Privacy Policy
1. Who we are
PuckWeekly Inc. ("PuckWeekly," "we," "us") is a corporation incorporated under the Canada Business Corporations Act and registered extra-provincially in Manitoba, with its registered office at 1800–One Lombard Place, Winnipeg, Manitoba R3B 2A3, Canada.
This policy explains what personal information we collect when you use puckweekly.ca (and puckweekly.com, which redirects to it), and the PuckWeekly applications (the "Service"), why we collect it, who we share it with, and what control you have over it.
It applies to Managers, Commissioners, and anyone who contacts us. It forms part of our Terms of Service.
We are governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and by the Personal Information Protection Act in Alberta and British Columbia where those apply.
The Service is currently offered only in Canada, excluding Quebec. We do not knowingly collect personal information from people outside that territory.
Capitalized terms not defined in this Policy have the meaning given in the Terms of Service.
2. The short version
We collect what we need to run a fantasy hockey league and not much else. Your name, email, and how you play.
We do not sell your personal information. We do not share it with advertisers. We do not build advertising profiles.
Other Managers in your League see your name, team name, roster, and scores. That's the game working as intended, and it's the main way your information becomes visible to anyone.
Your card details go to Stripe, not to us. We never see or store a full card number.
Our servers are in Germany, which means your information is stored outside Canada. Section 8 explains what that means for you.
You can ask us what we hold, correct it, or delete your account at any time.
3. What we collect
Account information
- Name
- Email address
- Password (stored only as an Argon2id hash, which we cannot read)
- Google account identifier and basic profile, if you sign in with Google
- Authentication method
- Multi-factor authentication settings, if you enable it
- Email verification status
League and gameplay information
- Leagues you belong to and your role in each
- Team name
- Draft picks, pick timing, and whether a pick was made by you or by auto-draft
- Weekly rosters
- Fantasy points, weekly finishes, Placement Points, and Season standings
- Scoring settings you configure, if you are a Commissioner
Invitation information
- Invite codes you issue or redeem
- Which League you joined and who invited you
Payment information (Commissioners only)
- Which Seasons you have bought, and their start and end dates
- Payment records, amounts, and currency
- Billing province or territory, used to calculate tax
- A Stripe customer identifier
We do not collect or store full card numbers, CVVs, or expiry dates. Those go directly to Stripe.
Technical information
- IP address
- Browser and device type, operating system
- Approximate location derived from IP address, used to confirm you are in the territory we serve
- Timestamps of logins, drafts, and other actions
- Error and performance logs
Communications
- Messages you send to support
- Your email notification preferences
- Delivery and bounce information for emails we send you
We do not collect precise GPS location, contacts, photos, or any biometric information.
4. Where it comes from
Most of it comes from you directly: at signup, when you configure a League, and as you play.
Some comes from other people: a Commissioner who invites you to their League.
Some is generated by the Service: your standings, Placement Points, and draft history are calculated by us from how you play.
Some comes from Google, if you sign in with Google, from Stripe, which tells us whether a payment succeeded, and from Cloudflare, which tells us the approximate location of the network you connect from.
NHL player statistics come from MySportsFeeds. Those are statistics about professional athletes, not about you.
5. Why we collect it
Under PIPEDA we collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate, and only with your consent.
| Purpose | What we use |
|---|---|
| Create and secure your account | Account information, technical information |
| Run drafts, scoring, and standings | League and gameplay information |
| Show standings to your league | Name, team name, roster, scores |
| Process Season purchases | Payment information, billing province |
| Calculate and remit sales tax | Billing province or territory |
| Manage league invitations | Invitation information |
| Send you service emails | Email address, notification preferences |
| Confirm you are in the territory we serve | IP address, approximate location |
| Prevent fraud, multi-accounting, and collusion | Technical information, account information |
| Diagnose problems and improve the Service | Error logs, aggregated usage |
| Meet legal and tax obligations | Payment records |
Consent. You consent by creating an account and using the Service. For anything outside the purposes above, we ask first.
You can withdraw consent at any time, subject to legal and contractual limits. Withdrawing consent for the core purposes above means we can't operate your account, so it is effectively a request to close it. Some records, payment and tax records in particular, we are required to keep even after you leave.
No advertising, no profiling. We do not use your information for behavioural advertising, and we do not make automated decisions about you that produce legal or similarly significant effects. Auto-draft picks a hockey player when your timer runs out; it does not evaluate you.
6. What your League sees
This is the disclosure most likely to matter to you day to day, so it gets its own section.
Other Managers in a League you join can see your name, team name, draft picks, weekly roster, fantasy points, weekly finishes, and Season standings. Drafts are live, so your picks are visible to your league as you make them, and they remain in the League's draft history afterward.
Your Commissioner can additionally see that you accepted their invitation, and can remove you from the League.
Other Managers cannot see your email address, password, payment information, or which other Leagues you belong to.
Leagues are private and invite-only. We do not publish standings publicly or make League data available to search engines.
7. Who we share it with
We do not sell personal information. We do not disclose it for anyone else's marketing.
