages of the other members of that pool. A pool administrator also sees the names of people asking to join and the invitations sent. Your email address is not shown to other participants.

5. Service providers

We use providers who process some information on our behalf, only for the purposes described here:

• Hosting of the site and database.
• Cloudflare: delivery and protection of the site (request transit, IP address).
• Our credit card payment provider: payment processing and tax calculation.
• A transactional email provider: delivery of Service emails.
• Google Firebase Cloud Messaging and Apple's notification service: delivery of mobile app notifications.

Some of these providers may process information outside Québec, notably in the United States. Before sharing information with them, we make sure they offer adequate protection and are bound by confidentiality commitments.

6. Cookies

The site uses only three cookies, all necessary or preference cookies:

• Session cookie: keeps you signed in (deleted when you sign out or after 30 days).
• Language: remembers French or English (1 year).
• Theme: remembers the dark or light theme (1 year).

No advertising or audience-measurement cookies are used.

7. Retention

• Account and pool activity: as long as your account is active, then deleted or anonymized when the account is closed, except what the law requires us to keep.
• Payment records: for the period required by tax laws (generally 6 years).
• Sign-in attempts: 24 hours.
• Password reset links: valid for 1 hour.

8. Security

The site is only available over HTTPS, passwords are hashed, forms are protected against forged requests and repeated sign-in attempts are blocked. Access to data is limited to what is needed to operate the Service. In the event of a confidentiality incident presenting a risk of serious injury, we will notify the people concerned and Québec's Commission d'accès à l'information.

9. Your rights

You may at any time ask to access your personal information, have it corrected, obtain a copy in a structured technological format, withdraw your consent or have your account deleted. You can change your name and photo directly in your profile. For any other request, write to [email protected]; we reply within 30 days.

If you are not satisfied with our answer, you may file a complaint with Québec's Commission d'accès à l'information (www.cai.gouv.qc.ca).

10. Invited people

If a member invited you by email, we used your address only to send you that invitation, and we keep it to avoid repeated sends. To have it deleted, write to [email protected].

11. Minors

The Service is not intended for people under 14 and we do not knowingly collect their information.

12. Changes

We may update this policy. The last-updated date appears at the top of the page; if there is a significant change, we will inform you by email or in the Service.