Privacy Policy

1. Who we are

Crunch Time is a web app at crunchtimealerts.com (or another address we serve it from) that sends you one alert when a game of a team you follow is about to end. "We" and "us" in this policy mean Jason McDermott, who runs Crunch Time as an individual.

This policy explains what information we collect when you use the app, why, who else handles it, how long we keep it, and what you can do about it. It covers the website, the version of the app you add to your home screen, the alerts we send to your devices and the emails we send to your address.

Questions go to jasonamcdermott@gmail.com. Our Terms of Service are the rules for using the app.

2. What we collect

We collect only what the app needs to work. Here is all of it.

Your email address

You type it to sign in. We store it in lowercase as the name of your account. Your account is created the first time you verify the address with the code or the link we email you, and that moment is also when you accepted the terms. We never ask for a password.

Sign-in records

Each time you ask for a code, we create a record with your address and a hashed version of the code and link we emailed you (a hash cannot be turned back into the code). The record expires after 15 minutes and is single use. Once you're signed in, we keep a session record for that device: a hashed token (we never store the token itself), the browser's user agent string (the browser's name and version and the kind of device), when the session was created and when it was last used. A session lasts 90 days from its last use.

Your settings

The teams you follow and when you followed each of them, your alert timing (5, 10 or 15 minutes) and when you last changed it.

Your devices

When you turn alerts on, your browser creates a push subscription with its push service (see section 5). For each device we store the subscription's address (a URL that identifies this browser on this device to its push service), the two encryption keys your browser generated for it, the browser's user agent string, a platform label we derive from it (iPhone or iPad, Android, or other), when the device was turned on and last synced, and, if the push service later told us the subscription was gone, when that happened.

Your alert history

For every alert we send you, we keep the game, your timing at the time, the minutes shown, the alert's title, body and link, and when it was created, plus a delivery log for each of your devices: the attempt number, whether it was sent or failed, and the error text when it failed. You see the alerts on the Alerts screen; the delivery log is internal.

Onboarding steps

We record which of three steps you reached (signed up, saw the notifications screen, enabled alerts), with the platform label and the time. We use these counts to see where people get stuck. This is the one record that survives account deletion, with your account id removed (see section 8).

Technical logs

Our servers write a log line when something happens: a sign-in, a follow, an alert sent, an error. A line identifies you only by your account's random id; it never carries your email address, a code, a token, a device address or the text of an alert. When something breaks, our servers also send an error report to an error-tracking service (see section 4): the page or background job that failed, the error's name and the lines of our code it passed through, our event names and the same random ids. Your email address, codes, tokens, cookie values and the text of alerts are removed before a report leaves our servers. Our hosting providers also keep standard request logs, which include your IP address, your browser's user agent and the addresses of the pages requested; when you tap a sign-in link, that address includes your email and a one-time sign-in token (see section 7).

What we don't collect: no name, no phone number, no password, no payment details, no location, no contacts and no advertising identifiers. We read nothing on your phone beyond what your browser sends with each request.

3. How we use it

• To sign you in and keep you signed in (your email address, the sign-in records and the sessions).
• To decide when to alert you and to send the alert (your teams, your timing, your devices and the live game data).
• To show you your scoreboard, your teams and your recent alerts.
• To make sure we never send the same alert twice, and to stop sending to a device that is gone.
• To email you: the sign-in email you asked for, and occasionally an email about Crunch Time itself, such as a new feature, a change to this policy or the terms, or a problem with the service. Never on behalf of anyone else. You can opt out of these product emails at any time by emailing us; sign-in emails continue as long as you sign in.
• To keep the service running and secure: logs for debugging and abuse prevention, and the onboarding counts to improve the setup flow.

We don't use your information for advertising, we don't build profiles, and we make no automated decision about you other than whether it is time for your alert.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you (everything the app does for you), our legitimate interests (keeping the service secure and improving the setup flow), and your consent (push notifications on each device, which you can withdraw at any time by turning that device off).

4. Who else handles it

We run the app on services operated by other companies. They process your information on our behalf, only to provide their service to us, under their own security commitments. We don't sell your information, rent it, or share it for marketing.

