Privacy Policy
We're committed to protecting your privacy and ensuring the security of your personal information.
Last updated: September 5, 2026
Introduction
Welcome to Leaderboard Fantasy Sports, a service operated by DCS Ventures, LLC ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your information when you use our fantasy golf platform and related services.
By using our website and services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.
Information We Collect
Personal Information You Provide
We collect information you voluntarily provide when you:
- Create an account: Name, email address, and password
- Use social login: Information from Google or Facebook (when enabled)
- Contact us: Name, email, subject, and message content
- Participate in contests: Fantasy team selections and roster information
- Subscribe to updates: Email address for newsletters and notifications
- Interact on our platform: Messages, comments, and communications with other users
Information Collected Automatically
When you use our services, we automatically collect certain information:
- Usage Data: Pages visited, time spent, features used, and interaction patterns
- Device Information: Browser type, operating system, device identifiers
- Log Information: IP address, access times, error logs, and security events
- Cookies and Tracking: As described in our Cookie Policy
- Analytics Data: Website performance and usage through Google Analytics — only if you choose "Accept analytics" in our cookie banner. In the mobile app, Firebase Analytics is off until you switch on Share Usage Analytics in your profile's Privacy settings.
- Error and Diagnostic Data: When something breaks, an error report is sent to Sentry — the error message and stack trace, the page or screen involved, and browser/device metadata. The mobile app attaches your account ID so we can tell whether a crash affected one person or everyone; the website attaches no identifier. The website also records a small sample of masked session replays (all text is masked and all images and video are blocked before the recording leaves your browser) to reproduce faults.
- Bot-Protection Signals: Cloudflare Turnstile runs on our registration, newsletter, contact, feedback, and email-verification forms and evaluates browser signals to confirm you are not a bot.
Email open tracking is off
Email we send you carries no open-tracking pixel and no click-tracking redirect. Both are disabled on every message addressed to a user, so we do not record whether you opened an email or which links you followed. Historical engagement timestamps recorded before we turned this off remain on your account record until you delete your account. Our email provider still processes your address in order to deliver the message, and it keeps its own delivery records (such as whether a message bounced) under its own terms.
Third-Party Information
We may receive information about you from third-party sources, including:
- Social Media Platforms: Profile information when you use social login
- Golf Data Providers: Tournament information, player statistics, and scoring data
- Analytics Services: Aggregated usage and performance data
How We Use Your Information
We use the information we collect for the following purposes:
Core Services
- Create and manage your account
- Provide fantasy golf contest functionality
- Calculate scores and maintain leaderboards
- Enable communication features
- Process contest entries and roster management
Communication
- Send account-related notifications
- Respond to inquiries and support requests
- Send contest invitations and reminders
- Deliver newsletters and the weekly digest (only with your opt-in consent)
- Notify of system updates
Marketing email is opt-in
We only send you the weekly digest and promotional/newsletter email if you affirmatively opt in — the checkbox on our registration form is unticked by default, and creating an account never subscribes you. We record each opt-in and withdrawal, including when it was made and which version of this policy was in effect at the time.
You can grant or withdraw this consent at any time from your profile settings or the unsubscribe link in any marketing email. Withdrawing it does not stop service messages you are a party to — account and security notices, and invitations and results for contests you have joined.
Platform Improvement
- Analyze usage patterns
- Develop new features
- Optimize performance
- Conduct research and analytics
Security & Legal
- Protect against fraud and abuse
- Enforce terms of service
- Comply with legal obligations
- Resolve disputes
Sponsored Content & Featured Contest Advertising
From time to time, the Featured Contest recommendation on your dashboard (desktop web, mobile web, iOS, and Android) may display a clearly labelled sponsored contest from a golf brand we've partnered with. Sponsored placements always carry a "Sponsored by" label, and viewing sponsor details is always a deliberate action you take — a sponsor promotion never opens automatically.
What we measure
We record only first-party, aggregate counts of how a sponsorship performs:
- Card impressions: a sponsored card was shown on screen
- Promotion opens: a viewer opened the sponsor detail dialog or sheet
- CTA clicks: a viewer activated the sponsor's call-to-action
Each event increments a daily counter bucketed only by campaign, contest, placement, surface (desktop web / mobile web / iOS / Android), and calendar date — never a per-person or per-device record.
