Privacy

What you give us

• Your email address. Used to confirm your account and to sign you in. It is never shown to another player.
• Your password. Stored by Supabase, our database provider, as a one-way hash. Nobody at The Slate can read it and no page ever displays it.
• Your display name. The name other people see. It does not have to be your real name.

What you create by using it

• The pools you build or join, and when you joined each one.
• The slate of games a pool you built plays.
• Your picks, and when you last changed each one.
• If a pool has an access key, a one-way hash of that key. The key itself is never stored, so nobody can look it up.

What is collected automatically

• A sign-in cookie. Set by Supabase, with a name beginning “sb-”. It keeps you signed in and is refreshed as you move around the site. Deleting it signs you out. It is not used for anything else.
• Server logs. Our host records ordinary web-server request logs — the page requested, the time, and the IP address it came from. They exist to keep the site running and secure.

What is not collected

This list is short on purpose, and it is a description of the software rather than a promise about intentions:

• No analytics of any kind. No page-view tracking, no session recording, no heatmaps.
• No advertising, no ad network, no third-party trackers and no tracking pixels.
• No error-reporting or crash-reporting service.
• No location data.
• No payment details, because there are no payments.
• No phone number, no date of birth, no photo, no address book.
• Nothing about you is sold, rented or shared for anyone else’s marketing, ever.

There is no cookie banner because there is nothing to consent to: the sign-in cookie is the only cookie this site sets, and without it you could not stay signed in. Even the fonts are served from this site rather than from Google, so loading a page here does not tell another company you visited.

Who else holds it

• Supabase — the database and the sign-in system. Everything above is stored there.
• Vercel — hosting. Every request passes through it, so it holds the server logs.
• GitHub — runs the timer that tells our server to go and fetch scores. It receives nothing about you.
• ESPN — where schedules and scores come from. Data travels from ESPN to us and never the other way. Your browser does not contact ESPN.

Our database and hosting are run by companies in the United States, and your data is stored on servers they operate.

What other people can see

• Inside a pool you have joined: your display name, your standing, and — once a game has kicked off — what you picked in it.
• Before a game kicks off, no other player can see your pick. Not the pool admin, not another member. That rule is enforced in the database, not merely hidden on the screen.
• A private pool is invisible to anyone who has not been sent its invite link.
• A public pool is listed on the home page and has a page anyone can read, with or without an account.

Standings on a public pool’s page are visible to anyone, without an account: display name, points and place. So treat your display name and your standing in a public pool as public, and pick a display name you are happy for a stranger to see. Your picks are not part of that — they follow the kickoff rule above, whoever is reading.

One person — the site administrator who operates The Slate — has direct access to the database, because somebody has to be able to fix a wrong score on a Saturday. That access exists to run the product, not to read your picks.

Email we send

Two messages, both sent by Supabase and both only when you do something that asks for one: the confirmation email when you sign up, and a link to set a new password when you ask to reset it. There are no newsletters, no marketing and no game-day reminders. If that ever changes it will be something you switch on, not something switched on for you.

How long it is kept, and how to get rid of it

Your data is kept for as long as you have an account. There is no delete button in the product yet. Ask, and your account will be deleted — which removes your profile, your pool memberships and your picks. Ask, and you can also have a copy of what is stored about you.

One exception: a pool you built that other people have joined is hidden rather than erased, because erasing it would destroy their picks along with yours.

There is no contact address on this page yet. One goes here before the private beta opens on 29 August 2026, once PlayTheSlate.com is connected. The Slate has not opened to players yet.

Children

The Slate is not for anyone under 13, and nothing is knowingly collected from a child under 13. If we find that an account belongs to one, it will be deleted. Players under 18 need a parent or guardian’s permission, as the Terms of Use say.

Changes to this page

When this page changes, the date at the top changes with it. If a change materially affects what is collected or who can see it, we will say so on the site before it takes effect.