Privacy Policy

• Account information — your email address, username and permanent @handle, and any profile details you provide (display name, bio, profile photo). We do not ask for a phone number. Earlier versions of the app offered an optional phone field at signup; a number given there is kept on your account, never shown to anyone and not used for anything, and you can ask us to delete it at any time.
• Year (and, for some ages, month) of birth — collected at signup to check you are 13 or over. We ask for the month only when the year alone cannot tell. We check them and do not store either.
• Age range — if you live somewhere the law requires it, Apple may share your age range with us when you sign up or open the app — under 13, 13–15, 16–17 or 18+. We keep only that range and whether it was declared by you, a parent, or checked by Apple; never your date of birth. We use it only to follow age laws. If it shows you are under 13, we close the account and delete it.
• Sign-in information — if you sign in with Apple or Google, we receive the name and email (or Apple's private relay email) you choose to share, and from Google your profile photo. We use them to create and secure your account, and the name and photo start out as your public profile name and picture — you can change both at any time.
• Content you create — ratings, reviews, takes, polls, brackets, lists, replies, picks, follows, stories, and other activity on the Service.
• Photos and video — your profile photo, images and video attached to posts, and any images you send in direct messages.
• Messages — the content of direct messages you send to other users.
• Usage data — which search results you open, and which match, player, team, season and profile pages you view, so we can rank what is trending and what to show you. These records are linked to your account. Search taps are deleted after three days, page views after seven days, and player-page taps after a day. When you open someone's story we also record that you viewed it, so the app can show which stories you have already seen. That record is not shown to the story's author, is kept only as long as the story itself (see section 8), and is included in your data export.
• Device & technical data — general device type, operating system and app version, language and region; a push notification token if you turn notifications on; and, on iPhone, a Live Activity token so live scores for teams you follow can appear on your lock screen.
• Crash and performance data — when the app crashes or hits an error, a report of what went wrong (the error, the screen, the device and app version, and your account ID), plus timing data from a sample of sessions. We use it only to find and fix bugs.
• Security data — the IP address of sign-in and verification attempts, kept for up to 24 hours to stop password-guessing and abuse. To rate-limit requests that come without an account (error reports from a signed-out app, waitlist signups, lock-screen live updates) we keep a keyed one-way code derived from your IP address — not the address itself — with a hit count, also for up to 24 hours. When you sign in with your username, we remember that this username signed in successfully from this network as a keyed one-way code (again, never the IP address), for 30 days, so a stranger guessing at your username cannot slow your own sign-ins down. For each signed-in device we also keep the IP address and device type it last used until you sign out of that device or delete your account, so your sessions stay secure. They are included in your data export. If you change your email address and the change is never confirmed from the new inbox, we move the account back and remember the unconfirmed address for one year, so it cannot be switched to again; that record is in your data export too.
• Waitlist — If you join the waitlist on our website, we store your email address, the date you signed up and which page you signed up from, and use it only to tell you when Fulltime launches. It is deleted automatically 30 days after that email, and no later than 12 months after you signed up. You can ask us to remove it at any time through the Contact page.

The app removes the location (GPS) data a phone camera writes into photos and video before they are uploaded, and any upload that still carries it is taken down when it is found. The original file is deleted, and a copy with the location removed is checked like any other upload and kept only on the terms below. In the rare case that the location cannot be removed from a file (one not made by the app), a private copy of the file as uploaded is checked instead, by our moderation provider, and kept on the same terms. We do not collect your location, your contacts, or any advertising identifier, and there is no advertising or third-party analytics SDK in the app. The only third-party diagnostics tool is Sentry, used for crash reports as described above.

• to create, secure, and manage your account and profile;
• to display your ratings, reviews, and activity to you and other users;
• to deliver direct messages between you and other users;
• to send you notifications you have asked for;
• to operate, maintain, secure, and improve the Service;
• to respond to your requests and provide support;
• to screen uploads, review reports, and enforce our Terms and Community Guidelines, and to detect and prevent fraud and abuse;
• to meet our legal obligations.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 GDPR:

Your username and @handle, profile details including your profile photo, and the content you post (ratings, reviews, takes, lists, follows, and similar activity) are public: other users see them in the app, and anyone with a link can see your profile and posts on our website without signing in. We ask search engines not to index those web pages. Stories are the exception: a story is shown in the app only to you and to people who follow you, for 24 hours, and not on our website. Anyone with an account can follow you without your approval, so treat a story as visible to anyone who chooses to follow you. Photos and video in a story are stored at a web address that is hard to guess but not protected by a sign-in. The questions you answer in polls and hot takes, and your pick on each, are listed in the Answers section of your profile. Other votes — up and down votes on chat messages — are only ever shown as totals, never as who voted which way.

Your email address, any phone number given in an earlier version, and your year of birth are never shown to other users. Direct messages are private between the people in the conversation and are not shown on your public profile. Images and video you upload — including direct message attachments — are automatically screened for prohibited content; that check is machine-only and no person reads your messages unless someone in the conversation reports them.