What we explicitly do not collect for sponsorship
- No user ID, account, or session identifier
- No device identifier or advertising ID (IDFA/GAID)
- No Google Play Age Signal data — that feature is entirely separate from sponsorship and is never combined with it in any way
- No third-party advertising pixel, SDK, or tracker
- No personally identifying parameters on a sponsor's call-to-action link (no user id, email, or name is ever appended)
Sponsorship telemetry is sent anonymously — the request that records an impression, open, or click carries no session cookie, signed user header, or correlation id.
Leaving our platform
A sponsor's call-to-action link opens the sponsor's own website in a new tab or your device's browser. That site is operated by the sponsor, not by us; this Privacy Policy does not apply once you leave leaderboardfantasy.com or the app, and we encourage you to review the sponsor's own privacy policy before providing them any information.
Reporting a sponsorship: Every sponsor promotion includes a "Report this sponsorship" action, which pre-fills our contact form with the sponsor name and campaign details so you can flag misleading, inappropriate, or broken sponsor content. You can also contact us directly at any time.
Information Sharing and Disclosure
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
Service Providers
We share information with the service providers below, each only for the purpose described and only with the data that purpose requires. This is the complete list of processors that receive personal data from our website, our API, or our mobile app:
- Email Delivery — Mailjet (Sinch): your email address, display name, and the content of the message we send you, for account, contest, support, and (opt-in only) marketing email
- Website Analytics — Google Analytics: page views, device and browser metadata, IP address, and analytics cookie identifiers — only after you accept analytics cookies
- Mobile Analytics — Firebase Analytics (Google): app screen views, a fixed set of product events, device metadata, and your account ID — only after you enable Share Usage Analytics in the app
- Authentication — Google and Meta (Facebook Login): the sign-in exchange discloses to them that you are signing in to our service; we receive your name and email in return
- Error Monitoring — Sentry: error messages and stack traces, the page or screen involved, device and browser metadata, IP address, masked website session replays, and (mobile only) your account ID. Processed in the United States
- AI Features — Google Cloud (Vertex AI / Gemini): the content of your Caddie chat messages and the contest context they relate to — see AI Features and Caddie below
- Contact-Form Spam Screening — OOPSpam (via RapidAPI): the message you typed into our contact form, the email address you supplied, and your IP address. If that service is unavailable, the same message content is screened by Google Vertex AI instead
- Bot Protection — Cloudflare (Turnstile): browser signals and a verification token from our registration, newsletter, contact, feedback, and email-verification forms
- Network Edge and Security — Cloudflare: all traffic to our website and API passes through Cloudflare's edge for TLS, DDoS protection, and caching, so your IP address and request metadata are processed there
- Static Asset Delivery — Cloudflare (cdnjs) and jsDelivr: our pages load an icon font from Cloudflare's cdnjs service, and our contest leaderboard loads a charting library from jsDelivr. Your browser fetches those files directly from them, so each sees your IP address and browser user-agent. We ask your browser to send no referrer with the cdnjs request; the jsDelivr request does tell it which page you were viewing. This is separate from the Cloudflare edge entry above, which covers traffic to our own site
- Push Notifications — Expo: your device's push token and the content of the notification (its title, body, and the screen it opens), routed to Apple's and Google's push services
- Breached-Password Screening — Have I Been Pwned: only the first five characters of a one-way hash of a candidate password. Your password, the full hash, and your identity never leave our servers, and the request cannot be linked back to you
- Hosting — Hostinger: our production servers and database, which hold all of the information described in this policy
- Backups and Archives — Google Cloud Storage: database backups and archived security audit records
We maintain an internal inventory of these processors — what each one receives, why, and where it processes it. If you would like the current version, contact us and we will send it to you.
Legal Requirements
We may disclose your information when required by law or to protect our rights, property, or safety.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
AI Features and Caddie
Some features on our platform are powered by a third-party AI service — Google Cloud's Vertex AI, running Google's Gemini models. Where that is the case, the text involved leaves our servers and is processed by Google in order to generate a response.
What we send to Google
- Caddie chat: the message you type, the earlier messages in that conversation, and the contest, tournament, and roster context your question relates to. Whatever you type into Caddie is sent to Google — please do not type anything into it you would not want processed by a third party.
- Contest invitations and BeatCaddie picks: the contest and roster details needed to draft the text or the picks.
- Contact-form spam screening (fallback only): if our primary spam-screening provider is unavailable, the message content you submitted is screened by Vertex AI instead. This tier is capped and only runs while the primary provider is failing.
What we do not do
- We do not use Caddie conversations to make any decision that produces a legal or similarly significant effect about you. Caddie answers questions about golf and your contests; it does not decide anything.
- We do not send your name, email address, or password to the AI service as part of a chat. Caddie is scoped to the account making the request so that it can only look up your own contests and rosters.
