Privacy Policy

Chameleon Bracket · Last updated 19 October 2026

Chameleon Bracket is a bracket pool app. This policy explains what it stores about you, why, who else can see it, and how to get rid of it. It is written to be read rather than skimmed past.

The short version. We store what is needed to run your pools — your sign-in identity, the pools you are in, and the messages you send in them. There is no analytics, no advertising, no tracking, and nothing is sold or shared for marketing. You can delete your account and its data from inside the app at any time.

What we collect

What	Why
Your email address	To identify your account and let you sign in. If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple's private relay address.
Your public user ID	The name other players see. You choose it, and you can change it.
Your display name from Apple or Google	Only if you sign in with one of those and it provides one. Used as a fallback name on a pool roster.
An internal account identifier	Assigned by Firebase Authentication. It links your data together and is shown in the app under "Technical account ID" for support.
Pools you create or join	Pool settings, who is in them, the teams assigned to you, scores and spreads entered, and standings.
Messages you send in pool chat	So the other people in that pool can read them.
Notification tokens	One per device you sign in on, so we can send you push notifications. Removed when you sign out or delete your account.
Email addresses you invite	When you invite someone to a pool, we store that address so they can join, and we send them one invitation email. This can include people who have never used the app.

What we do not collect

No analytics or tracking. The app contains no analytics SDK and no advertising SDK. We do not build a profile of your behaviour or track you across other apps or websites.
No location data.
No contacts. The app never gains access to your address book, and iOS never asks you to grant it. When you tap "Invite from contacts", the list you see is shown by iOS itself, not by us — we are handed only the one person you tap, and only their name and email address, which is then used to send that invite exactly as if you had typed it. Everyone else in your contacts stays invisible to the app.
No payment information. Chameleon Bracket does not take payments, and is not a gambling service.

What stays on your device

Some settings never leave your phone and are not visible to us: your light/dark appearance choice, and which notifications you have read or cleared. Deleting the app removes them.

Who else can see your information

Other people in your pools can see your public user ID, the teams assigned to you, your standing, and anything you write in that pool's chat. They cannot see your email address.
The host of a pool you are invited to sees the email address or public user ID used to invite you, because they are the one who entered it.
Google, as our hosting provider. The app runs on Firebase — Authentication, Firestore, Cloud Functions and Cloud Messaging — so your data is stored on Google's infrastructure.
Apple or Google, if you choose to sign in with them, handle that sign-in according to their own privacy policies.
Our email provider, which delivers pool invitations.

We do not sell your information, and we do not share it for advertising.

Deleting your account

Go to Profile → Delete account. This is permanent and takes effect immediately. Specifically:

Your sign-in account, public user ID, notification tokens and settings are deleted. Your email address and public user ID become available for reuse.
Pools you host pass to the player who joined first. A pool with no one else in it is deleted entirely.
You are removed from pools still in progress, and the teams you held go back into play.
Finished pools keep your results, listed as "Former player" rather than your name. We do this so other players' completed standings and chat history stay intact and are not silently rewritten after the fact.
Messages you sent in pool chat remain visible to that pool, shown without your name, for the same reason.

If you would rather we erase that remaining history too, email us and we will do it by hand.

How long we keep things

Pool data is kept while the pool exists. Pools are kept so you can look back at past seasons. Notification records are removed when your account is deleted. We do not keep backups of deleted accounts beyond what our hosting provider retains for ordinary disaster recovery.

Security

Access is enforced server-side with Firestore security rules, so the app cannot read a pool you are not in. Sign-in is handled by Firebase Authentication; we never see or store your password. No system is perfectly secure, and we will tell affected users promptly if we ever learn of a breach involving their data.

Children

Chameleon Bracket is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, email us and we will delete it.

Your rights

You can see and change your public user ID in the app, delete your account in the app, and email us to ask what we hold about you, to correct it, or to have it erased. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA; we will honour those requests regardless of where you are.

Changes to this policy

If this policy changes in a way that materially affects you, we will update the date at the top and notify you in the app before the change takes effect.

Contact

Questions, requests or complaints: support@chameleonbracket.com.