We use trusted third parties (sub-processors) to run the Service:

• Supabase — authentication, database, and file storage (hosted on Amazon Web Services infrastructure in the United States);
• Google — Sign in with Google, and our own email; and profile photos of people who signed up with Google, which load directly from Google's servers, so Google sees your device's IP address when one is shown to you;
• Apple — Sign in with Apple, and delivery of lock-screen Live Activity updates through the Apple Push Notification service;
• Resend — sending the verification and sign-in codes we email you;
• Expo — delivery of push notifications to your device, and over-the-air app updates. A notification's text passes through Expo and then Apple's push service on its way to your phone, and for a direct message that text includes the sender's name and a short preview of the message (not a photo). You can turn message notifications off in the app's notification settings or your phone's settings;
• Sentry — crash and performance reports, linked to your account ID (not your email or name);
• Anthropic — the AI that writes our quiz and debate questions and historical squad line-ups. To avoid repeats, it is shown the text of recent debate questions people have asked, with no names, handles or account details. Nothing else you post is sent to it.
• Sightengine — automated screening of uploaded images and video;
• Klipy — GIF search. When you search for a GIF, your search words and a scrambled code made from your account (not your name, email or account ID, and Klipy cannot link it back to you) are sent to Klipy, and the GIFs load from its servers;
• API-Sports and FlagCDN — team crests, player photos and flags load directly from their servers, so they see your device's IP address, as any website you visit does;
• Imago — licensed editorial photography shown in the app;
• Vercel — hosting for this website;
• Web3Forms — delivering messages sent through this website's contact and removal-request forms to our inbox.

These providers process data on our behalf under their own security and privacy commitments. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for third-party advertising.

Translation stays on your phone. Tapping Translate uses the translation built into your phone's operating system. The text is not sent to us or to any AI company, and nothing you write is used to train an AI model.

Automated screening. Every image and video uploaded to the Service — including direct message attachments — is checked by Sightengine, an automated content-moderation service. An upload that matches prohibited content is removed automatically, without a person seeing it. If you think that decision was wrong, write to service@fulltimecompany.com and a person will review it. You have the right to that human review, to explain your side, and to contest the outcome.

What AI does not do. We do not use AI to decide whether to suspend or terminate an account, and we do not profile you or make any other decision about you by automated means.

Separately, some of what you read on Fulltime is AI-generated rather than written by a person — quiz questions, debate questions, and historical squad line-ups and their statistics. That does not involve your personal information, but it is worth knowing it can be wrong.

We may disclose information when we believe in good faith that it is necessary to comply with a law, regulation, subpoena, court order, or other valid legal process; to enforce our Terms; to detect or prevent fraud, security, or technical problems; or to protect the rights, property, or safety of Fulltime, our users, or the public.

US law requires us to report apparent child sexual abuse material to the National Center for Missing & Exploited Children, and we do. Where we are legally allowed to tell you about a request for your data, we will try to.

Export. In the app, go to Profile → The locker room → Support → Download my data. You get a single file with your account, profile and everything you have created on Fulltime.

Deletion. In the app, go to Profile → The locker room → Delete account. Deleting schedules your account for removal: for seven days it is marked and you are signed out, and if you sign back in within that window you can cancel the deletion and keep your account, profile and posts as they were (you sign in again on each device and turn live lock-screen scores back on). After seven days we delete your account, profile, uploads and private messages for good. Full detail is on our account deletion page.

If you have lost access to your account, email us at service@fulltimecompany.com and we will delete your data after verifying the account is yours.

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the processing of your personal information, to object to processing based on legitimate interests, and to withdraw consent at any time. You can exercise most of these directly: update your profile in the app, export your data, or delete your account. For anything else, write to service@fulltimecompany.com.

We do not charge for this and we will not treat you differently for asking. If you are in the EEA or UK you also have the right to complain to your local data protection authority.

California and other US states. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We collect the categories described in section 1 for the purposes in section 2, and we disclose them only to the service providers in section 5. California residents may request access to or deletion of their information using the same routes above, and may designate an authorised agent to make the request.

We use reasonable technical and organizational measures to protect your information: data is encrypted in transit, access to production data is limited to the people who need it, and per-user database rules restrict what any account can read. Private images, including direct message attachments, are stored in a private bucket and served only through short-lived signed links.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information we will notify you and the relevant authorities where the law requires it, without undue delay.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. We ask for a year of birth before an account can be created and block anyone under 13. If you believe a child under 13 has provided us information, contact us and we will delete it and close the account.

If you are under 18, you can remove anything you have posted. Every rating, review, take, reply, list and poll you create has a delete control on it, and deleting your account removes the lot. If something will not delete, or you cannot reach it, email service@fulltimecompany.com and we will remove it for you.

Two honest limits, which the law asks us to spell out: removal takes the content off Fulltime, but it cannot reach copies other people have already saved, screenshotted, or re-posted; and a copy may remain in our encrypted backups until they age out on the normal cycle.

We operate the Service from, and store data with providers located in, the United States. If you use the Service from outside the US, your information is transferred there. Where that transfer is from the EEA or the UK, our providers rely on the European Commission's Standard Contractual Clauses and the UK Addendum, and we have data processing agreements in place with them.

The Fulltime app does not use cookies. This website sets no cookies and runs no analytics or advertising scripts, so there is nothing to consent to or opt out of. If that ever changes we will update this section and ask for your consent first.

Do Not Track. Some browsers can send a "Do Not Track" signal. We do not track you across other websites or services in the first place, and we do not allow anyone else to, so there is nothing for the signal to change — we treat every visitor as though it were switched on. We do not respond to it differently.

We may update this Privacy Policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you in the app. Continued use of the Service after changes take effect means you accept the revised policy.

Questions about this policy or your data? Reach us at service@fulltimecompany.com.