Privacy Policy

What we collect

• Email address (only if you choose to register). Used solely for magic-link sign-in and account-related notices.
• IP address (HMAC-hashed, never stored in raw form). Used for spam/abuse rate-limiting and one-vote-per-IP enforcement.
• Session cookie (random UUID, HMAC-hashed before storage). Used to enforce one vote per matchup for anonymous voters.
• Bracket and voting activity — the content you create and the matchups you vote in.

What we do NOT collect

• Payment info — TopCeed is free.
• Geolocation, contact lists, or device fingerprints.
• Third-party advertising trackers.

Cookies

We use two kinds of cookies:

• tc_vid — an anonymous voter cookie set the first time you cast a vote. HttpOnly, SameSite=Lax. We hash it before storing.
• NextAuth session cookies — only set if you sign in with magic link.

Email

We send transactional email via SendGrid for magic-link sign-in only. We do not send marketing email.

Data retention

We retain your data until you ask us to delete it. To request export or deletion, email us via the contact form.

Third parties we share data with

• SendGrid — to deliver your magic-link sign-in email. Subject to SendGrid’s privacy policy.
• Replit — our hosting provider. App data is stored in Replit Postgres and image files in Replit App Storage. Subject to Replit’s privacy policy.

Your rights

You can request a data export, a deletion of your account and all associated data, or any other privacy-related action at any time via our contact form.