Privacy policy

The short version

You can browse every team's depth chart without an account, and without sending us anything. If you sign in, we store your email address and the things you save — your favorite team, your depth-chart edits, and any share links you create. We show no ads, run no advertising or tracking SDKs, and never sell or share your personal information. You can delete your account and everything attached to it from inside the app at any time.

Who we are

The Sticks is an NFL depth-chart app for iPhone and the web, operated by Cooper Harris, an individual. This policy covers both the app and the website.

Browsing without an account

Nothing about you reaches our servers. Your depth-chart edits, last-viewed team, uniform selection, and dismissed hints are stored only on your own device — in your browser's local storage on the web, and in app preferences on iPhone. We can't read any of it. The iPhone app also caches public roster and schedule data so it works offline; that cache holds team and player information, never anything about you.

If you sign in

Signing in uses a one-time code sent to your email. We store that address because it is your account — there is no password and no username. We do not collect your name, phone number, mailing address, date of birth, payment details, or any government identifier. While signed in, we also store:

• your favorite team, last-viewed team, and whether the app opens on your favorite;
• your depth-chart reorders, per team and position;
• any share links you create, including the team shared and the date created.

Anonymous usage counters (iPhone app only)

The iPhone app records a small, fixed set of counters so we can tell whether the app is working: app launches, depth charts loaded, sign-in started, sign-in completed, an edit saved, and errors. An error record carries only a general category — such as “offline” or “server” — never a message, a stack trace, or any free text.

These records contain no user ID, device ID, session ID, email address, IP address, location, or advertising identifier. That isn't a promise about how we behave: the database table has no column capable of holding any of it. Two events cannot be connected to each other, to a device, or to a person — including by us. The website records no analytics at all and loads no third-party scripts.

Technical data

Like any internet service, our hosting and database providers process technical data — including IP addresses — to deliver and secure the service. We also apply a short-lived, in-memory rate limit to the public player-search endpoint, keyed on the requesting IP address, to prevent abuse. Those entries expire on their own, are never written to a database, and are never associated with an account.

Crash reports

We ship no crash-reporting SDK. If you enable Settings → Privacy & Security → Analytics & Improvements → Share With App Developers on your iPhone, Apple collects crash logs and makes them available to us through App Store Connect. That is Apple's pipeline under Apple's terms — the data never passes through our servers, and the app cannot see, change, or override your choice.

What we don't do

• No advertising, ad networks, or advertising identifiers.
• No third-party analytics, attribution, or crash SDKs.
• No tracking of you across other apps or websites, by us or anyone else.
• No location collection, precise or coarse.
• No access to your contacts, photos, microphone, or camera.
• No sale of personal information, and no sharing of it for advertising.
• No use of your information to train AI models.

Sharing a depth chart

When you create a share link, anyone who has the link can view that depth chart without signing in, and the portion of your email address before the @ is displayed publicly as the chart's owner name. For example, jane.doe@example.com appears as “jane.doe”. Your full address is never shown.

A share link stays live: it always resolves to whatever you currently have saved for that team, so it keeps updating as you keep editing. Deleting the link, or deleting your account, removes it. Once a link exists, others can copy, screenshot, or archive what it shows — so don't share a chart you wouldn't want public.

How we use your information

We use what we collect only to:

• sign you in and keep you signed in;
• save and sync your preferences and depth-chart edits across your devices;
• resolve share links you create;
• understand whether core flows work, using the anonymous counters above;
• keep the service secure and prevent abuse;
• respond when you contact us for support, and comply with the law.

We send no promotional email. The only email we send is your sign-in code, plus a reply if you write to us.

Who we share it with

We do not sell your information or share it for advertising. We disclose it only to Supabase (our database and authentication provider), Vercel (our website host), and Apple (App Store distribution and, if you opt in, crash reports). Each acts as a service provider processing data on our instructions, not for its own purposes.

We may also disclose information if legally required, or to protect our rights or someone's safety. If we are ever involved in a sale of the business, your information may transfer as part of it. Roster and schedule information is drawn from public sources — that is data flowing in about NFL players, not user data flowing out.

How long we keep it

Account data is kept until you delete your account. If you stop using the app without deleting it, the data stays until you do. The anonymous counters are retained in aggregate; because they cannot be linked to any person, deleting your account doesn't remove them, and there is nothing in them to identify.

Deleting your account

You can permanently delete your account at any time from the account page's Danger Zone. For safety, deletion requires a fresh one-time code, so an unattended signed-in device can't be used to wipe your account.

Deleting removes your sign-in record and, automatically with it, your settings, every depth-chart edit you've saved, and every share link you've created — all links stop working immediately. This is immediate and cannot be undone. If you'd rather we did it for you, email us from the address you signed in with.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information. Because your account holds so little, most of these are built into the app: your email address is on the account screen, your saved data is visible in the app, and deletion is one screen away. For anything else, email us and we'll respond within the time your state's law requires.

We verify requests by replying to the email address on the account. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of, and we do not profile you or make automated decisions about you.

Children

The Sticks is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email us and we'll delete it.

Security

We protect your information with encrypted connections, database-level row security that scopes your saved data to your own account, and passwordless sign-in that leaves no password to steal. Even so, no internet service is perfectly secure, and we can't guarantee absolute security.

Where your data is stored

We operate in the United States, and our providers store data there. If you use the app from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from your own.

Changes to this policy

We may update this policy as the app changes. If a change materially affects how we handle your information, we'll update the effective date above and post a notice before it takes effect. Continued use after a change means you accept the updated policy.

Contact

Questions, requests, or privacy concerns — reach us at support@cooper-harris.site. See also our terms of service.