Privacy Policy

Last updated July 28, 2026

Heads Up Fantasy is a head-to-head fantasy sports game you play with friends. This policy explains exactly what we store, why, and what you can do about it. It is deliberately short, because we collect very little.

What we collect

• Your account — username, email address, and a one-way cryptographic hash of your password. We never store your actual password and cannot recover it.
• How you play — duels, drafts, picks, and results.
• Your friends and groups — who you're connected to, and the private groups you sort them into. Group names are visible only to you.
• Activity time — a timestamp of when you last used the app, so friends can see whether you're around.
• Push token — an anonymous device identifier from Apple or Google, only if you allow notifications.

What we do NOT collect

• No payment or financial information. There is nothing to buy, stake, or win — duels are played for the record.
• No location data.
• No contacts, photos, microphone, or camera access.
• No advertising identifiers. We do not sell or share your data, and there are no third-party ad or tracking networks in the app.

Who else touches your data

Only the services required to run the app: our hosting provider and database, Apple's and Google's push notification services (for notifications you opted into), and an email provider used solely to send verification and password-reset codes. Sports statistics come from public feeds and contain no information about you.

Your control

You can delete your account at any time from Settings → Delete account. Deletion erases your username, email, password, and push token, removes your friendships and private groups, and cancels any live duels. Finished duels remain in your opponents' history under an anonymous name, because those results are their records too.

You can turn off notifications at any time in your device settings.

Children

Heads Up Fantasy is not directed to children under 13, and we do not knowingly collect information from them.

Security

All traffic is encrypted in transit. Passwords are hashed with bcrypt. Login sessions expire after prolonged inactivity.

Contact

Questions about your data, or want a copy of it? Email headsupfantasy.help@gmail.com.