Move The Chains privacy policy

> > This policy explains what Move The Chains ("Move The Chains," "MTC," "we," "us") collects when you visit our site or play the game, how we use it, who we share it with, and the choices you have. By using Move The Chains you agree to this policy.

Notice at collection

A summary for readers who want the shape of it before the detail. Every row is expanded below.

| | | |---|---| | What we collect | Your email address, your handle, your gameplay data (roster, lineups, captains, moves, audibles, scores, standings), anything you send us, and usage and device data including IP address. | | Why | To run the game, sign you in, send email you asked for, keep the service secure, and understand how it is used. | | Do we sell it? | No. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under California and other state privacy laws. We have never done so. | | Do we take payments? | No. Move The Chains is free and we collect no payment-card data. | | How long we keep it | While your account is open, and for a limited period afterwards. See "Data retention". | | Your choices | Access, correct, delete, port, and opt out of marketing email. See "Your rights". | | Contact | [CONTACT EMAIL] |

Who we are

Move The Chains is a season-long NFL fantasy game operated by [LEGAL ENTITY]. If you have questions about this policy or your data, contact us at [CONTACT EMAIL] or [BUSINESS MAILING ADDRESS].

What this policy covers

This policy covers the Move The Chains marketing site, the email list, and the game itself. It does not cover third-party sites we link to, which run their own policies.

Information we collect

### Information you give us

• Email address. When you join the list or create an account. This is the core of how we reach you and how you sign in.
• Account and sign-in data. Move The Chains uses magic-link sign-in, so we do not store a password. We keep your email and the sign-in tokens needed to log you in securely.
• Gameplay data. Your roster, weekly lineups, captain picks, moves (adds and drops), audibles, and your scores and standings across the season.
• Anything you send us. Support messages, survey or feedback responses, and replies to our emails.

### Information we collect automatically

• Usage and device data. Pages viewed, actions taken in the game, referring page, browser and device type, and approximate location derived from your IP address.
• Log data. IP address, timestamps, and error data collected by our hosting and analytics tools to keep the service running and secure.
• Cookies and similar technologies. Used for sign-in sessions and for product analytics. See "Cookies and analytics" below.

### Information we do not collect

We do not take payments, so we do not collect or store payment-card data. Move The Chains is free to play at launch.

How we use your information

• Run the game. Build and manage your roster, score your lineups, and publish standings.
• Sign you in. Send and verify magic-link login emails.
• Send email you asked for. Build updates, the weekly recap, and other newsletter content you opted into.
• Send service messages. Account, security, and transactional notices tied to your use of the game.
• Improve the product. Understand how people use Move The Chains so we can fix what is broken and build what matters.
• Keep it secure. Detect, prevent, and respond to abuse, fraud, and technical problems.
• Meet legal obligations. Comply with applicable law and enforce our terms.

Legal bases (for EEA and UK users)

Where the GDPR or UK GDPR applies, we rely on these bases: consent for marketing email and non-essential analytics; performance of a contract to provide the game you signed up for; and legitimate interests to secure, maintain, and improve the service. You can withdraw consent at any time without affecting processing already carried out.

How we share your information

We do not sell your personal information. We share it only with the service providers ("subprocessors") that run Move The Chains on our behalf, and only as needed to operate the service:

| Provider | Purpose | Data involved | |---|---|---| | Beehiiv | Newsletter and marketing email | Email address, engagement data | | Resend | Transactional email, including magic-link sign-in | Email address, message metadata | | Neon | Database hosting (serverless Postgres) | Account and gameplay data | | Vercel | Application and site hosting | Log and request data, IP address | | PostHog | Product analytics (page views, in-game events, error reports) | Usage, device, and event data |

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in control of your data.

NFL statistics that power the game come from public data sources (NFLverse and the Sleeper public API). These are data we pull in, not places we send your personal information.

Cookies and analytics

We use cookies and similar technologies to keep you signed in and to understand product usage through PostHog. You can control cookies through your browser settings. Blocking some cookies may break sign-in or parts of the game.

We do not record your screen. Move The Chains does not use session recording, session replay, or heatmap tools, and we do not run any third-party analytics beyond PostHog. What we collect is described above: page views, in-game actions, and device and error data — not a replay of your session.

If that ever changes we will update this policy and, where required, ask for your consent before turning it on. The same applies if we add cookie-based advertising or another analytics provider.

Email choices

Every marketing email includes a one-click unsubscribe link. Unsubscribing stops the newsletter and build updates. We may still send you service messages required to operate your account, such as magic-link sign-in emails. To manage your subscription you can use the link in any email or contact us at [CONTACT EMAIL].

Data retention

We keep your information for as long as your account is active or as needed to provide the game. If you delete your account or ask us to remove your data, we will delete or de-identify it within a reasonable period, except where we must retain it to meet legal, security, or fraud-prevention obligations. Aggregated or de-identified data that cannot reasonably identify you may be retained for analytics and historical scoring.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Delete your information.
• Object to or restrict certain processing.
• Port your data to another service.
• Opt out of marketing email at any time.

To exercise any of these, email [CONTACT EMAIL]. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights.

EEA and UK users may also lodge a complaint with their local data protection authority.

### State-specific rights

California. Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect and how we use it, to delete it, to correct it, to obtain a copy of it, and to opt out of its sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but the right exists and we honor it. We will not discriminate against you for exercising any of these rights. You may designate an authorised agent to make a request on your behalf; we may ask you to verify the agent's authority.

Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, and other states with comprehensive privacy laws. You may have rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. We do none of those three. Where your state provides an appeal process for a denied request, we will tell you how to use it when we respond.

Nevada. Nevada residents may direct us not to sell certain personal information. We do not sell it.

To exercise any state right, email [CONTACT EMAIL] and say which right you are exercising and which state you reside in.

Security

We use reasonable technical and organizational measures to protect your information, including passwordless sign-in, encrypted connections, and reputable infrastructure providers. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to respond quickly if something goes wrong.

Children's privacy

Move The Chains requires users to be at least 13 years old. It is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected information from a child under 13, we will delete the account and the information promptly. If you believe a child under 13 has given us their information, contact us at [CONTACT EMAIL].

Users aged 13 to 17 may only use Move The Chains with the involvement and consent of a parent or legal guardian, who is responsible for their use of the service. A parent or guardian may contact us at [CONTACT EMAIL] to review, correct, or delete their child's information, or to close the account.

International data transfers

We operate from the United States, and our providers may process data in the United States and elsewhere. If you access Move The Chains from outside the United States, you understand your information will be transferred to and processed in countries that may have different data-protection laws than your own.

Changes to this policy

We may update this policy as the product and our providers evolve. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or in the game. Continued use after changes take effect means you accept the updated policy.

Contact

Questions, requests, or concerns: [CONTACT EMAIL] or [BUSINESS MAILING ADDRESS].

This policy is governed by the laws of [GOVERNING STATE], United States, without regard to conflict-of-laws rules.