Privacy policy

Unscripted is operated by the Unscripted team. For anything in this policy, including requests about your data, contact unscriptedleague@gmail.com.

From Google, when you sign in

Your name, email address, profile image URL, and the tokens that keep you signed in. Sign-in is Google only, so we never see or store a password.

What you create in the app

Your display name, team names, uploaded team logos, league names and invite codes, draft picks, roster changes, trade proposals and their messages, and the scoring history attached to your team.

What you paste in

If you are a commissioner and you paste an episode recap to be scored, we store that text and the events extracted from it.

Technical data

Our host keeps standard server logs, which include IP addresses, user agent strings and request paths.

We also count page views using Vercel Web Analytics, so we can see which pages get used and how people find us. It sets no cookies, and it does not follow you to other websites or build a profile of you. It records the page you viewed, the site that referred you, and general details like country, browser and device type. The visitor count is worked out from a value that is scrambled and reset every day, so it cannot be traced back to you or linked to your account. We do no advertising and no fingerprinting.

Invitation and introduction measurements

We also measure how league invitations and cast introductions perform, without cookies. When you open an invitation link or view a cast introduction, we record it under a value scrambled from your IP address and browser type. That value changes every day, so it cannot be reversed or linked across days. We record which invitation message was copied, and when someone joins a league through an invitation link, we credit the join to that link. The operator can see these results in admin. We do not measure messages being sent or read in other apps, and a profile view does not establish that you watched a show. To limit abuse, these features also keep a scrambled form of your IP address with a count of recent requests.

To sign you in and keep you signed in; to run your leagues (rosters, drafts, matchups, standings); to score episodes and notify you when your team scores; to prevent abuse and control cost, which is why we rate limit the recap parser; to see which pages get used, so we know what to build next; and to fix things when they break.

If you are in the UK or EU, our lawful bases are performance of a contract (running the game you signed up for) and legitimate interests (keeping the service working, secure and affordable, and understanding which pages get used). We do not ask for consent, because we set no cookies beyond the ones that sign you in, and our page-view and invitation counts use scrambled values that cannot be traced back to you.

Anyone in a league with you can see your display name, team name and logo, roster, trades you propose to them, and your scoring history. They cannot see your email address.

If your Google account has no display name, you appear as “Friend”. We deliberately do not derive a name from your email address.

We run this service, so we can reach the data in it. In practice that means two things. We can query the database directly, which is how the app is built and maintained. And the account that operates Unscripted can open a league it is not a member of, read only, to see what a league looks like when something goes wrong or somebody reports a problem.

That view deliberately excludes the group chat. It shows the same things your league mates already see: teams, rosters, standings, matchups, the draft and the scoring log. It cannot change anything, post anything, or act in your league, and there is no way for one player to use it to look at another player’s league.

We do not read your leagues for entertainment, and we do not look at private conversation unless we are investigating something you or a league mate has reported. This is a small beta run by two people; if you would rather we didn’t look at something, say so and we won’t.

We use these providers, and no others:

• Anthropic runs the Claude model that reads episode recaps and extracts scoring events. Recap text you paste for scoring goes to Anthropic. Do not paste anything you would not want sent there.
• Google for sign-in (Google account), and Google Gemini to read Bravo’s public cast pages so the cast list stays current. Gemini no longer reads recaps.
• Vercel hosts the app, keeps server logs, stores uploaded team logos, and counts page views for us.
• Supabase hosts the database where everything above is stored.

This list names the providers we use today. If we change one, we update this page.

We do not sell your data, and we do not share it for advertising. These providers process it on our behalf and are not permitted to use it for their own purposes.

On servers in the United States. If you are outside the US, using Unscripted means your data is transferred there and handled under US law.

Your account data stays until you delete your account. League activity stays for as long as the league exists, because it belongs to the other players too. Deleting a league removes its teams, rosters, matchups, drafts, trades and scoring events. Server logs are kept on our host’s normal schedule, which is short. Invitation and introduction counts are kept until the invitation experiment ends, and then deleted.

You can, at any time:

• See and correct your display name on your profile.
• Delete your account from the same page. That immediately removes your email, name, profile image and sign-in tokens, and deletes your notifications. Match history stays with the leagues you played in, because it is other players’ record too, but it is no longer linked to an identifiable account.
• Ask for a copy of your data, or ask us to delete something the app does not expose, by emailing unscriptedleague@gmail.com.

Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your data protection regulator. Contact us first and we will try to sort it out.

A small set of first-party cookies that sign you in and keep you signed in, plus short-lived ones used during the Google sign-in round trip. Nothing for advertising, and neither our page-view counting nor our invitation and introduction measurements set any at all, which is why there is no cookie banner. Clearing them signs you out.

Unscripted is not intended for children. Do not use it if you are under 13, or under 16 in the UK and EU. We do not knowingly collect data from children, and we will delete any account we learn belongs to one.

Traffic is encrypted in transit. The database is not reachable from the public internet: the app connects to it, and so do we when we maintain it, as described above. Sign-in is delegated to Google, so we hold no passwords. That said, this is a prototype rather than a hardened production service, so please do not store anything sensitive in it.

If this policy changes in a way that matters, we will update the date at the top and, for anything significant, tell you in the app before it takes effect.