Vercel (hosting, United States)

Serves the app and runs the sign-in and settings code. Its request logs see your IP address, your browser's user agent and the pages you request.

Neon (database, United States)

Stores everything described in section 2 except the logs.

Railway (the alert worker, United States)

Runs the server that watches games and sends alerts. It reads your teams, your timing and your devices and writes your alert history. Its logs hold account ids, never addresses.

Resend (email, United States)

Sends the sign-in email and any product email. It processes your address and the message, and keeps a copy of each sent email for 30 days.

Sentry (error tracking, United States)

Receives a report when our servers hit an error: the page or background job that failed, the error's name and the lines of our code it passed through, our event names and our random ids (your account id, a device record id, a game id). Your email address, sign-in codes and tokens, cookie values and the text of alerts are removed before a report is sent, so Sentry never sees them. It keeps error reports for 30 days.

Better Stack (uptime monitoring, European Union)

Watches that the alert worker and the website are up: the worker sends it a signal after each check of the live games, and it loads our landing page every few minutes. It receives nothing about you.

Your browser's push service

Apple for Safari and the installed app on iPhone and iPad, Google for Chrome and most other browsers, Mozilla for Firefox, Microsoft for Edge on Windows. It relays each alert to your device. The alert is encrypted on our server with the keys your browser generated, so the push service cannot read it; it sees that a message went to your subscription, its size and its timing.

A third-party sports data provider

Schedules, clocks, scores and broadcast information come from a sports data feed. Our server makes those requests, not your phone, and we send the provider nothing about you. The team logos shown in the app are loaded by your browser from that provider's content delivery network, which, like any image host, receives your IP address and browser details with each request.

Beyond that, we disclose information only when the law requires it, when it is needed to protect Crunch Time or its users, or if Crunch Time changes hands, in which case we would tell you first.

5. Push notifications

Alerts are push notifications from your browser. We never ask for notification permission until you tap "Enable notifications"; the prompt you then see is your browser's. Turning alerts on stores a device record (section 2), and that record is what we send to.

You can stop alerts on a device at any time: tap "Turn off on this device" on the Alerts or Settings screen, which removes its record. If you instead revoke the permission in your browser or phone settings, or remove the app from your home screen, the next alert we try to send to that device fails, the push service reports the subscription gone, and we mark the device as gone and stop sending to it. Each device is separate: turning one off does not affect the others.

Signing out does not turn alerts off on that device: its record and the browser's subscription stay until you turn it off or someone else signs in there. Tap "Turn off on this device" first if you want alerts to stop.

An alert says how many minutes are left and which teams are playing, never the score. Tapping it opens a page of our app and nothing else.

6. Cookies and storage on your device

We use only what is needed to sign you in and keep you signed in. No advertising or analytics cookies, and no third-party cookies.

login_request

Set when you ask for a code. It holds your address and half of the sign-in secret, so the 6-digit code works only in the browser that asked. It lasts 15 minutes, or until you sign in or tap "Use a different address".

The session cookie

Keeps you signed in on this device for 90 days, extended each day you use the app. Signing out removes it. Two short-lived cookies protect the sign-in form while you use it (a token against forged requests and the address to return to).

Local storage

A small record in this browser with two preferences: whether you dismissed the install banner, and when you last opened the alert history, for the unread marker. It stays in the browser and is never sent to us. Deleting your account from this browser clears it.

A service worker

The small part of the app your browser keeps so it can receive push messages and open the alert you tap. It stores no pages and watches nothing you do.

Do Not Track. We don't track you across other websites or apps, and no third party tracks you through Crunch Time. A "Do Not Track" or Global Privacy Control signal from your browser changes nothing, because there is nothing to turn off: we treat everyone that way.

7. How long we keep it

Your account, settings and alert history

Until you delete your account.

Sign-in records

A record expires 15 minutes after you ask for a code. The next time a code is requested for your address, its records older than an hour are removed; we may also clear old records in bulk.