Service providers. We use third parties to operate the Service. They receive only what they need, are bound by contract to protect it, and may not use it for their own purposes.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Hetzner | Server hosting and databases | Everything stored by the Service | Germany |
| Cloudflare | Network security, content delivery, and hosting for our website and web app | IP address, browser and device information, and the traffic passing between you and the Service | United States, with traffic handled at the data centre nearest you |
| Stripe | Payment processing | Name, email, card details you enter, billing address | United States, Ireland |
| Sign-in, if you choose it; our business email, which receives your support messages | Authentication request; name, email, message content | United States | |
| Resend | Transactional email delivery | Name, email address, message content | United States |
| Sentry | Error and performance monitoring | Technical logs, error reports, and your account identifier | United States |
Legal disclosure. We may disclose personal information where required by law, court order, or a lawful demand, or where necessary to establish or defend a legal claim, or to protect the safety of a person. Where we are permitted to tell you, we will.
Business transfer. If PuckWeekly Inc. is acquired or merges, personal information may transfer as part of that transaction. It stays subject to this policy until you are notified otherwise.
8. Where your information is stored
Your personal information is stored outside Canada. Our servers are hosted by Hetzner in Germany, and several of our service providers are located in the United States and Ireland.
While your information is in another country, it is subject to that country's laws, and may be accessible to that country's courts, law enforcement, and national security authorities under their legal processes. Canadian privacy law does not prevent that.
We use providers with comparable protections and bind them contractually to standards consistent with Canadian law. But we want you to know where your information sits, and that this is a real trade-off, not a formality.
If you are in Alberta, this section serves as notice under section 13.1 of Alberta's Personal Information Protection Act that we use service providers outside Canada. You can contact our Privacy Officer (Section 14) with questions about how they handle your information.
9. How long we keep it
| Information | Retention |
|---|---|
| Account information | While your account is open, then 7 days after you delete it |
| League and gameplay history | Kept indefinitely as league records, anonymized or pseudonymized as the case may be, when you delete your account |
| Payment and tax records | 6 years, as required by Canadian tax law |
| Technical logs | 30 days |
| Support messages | 2 years |
| Backups | Up to 7 days after deletion from live systems |
When you delete your account, we remove your personal information on the schedule above. Gameplay records that other Managers rely on, being draft results, weekly scores, and standings, are retained for the League's Season records, with your name replaced by a placeholder. A completed League's history should not disappear because one Manager left, but it doesn't need to keep identifying you.
We delete or anonymize personal information when it is no longer needed for the purpose it was collected for.
10. How we protect it
- Passwords hashed with Argon2id. We never store passwords in a readable form and cannot recover them.
- Multi-factor authentication available on your account. We recommend enabling it.
- TLS encryption for all traffic between you and the Service.
- Encryption at rest for databases and backups.
- Authentication tokens stored in your device's secure storage, never in general-purpose local storage.
- Access controls on every endpoint, so managers can only reach data for leagues they belong to.
- Internal access limited to the people who need it to operate or support the Service.
No system is perfectly secure, and we can't promise absolute security. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep records of breaches as required by law.
You are responsible for keeping your own password and devices secure.
11. Your rights
You can:
- Access the personal information we hold about you, and learn how it has been used and who it has been disclosed to
- Correct anything inaccurate or incomplete
- Withdraw consent, subject to legal and contractual limits
- Delete your account and the personal information attached to it, subject to Section 9
- Export your account and gameplay information in a portable format
- Opt out of non-essential emails at any time, though we will still send you essential service messages about drafts, payments, and account security
- Complain to us, and to a regulator, if you are unsatisfied
To exercise any of these, email privacy@puckweekly.ca. We respond within 30 days, as PIPEDA requires. We may need to verify your identity first. Access is normally free; if a request is unusually costly we will tell you the cost before proceeding.
We may refuse or limit access in the narrow circumstances PIPEDA allows, for instance where it would reveal another Manager's personal information, or where the information is subject to solicitor-client privilege. If we refuse, we will tell you why and how to challenge it.
Regulators. If we haven't resolved your concern, you can complain to:
- Office of the Privacy Commissioner of Canada: priv.gc.ca
- Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca (Alberta residents)
- Office of the Information and Privacy Commissioner for British Columbia: oipc.bc.ca (BC residents)
12. Children
The Service is for adults. You must be at least the age of majority in your province or territory of residence to create an account, and we do not knowingly collect personal information from anyone under the age of majority.
If we learn that we have collected personal information from someone under the age of majority, we will delete it and close the account.
If you are a parent or guardian and believe your child has created an account, contact privacy@puckweekly.ca and we will remove it.
13. Cookies and tracking
We use cookies and similar technologies for:
- Essential functions: keeping you signed in, securing your session, protecting against cross-site request forgery. These can't be turned off without breaking the Service.
- Preferences: remembering your theme and settings.
We do not use analytics or advertising cookies, and we do not permit third-party advertising trackers on the Service.
14. Accountability
We have designated a Privacy Officer accountable for our compliance with this policy and with Canadian privacy law. We will provide that individual's name on request.
Privacy Officer
PuckWeekly Inc.
1800–One Lombard Place
Winnipeg, MB R3B 2A3
Canada
privacy@puckweekly.ca
Any question, request, or complaint about your personal information goes here first. We take complaints seriously and will investigate and respond.
15. Changes to this policy
We may update this policy. The current version is always posted at puckweekly.ca/privacy with its effective date.
If a change is material, meaning a new purpose, a new category of information, or a new disclosure, we will notify you by email or in the Service at least 30 days before it takes effect, and where the law requires it, ask for your consent.