This policy explains what information Turf Totals collects, why we collect it, and the choices you have. We try to collect as little as possible, and we never sell your personal data.

Information we collect

• Account details. If you sign in by email we store your email address to send you a one-time magic link — we do not store passwords. If you sign in with a Solana wallet (such as Phantom) we store your public wallet address. You may optionally set a display name and username, which are public on contest leaderboards.
• Sign-in with Google. If you choose Google sign-in, we receive your email address and basic profile information from Google to create or match your account.
• Gameplay data. Your contest entries, picks, scores, and referral activity.
• Payment data. Token and entry-fee purchases are processed by Stripe. We never see or store your full card number; Stripe handles card data under its own PCI-compliant systems. We retain a purchase audit record (amount, Stripe session id, status) to fulfill your order and for accounting.
• On-chain data. Contest entries, prize pools, and payouts settle on the public Solana blockchain. Your wallet address and the associated transactions are inherently public on-chain — this is true of any Solana application, not unique to us.
• Technical & usage data. Standard server logs (IP address, browser type, pages visited) and approximate location derived from IP for the eligibility check described below.

How we use your information

• To run the game: create your account, record entries, score contests, and distribute payouts.
• To process token and entry-fee purchases through Stripe.
• To send transactional email (magic-link sign-in, receipts, account notices) via our transactional email provider.
• To confirm you are accessing the game from a permitted jurisdiction (geo-eligibility).
• To detect and prevent fraud, abuse, and multi-account referral manipulation.
• To diagnose bugs and improve the product.

Analytics and session replay

We use error monitoring (Sentry) and, on a sampled basis, session-replay tooling (LogRocket) to reproduce and fix bugs. When session replay is active we identify your session by an opaque account slug only — we deliberately do not send your email address or other personal identifiers to these vendors. Your public display name may be attached because it already appears on leaderboards.

Who we share data with

We share data only with the service providers that make the game work, and only the data they need:

• Stripe — payment processing.
• Resend / Amazon SES — transactional email delivery, depending on the active mail transport.
• Solana RPC providers — reading and broadcasting on-chain transactions.
• Google — only if you use Google sign-in.
• Sentry / LogRocket — error monitoring and bug reproduction, as described above.

We do not sell your personal information. We may disclose information if required by law or to protect the rights, safety, and integrity of the game and its players.

Cookies

We use a small number of first-party cookies that are necessary for the site to work — principally your sign-in session and CSRF protection. We do not use third-party advertising cookies.

Data retention

We keep account and gameplay data for as long as your account is active. Payment audit records are retained as required for accounting and dispute resolution. Operational logs are trimmed on a rolling basis. On-chain data is permanent and outside our control by the nature of public blockchains.

Your choices and rights

• You can update your display name and username on your account page at any time.
• You can unlink Google sign-in from your account.
• You can request access to, correction of, or deletion of your personal data by emailing us. Note we cannot delete data already written to the public Solana blockchain.

Children

Turf Totals is not directed to children. You must be of legal age in your jurisdiction to use the game.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above.