Privacy Policy

Welcome to DYK Ball ("we," "us," or "our"). DYK Ball is a daily basketball trivia game that tests your knowledge of NBA history. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

DYK Ball is operated by BBALL DISTRICT LLC, an Ohio limited liability company based in Perrysburg, Ohio.

By creating an account or using DYK Ball, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

2.1 Account Information (required)

• Email address — used for authentication, password resets, and account recovery.
• Username — your unique identifier, chosen at registration.
• Password — stored as a salted, cryptographic hash by our authentication provider; we never store or see your plaintext password.

2.2 Profile Information (optional)

• Display name
• Full name
• Bio (up to 160 characters)
• Favorite NBA team
• Avatar image (selected from a preset or uploaded by you)

2.3 Gameplay Data

• Daily Lineup picks (which NBA player and season you selected for each prompt)
• Percentile scores, efficiency ratings, streaks, and perfect-pick counts
• DYK Rating (Ball Knowledge rating based on your last 30 games)

2.4 Social & Competitive Data

• Friend codes, friend requests, and friendship status (accepted/pending)
• Block list (which users you have blocked)
• Faceoff match history — including picks, scores, win/loss/draw records, and ELO ratings

2.5 User-Generated Content

• Suggested prompts (submitted by Ultimate members for admin review)
• Support requests, including account, billing, privacy, bug, and feedback submissions

2.6 Technical Data

• Session cookies— Supabase's authentication library uses cookies containing session credentials to maintain and refresh your authenticated session. These are strictly necessary for the site to function and are not used for tracking or advertising.
• Server logs — our hosting provider may automatically collect IP addresses, browser type, operating system, and request timestamps. This data is used solely for security monitoring and debugging.

2.7 What We Do NOT Collect

• We do not use advertising or analytics tracking cookies.
• We do not use third-party tracking pixels or beacons.
• We do not collect payment card information directly. DYK Ball Ultimate payments are processed by Stripe, a third-party payment processor. Your card details are submitted directly to Stripe and are not stored on our servers.

• To operate the game — calculate scores, track your streak and rating, populate leaderboards, and enable daily/historical gameplay.
• To enable social features — facilitate friend connections, 1v1 faceoff challenges, and presence indicators.
• To maintain your account — authenticate you, allow password resets, and manage your profile.
• To improve the service — review support requests and feedback to fix issues and enhance the user experience.
• To ensure fair play — our scoring engine uses cryptographic verification (HMAC tokens) to prevent score manipulation. This process is automated and does not involve human review of your gameplay.

We use the following third-party services:

• Supabase— provides our authentication system, database (PostgreSQL), and real-time communication infrastructure. Your account data, gameplay data, and social connections are stored in Supabase's cloud infrastructure. Supabase's own Privacy Policy applies to their processing of this data.
• NBA API & Basketball-Reference — we use these sources to obtain historical NBA statistical data (player names, team names, and performance statistics). No user data is shared with these services — data flows exclusively from them to us.
• Stripe— processes DYK Ball Ultimate payments and manages subscription billing. Your payment details are submitted directly to Stripe and are not stored on our servers. Stripe's own privacy policy applies to its processing.

We do not sell, rent, or share your personal information with third-party advertisers or data brokers.

DYK Ball uses essential session cookies required for authentication. These cookies:

• Are set by Supabase's authentication library (@supabase/ssr)
• Contain access and refresh credentials used to maintain your session
• Are managed by the authentication library and cleared when you sign out
• Are not used for tracking, advertising, or analytics

We do not currently use advertising, analytics, or social-media cookies. If that changes, we will update this policy and implement any consent controls required by applicable law.

We take security seriously and implement the following measures:

• Row Level Security (RLS) — all database tables enforce policies that restrict data access to authorized users only.
• Service-role isolation — all data writes flow through server-side API routes using a privileged service key; clients can never write directly to sensitive tables.
• Cryptographic score verification — HMAC token signing prevents client-side score manipulation.
• Password hashing — handled by Supabase Auth using bcrypt with automatic salting.
• HTTPS — all data in transit is encrypted via TLS.

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your data for as long as your account is active. Gameplay data (scores, picks, ratings) is retained indefinitely to maintain leaderboard integrity and historical records.

If you delete your account, app data tied to that account is removed from our active database, including your profile, scores, friend connections, faceoff history, and submitted content. We may retain limited payment, transaction, security-log, or backup records where reasonably necessary for legal, tax, fraud-prevention, security, or operational purposes. Account deletion is irreversible.

You have the right to:

• Access your data — your profile, scores, and gameplay history are visible in your Profile and Settings pages.
• Update your data — edit your display name, bio, favorite team, and avatar at any time in Settings.
• Delete your account — you can permanently delete your account and associated app data from Account Settings.
• Request information — contact us for any questions about your data. See the Contact section below.

DYK Ball is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us.

We may update this Privacy Policy from time to time. When we make changes, we will update the "Effective date" at the top of this page. We encourage you to review this page periodically. Your continued use of DYK Ball after changes are posted constitutes your acceptance of the revised policy.

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Operator: BBALL DISTRICT LLC
• Business location: Perrysburg, Ohio
• Support: Submit a Support Request
• Instagram: @dyk.ball