Sessions

A session stops working 90 days after the device last used the app. Its record is removed when you sign out on that device or delete your account; we may also clear expired records in bulk.

Device records

Until you turn the device off, delete your account, or someone else signs in on that device, which moves the device to their account. A device whose subscription the push service reported gone is listed in Settings as dropped off and keeps its record, marked as gone, until you re-enable alerts on that device, remove it from Settings, or delete your account; nothing is sent to it in the meantime.

Onboarding steps

Indefinitely, as counts. Your account id is removed from them when you delete your account.

Server logs

Our own log lines name only your random account id. Our hosting providers' request logs also hold your IP address, your browser's user agent and the addresses requested, which for a tapped sign-in link include your email and a token that is dead after 15 minutes or one use. They keep those logs briefly: up to a day for the web app, and up to 90 days for the alert worker.

Error reports

Sentry keeps error reports for 30 days. A report can carry your random account id, never your address.

Emails

Resend keeps a copy of each email it sent you for 30 days.

Backups

Our database provider keeps a short rolling history for restoring the database after a mistake (hours, today). Deleted data leaves it within 7 days at most.

8. Deleting your account

Open Settings and tap "Delete account". One step removes your account and email address, the teams you follow, your alert timing, every device, every session (you are signed out everywhere) and your entire alert history with its delivery log, along with any pending sign-in code for your address. There is no grace period and no undo. If you sign up again with the same address later, you start from scratch.

What remains afterwards:

• The onboarding step counts, with your account id removed. They say that someone reached a step, on a platform, at a time, and nothing about who.
• Log lines that name a random account id, until our providers' retention expires (section 7). After deletion the id matches nothing.
• Error reports at Sentry that name a random account id, for up to 30 days after they were sent.
• Copies of the sign-in emails at Resend, for up to 30 days after they were sent.
• The database's restore history, for up to 7 days.
• On your other devices, the browser's own push subscription. We no longer know its address, and only our key could send to it, so nothing can reach it. Removing the app from that device, or revoking its notification permission, clears it.
• On the device you deleted from, the browser's notification permission and the app's service worker. Both do nothing without a subscription, and removing the app clears them.

9. Your rights and choices

Wherever you live, you can:

• See your data. Most of what we hold about you is on the app's screens: your email in Settings, your teams, your alert timing, whether alerts are on for the device in your hand, and your recent alerts. Email us and we will send you a complete copy, device and session records included.
• Correct it. Change your teams and your timing at any time in the app. Your email address is the name of your account, so to change it, sign up with the new address and delete the old account.
• Delete it. Settings → Delete account, or email us.
• Say no to messages. Turn alerts off per device (section 5). Opt out of product emails by emailing us.

If you live in California, the European Economic Area, the United Kingdom or another place with a privacy law, the choices above are how you exercise your rights of access, correction, deletion and portability, objection and restriction, and withdrawal of consent. We don't sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of there. You can also complain to your local data protection authority. We will never treat you differently for exercising a right.

To make a request, email jasonamcdermott@gmail.com from the address on your account; that is how we know it is you. We answer within 30 days.

10. Children

Crunch Time is not for children under 13, and we don't knowingly collect information from anyone under 13. If you believe a child under 13 has an account, email us and we will delete it.

11. Security

Every connection to Crunch Time uses TLS. Sign-in codes and session tokens are stored only as hashes. Alerts are encrypted for your device with keys your browser generated. There are no passwords to steal. Access to the systems is limited to the people who run Crunch Time. No service is perfectly secure, and if a security incident affects your information we will tell you as the law requires.

12. Where your data lives

Our providers store and process your information in the United States. If you use Crunch Time from somewhere else, your information is transferred to and processed in the United States, whose laws may differ from those where you live. Crunch Time is made for fans of US leagues, and its broadcast information covers the United States only.

13. Changes to this policy

When we change this policy, we post the new version here with a new effective date. If a change is material, we also email the address on your account before it takes effect. The date at the top tells you when the version you are reading took effect.

14. Contact

Email jasonamcdermott@gmail.com. Our Terms of Service are the rules for using the app.