A LITTLE RIVALRY BETWEEN FRIENDS

Privacy policy

Effective September 28, 2026 | Friends web pilot

Rivale uses your account and game information to run private leagues. We do not sell your information or use advertising trackers.

Who is responsible

Meltemi Labs operates Rivale and is responsible for handling your personal information and privacy requests. Contact the operator to ask a question, raise a concern, or exercise your privacy rights. You can also email support@playrivale.app.

What we collect and why

• Your email, display name, password hash, verification status and account dates let you create an account, sign in and recover access. Use a display name you are comfortable sharing with your league.
• Session identifiers, IP address, browser/device information and security records help keep you signed in, show your devices and prevent abuse. Passwords are stored as hashes, not readable passwords.
• Your timezone, spoiler preferences, league membership, draft picks, queues, keeper choices, ballots, reactions, disputes and results make the game work and preserve your season history.
• Save receipts, audit records and first-party participation events, such as joining a league or making a pick, help resolve failed saves, scoring disputes and participation problems. These are linked to account identifiers; they are not anonymous analytics.
• Account emails and delivery records let us verify your address, welcome you after verification and reset your password. If you contact support, we use the message and reply details to handle your request.

What other players can see

League members can see your display name, roster, picks and league activity. Private queues, keeper nominations and finale ballots have access and reveal rules described in your league. Results and standings follow your spoiler settings. Your email, password and session tokens are not shown to other players. Anyone with a valid invitation link can see its limited invitation preview, so share it only with intended friends.

Services that process information

Vercel hosts the website and processes requests and operational logs. Supabase stores account and game data in a United States database. Resend processes recipient addresses, account-email content and delivery information. GitHub stores encrypted operational backups in a private repository's workflow artifacts. Cloudflare provides the domain's DNS. These services may process information outside your country, where different privacy laws apply. Authorized operators can access data needed for support, maintenance and recovery.

We may disclose information when required by law or when necessary to address abuse or protect the service and its users. We do not automatically send invitations or marketing emails. The app does not send your account or league data to a generative AI service, and there is no player-facing AI chat.

Cookies and browser storage

We use first-party authentication cookies for sign-in and security. Sessions normally last up to seven days and may renew while you use the service. A tab's session storage temporarily holds an unresolved game save and its receipt identifier so you can recover it after a connection failure; it is cleared after confirmation or when the tab ends. We do not load advertising pixels, Google Analytics or heatmaps. There is no optional tracking to accept. Blocking essential cookies prevents sign-in.

Retention and deletion

Account data is kept while you use your account. League entries and results support current play and season archives. You can request access, correction or account deletion through support; requests are handled by the operator, not an instant delete button. We verify that the request is yours before acting and explain what was removed or must be retained.

Deleting an account must not change other players' scores. Limited competition history may need to remain with identifying details removed or reduced. Other players may still recognize their former teammate from the game history; this is not a promise of complete anonymity. Necessary security, dispute or legally required records may also be retained, with the reason explained to you.

Scheduled encrypted backups are configured for seven-day daily and 28-day weekly retention. Deletion from the active service does not instantly remove every backup or provider log. Restricted recovery copies and provider-held records must also be considered when handling your request; deletion instructions must be reapplied before restored data is used. We do not accept user file or photo uploads.

Your choices

Update your name, timezone, reveal preferences and password in Account. You can sign out other devices there. Contact us to request a copy or correction of your information, withdraw consent by closing your account, or raise a privacy concern. We do not charge to make a request. Depending on your location, you may also contact your privacy regulator.

Adults and policy changes

This pilot is intended for adults 18 and over. Do not create an account for a child. Contact us if you believe a child has provided personal information so we can investigate and remove it as appropriate. We will update this page when practices change and give notice before a material new use of your information.