Privacy policy

Who operates Whiff

Whiff is operated by Spain Powell, a sole proprietor. Questions about this policy or your information can be sent to support@whiffsports.com.

What we collect

We collect your email address for sign-in, your display name for pool standings and invites, your first and last name so your pool's commissioner can identify you, and your date of birth to enforce our 13+ age floor. Your first and last name are shown, along with your favorite teams and your placements in competitions you share with them, to other members of a pool you belong to — never outside pools you're actually in, and never on a public invite link. We also store picks, pool activity, messages you choose to post, and historical records a commissioner chooses to import. When you share a pool card, we also store a snapshot of what that card displays, described under Sharing pool cards. An imported record can contain the display name used in an old spreadsheet, results, and trophies. We store an account link only after the invited person privately reviews and confirms the one record mapped to them. We also store—only after you enable notifications—an app notification token and device timezone. If you send in-app feedback, we email the subject, message, and any photo you attach to our support inbox; see Feedback below. When the website or app fails unexpectedly, we may collect a stripped-down error report as described under Diagnostics.

Notifications

If you opt in, Whiff sends your notification token and notification content to Expo, which forwards notifications through Apple Push Notification service or Firebase Cloud Messaging. We use your device timezone to avoid quiet hours. You can mute reminder, result, or mention notifications in the app, disable permission in your device settings, or revoke the device token by signing out.

Email

Whiff sends account email — sign-in links, and unless you opt out, pick-reminder digests and kickoff-change notices for games you have not yet picked — through Resend, our email delivery provider. Reminder and kickoff-change emails include only your own pool's name and public game kickoff times; they never include picks, scores, or other members' information. Account settings let you control reminder emails and kickoff-change emails separately. Every digest includes a one-click link to stop receiving pick-reminder emails.

Sharing invites

When you invite someone, Whiff builds an invite link and a shareable image. Anyone who has the link can see your display name, your pool or competition name, its member count, and when picks lock — that is what makes an invite readable to the person you sent it to, and it is visible without a Whiff account. If you post that link or image somewhere public, or the person you sent it to forwards it, everyone who sees it sees the same information. Messaging apps and social networks also generate their own previews of the link, which they may cache on their servers. Invite pages ask search engines not to index them, but an image you have already posted somewhere else is outside our control and cannot be recalled. The link never exposes picks, standings, other members' names, or anyone's email. In the app, you can also join by scanning a QR code with your camera instead of typing the invite code — the camera is used only to read the code on your device, and no photo, video, or camera frame is ever stored or sent to us.

Sharing pool cards

Whiff can turn a week’s results, a champion, a record, your own pick sheet, or a season recap into an image or a short video you can post. Making one saves a snapshot of what that card shows — the pool or competition name, the members named on it, and their results — and puts it at a private web address containing a long random token nobody can guess. Anyone holding that address can open the picture without a Whiff account; that is what makes it postable. Share addresses are disallowed in our robots file so they do not become search results, but a card you post publicly, or that someone forwards, is readable by everyone who sees it, and messaging apps and social networks keep their own cached copies. No card reveals another member’s pick before it locks: you can publish your own sheet early if you choose, and a sheet for anyone else can only be made once every game in that slate has locked. The cards Whiff publishes from its own social accounts are cross-pool totals and never name a member.

A snapshot is deliberately frozen, so a card you already posted does not change under you later. Account deletion is the exception: when you delete your account — from the website or from the app — we rewrite your display name to “Departed member” inside the stored cards we can still tie to you: cards you made, cards about you, and cards from any pool you belong to.

A rewrite is not an erasure, though, and four limits are worth stating plainly. Card images are cached, so there is a short lag: the rewritten card reaches our own share addresses within a few minutes, and a short video within a day, while a browser or messaging app that already fetched a picture can show the old one a little longer. A picture already downloaded, forwarded, or copied into someone else’s post is outside our control entirely and cannot be recalled. We rewrite the display name your account has at the moment you delete it, not a different name you used earlier and changed, because we do not keep a history of your past names to search for. And two traces are left on purpose: the two-character initials on a squares board stay, since members share initials and a square has no room for anything else, and a pool that merely contains your name in its own keeps it, because the pool is not the one leaving — though a pool named exactly after you loses that name along with you.

Claiming imported history

A commissioner can send a single-use pool invite that maps to one imported historical record. The claim link is private to the account that accepts that invite: it does not reveal the pool’s other imported names or mappings. Nothing is linked to that account until the recipient confirms the preview. The commissioner can revoke an unconfirmed link. After confirmation, the member can permanently delete that imported record, its trophies, and its account link.

Feedback

If you send us feedback — on the website or in the app — the subject, message, and any photo you attach are emailed directly to support@whiffsports.com through Resend, along with your account email so we can reply. We do not store your feedback in Whiff’s database — it lives only in that inbox.

Diagnostics

Whiff uses Sentry to receive error reports when the website, API, or app fails unexpectedly. A report can include exception details, code location, route metadata, app release, environment, and SDK metadata. Across platforms, Whiff disables default PII collection and removes user fields, request headers, cookies, and bodies. The website applies a stricter allowlist that also removes the exception message, complete request and page or capability URL, breadcrumbs, device and browser context, transaction, arbitrary tags, and extra application state. Performance tracing, profiling, session replay, Sentry logs, and automatic session tracking are disabled. Sentry necessarily receives the network request used to deliver the report; Whiff requires Sentry's IP-storage prevention control before enabling reporting in an environment. These reports are used only to diagnose reliability problems and are not joined to member profiles or used for advertising.

How we use it

We use this information to authenticate your account, operate pools, show standings, send pool reminders and kickoff-change notices, and keep an audit trail when a commissioner changes pool settings. We do not sell personal information.

Subscriptions and billing

If you subscribe to Whiff+, we use Stripe to process your payment. Stripe receives your payment details (such as your card number), your email address, and billing information directly — Whiff never receives, sees, or stores your full card number. We store only that you have a Stripe customer record, your subscription's status, the price and billing interval you chose, and the disclosure and consent record for that purchase. You can view or change your payment method, download receipts, and cancel your subscription at any time through the self-serve Manage Subscription link on the Whiff+ page, which opens Stripe’s Billing Portal — no support request is required. See Stripe's own privacy policy for how Stripe handles payment data it processes directly.

Advertising

When advertising is enabled, Whiff uses Google AdSense to show non-personalized ads on standings. Google and its advertising partners may process cookies, browser or device information, IP-derived location, and ad interactions to deliver, limit, secure, and measure those ads. Where consent is required, the advertising request remains subject to the choices shown in our consent message. Learn more in Google’s information for sites that use its services.

Your choices

You can delete your account from Account Settings. Deletion removes or anonymizes your personal information, revokes your active sessions, and permanently removes imported historical records you claimed, including their trophies, claim links, and identifying audit details. If you have a Whiff+ subscription, deletion also removes our record of your Stripe customer linkage and your purchase-consent history, and cancels any active Stripe subscription immediately as part of that same process — you do not need to cancel it separately first, and you will not be billed again. Account deletion always completes even if that cancellation step cannot reach Stripe at that exact moment; in the rare case that happens, contact support@whiffsports.com so we can cancel it manually. Your name stops appearing on invite pages, invite images, and the pool cards described under Sharing pool cards, though the four limits described in that section apply — cached copies, ours and other services’, can outlast it, and so can anything already posted elsewhere. We preserve only the de-identified standings and audit records needed for pool integrity. If you cannot access your account or the deletion tool fails, contact support@whiffsports.com.

Questions

Contact support@whiffsports.com.