Privacy

You can use this site without an account, and most people will. Nothing here is sold, and nothing here is shared with an advertiser. There are no analytics scripts and no third-party trackers on any page.

Two things are public by default: the name you give a universe, and the picks inside it. You can turn that off for a universe when you make it. Everything else is either private to you or not collected at all.

No account is required to create a universe, fill in a season, or be scored. When you make your first universe we create an anonymous session — a random identifier with nothing personal in it — and store it in a cookie called ykb_session. That identifier is what links your browser to the universes you have made. It is signed with a server key so it cannot be forged, and it is checked against our database on every write, so a cookie naming a session that no longer exists grants nothing.

Each universe also gets an eight-character claim code. Entering that code on another device moves the universe to it. The code is the only proof of ownership an anonymous universe has, so treat it like a password: anyone who has it can take over that universe.

Signing in is optional and is offered in one place, on the account page. There is no part of this site that requires it.

When you sign in, Google gives us and we store:

Your email address

Used to identify your account when you sign in again. It is never displayed to anyone.

Your Google account identifier

The number Google uses for your account. It is what actually matches you to your universes on a second sign-in.

Your name and profile picture URL

Stored because Google sends them and our sign-in library records them. Neither is displayed anywhere on this site. The picture your account shows is the sprite you pick, which is served from this site and is not connected to your Google profile.

We do not send email of any kind. Not a welcome message, not a receipt, not a newsletter. If weekly recap emails are added later they will be something you turn on rather than something you turn off, and this page will say so before the first one goes out.

We do not request, receive, or have any access to your Gmail, Drive, Calendar, contacts, or anything else in your Google account. The only permissions we ask for are your basic profile and email address.

The name you give a universe is public. It appears on the leaderboard for that sport and on the universe’s own page, which has a shareable link. The screen where you name a universe says so at the moment you choose: “It goes on the leaderboard and on anything you share.”

A universe’s page shows its name and its picks to anyone who has the link — unless you unticked compete on the leaderboard when you made it. A universe made that way is private: its page opens for you and returns a not-found for everybody else, including anyone you send the link to. It is not listed, not indexed, and has no share card.

Two things this does not cover, so that it is not read as more than it is. A universe made before September 2026 is public even if it is off the leaderboard, because the checkbox did not set this at the time and we have not gone back and changed what people made under the old behaviour — tell us and we will make yours private. And when the leaderboard slot for a sport is already taken, the checkbox is not offered at all, so a second universe is unranked but public. The screen says which you are getting in both cases.

A private universe follows you, not this browser: if you sign in, you can open it from another device. Anything still public is genuinely public, so do not put something in a universe name you would not want read.

If you have set a username, it appears beside your universes on the leaderboard. If you have not, nothing appears there — an entry with no account and an entry whose owner skipped the username step both simply show the universe name. Your claim code, your email address and your avatar sprite are never shown to anyone else.

We never store your IP address. When you create a universe we combine the address with a secret key, hash it with SHA-256, keep the first 32 characters of the result, and store only that. The stored value cannot be turned back into an address, and without the key it cannot be checked against a guessed one either.

It exists for one purpose: refusing more than 20 universes an hour from one connection and 5 from one browser, so that a script cannot fill a leaderboard page faster than a person could. It is never used to identify or locate anyone.

Our hosting provider (Vercel) and our database provider (Neon) keep their own operational logs, which will include IP addresses, in the ordinary way that any web host does. We do not add to those logs and do not use them.

Every cookie here is one the site needs to work. There are no analytics, advertising, or tracking cookies, and no cookie is set by anyone but us. Our fonts are served from this site rather than from Google Fonts, so loading a page makes no request to a third party.

ykb_session

Your anonymous session identifier, signed. Set when you first create or claim a universe. Lasts 400 days. Deleting it does not delete your universes — it just disconnects this browser from them, and a claim code gets them back.

__Secure-authjs.session-token

Set only if you sign in. Identifies your signed-in session, which is stored in our database and can be ended from our side. Lasts 90 days and is extended at most once a day while you are using the site.

__Host-authjs.csrf-token · __Secure-authjs.callback-url

Sign-in machinery: protection against a forged sign-in request, and the page to return you to afterwards. Cleared when you close your browser.

__Secure-authjs.pkce.code_verifier · __Secure-authjs.state

Set for 15 minutes while you are being redirected to Google and back, to prove the response is answering our request. Gone immediately afterwards.

ykb-nav (browser storage, not a cookie)

Whether you collapsed the sidebar. Never sent to us — it is read only by the page in your own browser.

ykb-cfb-conferences (browser storage, not a cookie)

Whether the college football grid is showing all ten conferences or only the four with automatic playoff bids. A view setting and nothing more: it is not attached to your picks, it does not travel with a universe you share, and like the one above it is never sent to us.

On a development machine the sign-in cookies appear without their __Secure- and __Host- prefixes, because those prefixes require HTTPS. On the live site they always carry them.

Nothing is deleted on a schedule. There is no cleanup job in this application: universes, picks and weekly scores are kept so that a season can still be looked at after it ends, and so that a leaderboard from last year still says what it said.

Sign-in sessions expire on their own after 90 days of not being used. The short sign-in cookies above expire in 15 minutes. Everything else is kept until you ask us to delete it.

Email site.ykb@gmail.com and we will do it by hand — there is no self-service button yet, and saying there is one would be the sort of thing this page is trying not to do.

If you have an account

Write from the address you signed in with. We delete your account, the Google link, every sign-in session, and every universe you own, including its picks and scores.

If you never signed in

Include the claim code of the universe you want removed. It is the only way we can tell it is yours — we have no other way to connect an anonymous universe to a person, which is the point of it being anonymous.

You can also just ask what we hold about you, and we will tell you.

If this policy changes in a way that affects what we collect or what we do with it, the date at the top changes and the change is described here. We will not quietly widen it.