BMX FANTASY

Privacy Policy

Last updated: 29 July 2026

BMX Fantasy is operated by Dinny Zerge in Sweden, who is the data controller for the service. This policy explains what information BMX Fantasy processes, why it is needed, who receives it, and the choices and rights available to you.

Privacy contact: play@bmxfantasy.com

Information we process

Account and authentication. Your email address, BMX Fantasy Player Name, internal account identifiers, authentication and session information. Email codes are the default sign-in method. If you choose to add a password, the authentication provider stores a one-way password verifier; BMX Fantasy does not receive or store your readable password.

Gameplay and League activity. Your picks, submission timestamps, scores, leaderboard results, Game and League participation, League role or ownership, and reactions to League highlights.

Safety and moderation. If you report another player's Player Name, we process the reported name as it appeared at the time, the reason you chose, which screen you reported it from, internal account identifiers for you and the reported player, and the time of the report. If you report or hide a player, we store that you have hidden them so the name stays hidden on your account across your devices. We do not collect any free-text description from you as part of a report.

Support communications. The email address, message, screenshots and other information you choose to send when asking for help.

Technical, security and notification information. Our hosting, database and anti-abuse providers may process IP address, request time, requested route, browser or device type, and limited error or security information. Cloudflare Turnstile also processes technical information needed to prevent automated sign-in abuse. If you enable push notifications, we process the device notification token, platform and app environment, your notification preferences, limited device-ownership state needed to keep the token attached to the correct account, and notification delivery and inbox state. You can change notification permission in iOS and notification categories under Account → Notifications.

We do not request your precise location, contacts, photos, payment details or health data. Device motion used for the visual background in the iOS app is processed on the device and is not sent to BMX Fantasy.

How and why we use it

We use account and gameplay information to create and secure your account, save your picks, calculate results, display leaderboards, operate private Leagues, and provide the features you request. We use support information to answer you. We use limited technical information to prevent abuse, diagnose failures and keep the service reliable.

For users in the EU or EEA, the legal bases are performance of the service you request, our legitimate interests in security and reliable operation, consent where a feature or applicable law requires it, and compliance with legal obligations. You may object to processing based on legitimate interests by contacting us.

Service providers

We use Supabase for database and authentication, Vercel for website and API hosting, Resend for sign-in email delivery, and Cloudflare Turnstile for bot protection. The website also loads fonts from Google Fonts. These providers receive only the information needed for their role. Providers acting on our behalf are required to protect personal data consistently with this policy and applicable law.

Some providers may process information outside the EU or EEA. Where required, those transfers rely on safeguards recognised by applicable data protection law. We do not sell personal information or give it to data brokers.

Website analytics and advertising

The website at bmxfantasy.com uses Google Analytics and Vercel Analytics to understand visits and performance, and Meta Pixel to measure advertising results. These services may receive the page visited, browser or device information, IP-derived approximate location, and cookie or similar identifiers. Google and Meta may process that information under their own privacy terms. You can limit cookies and similar storage through your browser and manage advertising preferences through Google and Meta.

The native iOS app does not contain Google Analytics, Meta Pixel, Vercel Analytics or an advertising SDK. BMX Fantasy does not use information from the iOS app to track you across other companies' apps or websites.

What is public

Your Player Name, points and ranking are visible on public Game leaderboards. Your Player Name and relevant results, League role and reactions are also visible to members of private Leagues you join. Your email address and sign-in information are never shown to other players.

Alongside an active player's name, the app also exposes an opaque moderation reference — a random identifier whose only purpose is to let another player report that name. It does not contain or reveal your email address, your sign-in (auth user) identifier or our internal player identifier. It is stable, so the app can recognise the same active public player across the screens that support reporting and send a report about them — that is all it does. It exists only for active players; retained anonymous results from deleted accounts do not have one and cannot be reported.

Reporting, hiding and Player Name checks

Player Names, League names and League descriptions are checked automatically for offensive content before they are saved. Text that fails the check is not stored, and we do not tell you which word matched.

You can report another player's Player Name from any screen where it appears, choosing from a fixed list of reasons. Reporting also hides that player for you. Reports are reviewed by a person promptly; where a report is upheld we replace the Player Name with a neutral handle and prevent the account from setting it again. You can see and undo who you have hidden under Account → Safety → Hidden players; the entries in that list are deliberately anonymous and do not repeat the hidden name back to you, and undoing a hide does not withdraw a report. Hiding a player never changes anyone's points, ranking or results. Because BMX Fantasy has no messaging between players, hiding is the meaningful block: that person's name no longer appears anywhere in your app.

A League’s own name and description are reported through a different channel: the League screen has a REPORT LEAGUE CONTENT action that opens an email to report@bmxfantasy.com. The League’s internal ID is the only value from the League that the app fills in — not the League name, description, invite code or any player identifier. The app also supplies a standard subject and instructions; your mail app supplies your sender details and lets you add text or attachments. What you send is processed as a support message. Where such a report is upheld we replace the League name with neutral text and clear the description; members, standings, points and the invite code are unaffected.

Open Player Name reports are kept while they are being reviewed. Actioned and dismissed reports are automatically deleted 12 months after the decision. If you delete your account first, reports you filed are no longer linked to you, and reports about you are deleted with the account. A Player Name lock remains until we lift it or the account is deleted; your hidden-player choice remains until you undo it or delete your account; the opaque moderation reference remains only for the life of the active player account. To ask about a report or a decision, email play@bmxfantasy.com.

Retention and account deletion

We retain account and gameplay information while your account exists and for as long as it is needed to operate the relevant Game, Season and League history. Support and League-report emails are deleted 12 months after the request or case is closed. We may keep specific information longer only where required by law or while it is necessary to establish, exercise or defend a legal claim. Limited security logs are retained only for as long as reasonably needed to protect and operate the service or meet a legal obligation.

Deleting your account permanently removes the Auth account, email, Player Name, credentials and sessions, raw picks, League memberships and ownership, reactions, notification tokens, preferences and inbox history, the list of players you had hidden, and any moderation reports about you. If you own a League, ownership transfers to the longest-standing remaining member; an empty League is deleted.

Points and established ordering from Rounds that were already completed may remain under a permanent, server-assigned BMX alias such as Deleted Holeshot. The alias is assigned independently per Game and Season, contains no email, former Player Name, Auth user ID or recovery key, cannot sign in, and cannot be claimed by a later account. Picks from Rounds that were not yet scored are deleted and do not receive a later result.

Deletion removes personal data from the active service. Restricted residual copies may remain temporarily in provider or disaster-recovery backups until those backups are overwritten under their normal retention cycle. They are not used for ordinary service operation; if a backup is restored, completed deletion requests must be reapplied.

Deleting your account

In the iOS app, open Account and choose Delete Account. The app explains the consequences and asks you to confirm before deletion begins. If that option is not available in your current version, you cannot access the account, or you need help, email play@bmxfantasy.com. Account deletion is permanent and a later sign-up with the same email creates a new account with no claim to the old anonymous results.

Your rights

Depending on where you live, you may have rights to access, correct or delete your personal data, restrict or object to processing, receive certain information in a portable format, and withdraw consent where processing relies on consent. Email play@bmxfantasy.com. We may need to verify that the request concerns your account. EU and EEA requests will be answered without undue delay and normally within one month.

You may also complain to your local data protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).

Children's privacy

BMX Fantasy is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will remove it.

Changes

We will update this page if our practices change, and revise the date at the top.