Privacy notice

1. Who we are

ThunderRiver Tech LLC, registered in Texas, United States, operates Sabi and is responsible for the personal information described here. The product owners are Andrew Bolaji and Bolu Akinwande. Andrew Bolaji is the Privacy Lead. For privacy questions, requests, or complaints, email support@sabi.football.

This private beta is intended only for people aged 18 or older and located in the United Kingdom, the United States, or Canada. Please do not use the service if you are under 18 or outside those locations.

2. Information we handle

• Account information: a Google account identifier, display name, and a verified email address when the email feature is available. We do not receive your Google password.
• Game information: private league names, invitations, join decisions, memberships, ownership changes, predictions, scores, and dated league activity.
• Integrity records: accepted and rejected prediction attempts, lock times, removal reasons, result evidence, and other records needed to explain a league table.
• Feedback: the message and category you submit, plus whether you agreed to a follow-up.
• Technical information: necessary sign-in cookies, short-lived sign-in links, security logs, and request details made available by our hosting and authentication providers.

We also use football fixtures, squads, and results from data providers. That sports data does not identify you.

Where it comes from

You provide league, prediction, feedback, and support information directly. Google provides the account information used for Google sign-in. Other league members provide invitations, join decisions, removal reasons, and ownership actions involving their league. Our application and service providers create technical, delivery, and integrity records as the service operates.

What is required

A Google account identifier and display name are required to create an account and use authenticated beta features. Without them, we cannot sign you in or connect your activity to the correct account. League details and predictions are required only when you choose to create, join, or play in a league. Feedback, follow-up permission, and optional email sign-in are optional.

3. How we use information

We use personal information to:

• create and secure your account;
• run private leagues, save predictions, calculate points, and show standings;
• keep predictions private until their server-set deadline;
• protect fair play and preserve a reliable record when membership or fixtures change;
• send a sign-in link or service alert when that feature is enabled;
• respond to feedback and support requests; and
• investigate abuse, protect the service, and meet legal duties.

United Kingdom lawful bases

• Contract: account, league, prediction, scoring, and standings information needed to provide the beta you ask to use.
• Legitimate interests: limited technical, security, and integrity records needed to prevent abuse, enforce deadlines, explain scores, provide user support, troubleshoot failures, and keep the game fair.
• Consent: optional follow-up and optional email sign-in where we ask you to make that choice. You may withdraw consent without changing lawful processing that already occurred.
• Legal obligation: information we must preserve, use, or disclose to meet an applicable legal duty or respond to a lawful request.

Where Canadian privacy law requires consent, we use information for the purposes explained here and honor applicable choices to withdraw that consent.

Scoring is automatic under published game rules. It does not make legal, employment, credit, insurance, or similarly significant decisions about you. League admission and removal decisions are made by people in that league, not by an automated profile.

4. Sharing and providers

Other members of your private league can see your display name, standings, and predictions after the relevant deadline. Current members can see the shared league record. A former member can see only the private historical record needed to explain their own participation, not later private activity.

We use a small set of service providers:

• Google for the main sign-in path;
• Vercel to host and deliver the web application;
• Neon to host the application database;
• Resend for approved service and sign-in email; and
• football-data providers for fixtures, squads, and results.

We use providers only for the services described above. They also handle information under their own legal duties, privacy notices, and service terms. We may disclose information when required by law, to protect a person or the service, or as part of a business transfer with appropriate safeguards.

We do not sell personal information. The application code does not include third-party advertising or behavior-tracking analytics.

5. How long we keep information

We use these criteria rather than keeping every item forever:

• account and active league information stays while it is needed to provide the beta;
• email sign-in links expire after 15 minutes and cannot be reused;
• feedback stays while we review, respond to, and learn from it;
• security and delivery records stay only as long as needed to investigate and operate safely; and
• prediction receipts, scores, settlement evidence, and dated league activity may stay longer because changing shared history can make a table unfair or remove evidence needed by other members.

We review retention when an account closes, the beta ends, a provider contract changes, or a legal duty requires a different period. We remove or de-identify information that is no longer needed when it is feasible and lawful to do so.

6. Your choices and rights

Depending on where you live, you may ask to access, correct, delete, restrict, or receive a copy of your personal information. You may also object to some uses or withdraw consent where consent is the basis. The Account page lets an eligible user turn optional email sign-in off.

To close your account or make a privacy request, email support@sabi.football from the address connected to your account. We may need to verify your identity. We will explain any record we must retain and why. Closing an account does not rewrite final game results or erase another member's record. Where a shared integrity record must remain, we will assess whether its personal details can be removed or de-identified without making the record misleading.

You may challenge our privacy compliance through the same address. The Privacy Leadreviews the request, coordinates the response, and records the decision without putting the request or its personal details in the public code repository.

We encourage you to contact us first. UK residents may also complain to the Information Commissioner's Office. Canadian residents may contact the Office of the Privacy Commissioner of Canada. People in the United States may have additional state rights and may contact their state regulator.

7. Security and international processing

We use access controls, server-side authorization, protected credentials, encrypted connections, and separate test environments. No online service can promise perfect security. Please tell us promptly if you believe an account or invite has been misused.

Our owners and providers may process information outside your country, including in the United States. Privacy protections can differ across borders. Where a transfer needs a legal safeguard, we must confirm an appropriate contractual or other lawful mechanism before opening that regional beta.

8. Changes to this notice

We may update this notice as the beta changes. We will change the effective date and provide a clear notice when a change materially affects how we use personal information. See our Terms for the rules that apply to the service.