Privacy Policy

Data Controller

ChampSheep is operated by Castillo Shell, LLC, a Delaware limited liability company, registered at 131 Continental Dr, Suite 305, Newark, DE 19713, United States. For privacy questions, contact us at hello@champsheep.com.

Information We Collect

When you create an account we collect your email address and a username you choose. We store the match predictions you submit, the leagues you join or create, the points you earn, and any badges you unlock.

If you sign in with Google, we receive your name, email, and profile picture from your Google account.

Our servers automatically log your IP address, user agent, and request metadata for security and abuse prevention. These logs are retained for 30 days.

If you buy a subscription, Polar provides us with billing identifiers, your selected plan, subscription status, and transaction or adjustment history. ChampSheep does not receive or store your full payment-card number.

When you use match chat, we store the text of the messages you send, which room (a league's room or the Global room) and match you sent them in, and when. If you report a message we store your report, the reason you chose and any detail you add; if you block someone we store that block.

Legal Basis for Processing (GDPR)

We process your data on the following legal bases under GDPR Article 6:

• Contract — to provide the prediction service you signed up for (account, predictions, leaderboards, leagues).
• Legitimate interest — to keep the service secure, prevent abuse, and measure aggregate usage with cookieless analytics.
• Legal obligation — to comply with applicable laws and respond to lawful requests.
• Consent — for any optional processing where we explicitly ask. You can withdraw consent at any time.

How We Use Your Information

• To create and manage your account
• To save and display your predictions
• To calculate scores and show leaderboards
• To send important account-related emails (sign-in links, email-change verifications)
• To prevent fraud, spam, and abuse
• To improve the service through aggregated, anonymous usage statistics
• To measure our advertising and reach similar audiences using advertising pixels (Meta, X, Google Ads, Reddit)
• To manage paid subscriptions, provide subscriber benefits, prevent billing fraud, and resolve payment or refund support requests
• To run match chat and to moderate it — screening messages before they are posted, acting on reports, and keeping a record of moderation decisions

Data Sharing

Your username, avatar, predictions, and points are visible to other users on leaderboards and within leagues you join. We do not sell, rent, or trade your personal information.

A message you send in a league's chat room is visible to the members of that league; a message in the Global room is visible to everyone in that tournament. ChampSheep can read chat messages to moderate them, and so can that league's creator and admins for their own league's rooms — they see the message and its author's username, never your email, IP address or location. When we remove a message we tell its author what was removed and why, and we tell whoever reported it what we decided.

Service Providers and Payment Partner

We rely on the following third parties to operate ChampSheep:

• Plausible Analytics (EU-hosted, cookieless) — aggregate usage statistics, no IP storage.
• Google LLC — Google Sign-In (only if you choose this method).
• Amazon Web Services (US East, Northern Virginia) — application hosting, database, and encrypted backups.
• flagcdn.com — country flag images displayed on match cards.
• Meta Platforms, Inc. (Meta/Facebook Pixel) — measures ad performance and builds audiences. Loads only with your consent in the EU/EEA and UK.
• X Corp. (X/Twitter Pixel) — advertising conversion measurement. Loads only with your consent in the EU/EEA and UK.
• Google LLC (Google Ads tag, including Enhanced Conversions) — advertising conversion measurement; your email is hashed in your browser before it is sent. Loads only with your consent in the EU/EEA and UK.
• Reddit, Inc. (Reddit Pixel) — advertising conversion measurement. Loads only with your consent in the EU/EEA and UK.
• Resend, Inc. — delivery of account and product emails.
• Polar — merchant of record for paid subscriptions. Polar is an independent controller for the sale itself: it decides how payment, tax, invoicing, and fraud prevention are carried out, under its own privacy notice. It is not our processor for that processing. We receive limited billing evidence back from it, described above.

Our processors may use data only to provide the services described and only on our instructions. Polar is the exception: for the sale it acts as an independent controller in its own right, not on our instructions.

International Data Transfers

ChampSheep is operated from the United States, and our servers are in the United States. Because we offer our service to people in the EEA and the UK, the GDPR and UK GDPR apply directly to our processing wherever it happens, and the rights described in this policy apply to you in full.

When we pass data to a service provider outside your country, we rely on the European Commission's Standard Contractual Clauses together with the UK addendum, and on additional technical and organisational safeguards. Where a provider is itself certified under the EU–US Data Privacy Framework, transfers to that provider may instead rely on that adequacy decision.

How Long We Keep Your Data

• Account data — until you delete your account, except for the limited billing evidence described below.
• When you delete your account, account data is removed from live systems. Residual encrypted backup copies may persist for up to four months and are then destroyed through backup rotation. Backups are not used to restore deleted accounts; after a disaster restore, pending deletions are reapplied before the service returns.
• Server logs — 30 days.
• Magic-link tokens and session tokens — until they expire (typically minutes to weeks).
• Pseudonymized subscription, transaction, accepted-terms, and aggregate usage evidence — normally up to 18 months after the later of subscription end or the last transaction, with a narrowly scoped extension of up to 90 days if a specific billing claim remains unresolved.
• Our own business records — the payouts we receive from our payment provider, which are not linked to individual subscribers — are kept for as long as tax and company law require.
• Chat messages — 90 days, after which they are deleted outright along with any reports attached to them. If you delete your own message it stops being visible immediately. When you delete your account, your messages are detached from you and their text is removed, so the conversation keeps its shape without keeping your words.

Local Storage on Your Device

We store a sign-in token, a cache of match data, and small UI preferences in your browser's local storage so the app works offline. Outside the EU/EEA and UK, our advertising partners (Meta, X, Google, Reddit) may also set cookies; in the EU/EEA and UK these are used only with your consent. Local data is cleared when you sign out or clear your browser storage.

Your Rights

Depending on where you live, you have some or all of the following rights:

• Access — request a copy of the data we hold about you.
• Portability — download your data in a structured, machine-readable format (use Profile → Edit → Download my data).
• Rectification — correct inaccurate information from your profile page.
• Erasure — delete your account and associated data (Profile → Edit → Delete my account), subject to the limited legal retention described above.
• Restriction — ask us to limit how we process your data.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — for any consent-based processing.
• Lodge a complaint — with your local data-protection authority.

To exercise any right not available in-app, email hello@champsheep.com. We respond within 30 days.

Children

ChampSheep is not directed at children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal data from children under 13. Some EU member states set a higher age — up to 16 — below which a child cannot consent to optional processing such as advertising cookies; we do not rely on consent for the game itself, which we provide under our contract with you. If you believe a child has an account without the involvement of a parent or guardian, contact us at hello@champsheep.com and we will remove it.

California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to know what personal information we collect, use, and disclose.
• Right to delete your personal information.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising these rights.

Categories of personal information we collect: identifiers (email, username, IP, device IDs), internet activity (predictions, page views), inferences (your engagement level). Sources: directly from you, from Google when you use Google Sign-In, from your device. We use advertising pixels (Meta, X, Google Ads, Reddit); outside the EEA/UK they load by default, and in the EEA/UK only with your consent — these platforms receive standard request data (IP, user agent, page URL) and advertising identifiers.

We do not sell your personal information for money. We do use advertising pixels (Meta, X, Google Ads, Reddit) that disclose limited data to those platforms for advertising measurement and audience building — which California law calls "sharing" for cross-context behavioural advertising, even though no money changes hands. To opt out: turn on Global Privacy Control in your browser, which we honour automatically everywhere, or use Cookie settings at the bottom of any page. You can also opt out of personalised advertising in each platform's own ad settings.

Brazilian Residents (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies to our processing of your data. You have rights of access, correction, anonymization, portability, deletion, and information about who we share data with. Our controller details are in the Data Controller section above. Email hello@champsheep.com — our published channel for data-protection requests — to exercise any of these rights or to raise a concern, and you may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

UK Residents (UK GDPR)

If you are in the United Kingdom, the UK GDPR and Data Protection Act 2018 apply. You have the same rights as EEA users, and you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Right to Lodge a Complaint

If you believe we have not handled your data properly, you may complain to the data-protection authority where you live, work, or where the alleged infringement happened. The European Data Protection Board lists national authorities at edpb.europa.eu.

Data Security

We use industry-standard measures including TLS in transit, encrypted databases at rest, hashed credentials, and least-privilege access controls. No system is 100% secure — if we ever discover a breach affecting your data we will notify you and the relevant authority within 72 hours.

Sign-in Security Logging

When you sign in, we record the approximate location (country and first-level region, e.g. "US-CA") derived from your IP address. We do not store the IP itself. This data is used solely for account-security and fraud-prevention purposes — e.g. flagging a sign-in from an unexpected country. The legal basis is our legitimate interest under GDPR Art. 6(1)(f). Records are kept for 12 months and are deleted automatically when you delete your account.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email. The "last updated" date below reflects the most recent revision.

Contact Us

Questions about this privacy policy? Contact us at hello@champsheep.com.