- We do not sell or share AI conversation content with anyone beyond the provider that processes it for us.
How long chat transcripts are kept
We store your Caddie conversations so you can scroll back through them. We keep the most recent 100 messages in a conversation and your 25 most recently active conversations; anything older is deleted automatically. Everything we hold is deleted when you delete your account. See Data Retention for the full schedule.
Using AI features is your choice. Caddie only runs when you open it and send a message — nothing is sent to the AI service if you never use it. AI-generated answers can be wrong or incomplete; treat them as suggestions about a game, not as advice.
Data Security
We implement appropriate technical and organizational measures to protect your personal information:
Encryption
Industry-standard encryption for data transmission and storage
Access Controls
Restricted access on a need-to-know basis
Monitoring
Regular monitoring for unauthorized access
While we strive to protect your information, no method of transmission over the internet is 100% secure. We continuously work to improve our protections.
Data Retention
Below is how long we keep each category of personal information. Where a period is stated, deletion is automatic — our database enforces it. Where no fixed period applies, the criterion that governs deletion is stated instead.
| Category | How long we keep it |
|---|---|
| Account and profile information | For as long as your account exists. If you don't sign in for 12 months we email you twice over 30 days; unless you keep the account (one click in the email, or a sign-in) it is then deleted automatically. Accounts that never verified their email address are deleted 90 days after registration. |
| Contest entries, rosters, and results | For as long as your account exists — they are the competitive record other participants rely on. Deleted with your account. When an account is deleted — by you or after inactivity — the standings of contests you finished are kept for the other participants, with your name replaced by a placeholder. |
| Messages you post to other users | Until you or a group administrator deletes them, or until you delete your account. |
| Caddie chat transcripts | The newest 100 messages per conversation and your 25 most recently active conversations; older messages and conversations are deleted automatically. All deleted with your account. |
| Contact-form submissions | Spam-screening records: 90 days. Messages held in quarantine: 30 days after a moderator decides on them. Messages that reach our support inbox are kept for as long as the support matter is open. |
| Security audit records (sign-ins, permission and account changes) | Moved to restricted-access archive storage at 90 days; the live database purges them at 150 days at the latest. |
| Sign-in attempts and abuse rate-limiting records | 15 minutes to 24 hours, depending on the protection. Deleted automatically. |
| Session, password-reset, and email-verification tokens | Deleted when they expire: sign-in sessions up to 30 days, email verification 24 hours, password reset 1 hour. |
| Push notification tokens and delivery records | Tokens: until you sign out, uninstall the app, or turn notifications off. Delivery receipts: 24 hours. Notification state: 30 days. |
| Marketing-consent records | Kept for as long as your account exists, including withdrawals — we have to be able to show what you chose and when. |
| Privacy-request records (your data-download and deletion requests) | We log the date, type, and response deadline of each request. The record survives account deletion so we can show a request was answered on time, but your identity is replaced with a placeholder at that point — the log no longer points back to you. Automated inactivity deletions are logged in the same way. |
| Cookie-consent record | 180 days, after which we ask again. Stored in your browser, not on our servers. |
| Sponsorship measurement | Aggregate daily counts only — no per-person record is created, so there is nothing personal to retain. |
| Operational logs and job records | Scheduled-job records: 14 days. Contest standing snapshots: 30 days. |
| Database backups | 7 days, then deleted automatically. Deleted data can persist in a backup for up to this long after you delete it. |
| Error telemetry and analytics held by our providers | Retained by Sentry, Google Analytics, and Firebase under their own retention settings and terms, not on our servers. |
You may request deletion of your account and associated data at any time. We may retain a limited amount of information for longer where the law requires it, or where we need it to resolve a dispute or enforce our agreements — and only for as long as that reason lasts.
Your Rights and Choices
Depending on your location, you may have certain rights regarding your personal information:
Access & Portability
- Request access to your personal information
- Download a copy of your data in a portable, machine-readable format (JSON) at any time — Profile → Account Management → Download My Data on the website, or Profile → Account Management → Download My Data in the mobile app
- Review and update your account information
Correction & Deletion
- Correct inaccurate information
- Request deletion of your personal information
- Close your account and associated data
Communication Preferences
- Unsubscribe from promotional emails
- Opt out of non-essential communications
- Manage notification preferences
Analytics Preferences
- Change or withdraw your website analytics choice at any time using Cookie settings at the bottom of any page
- Turn mobile analytics on or off under Profile → Privacy → Share Usage Analytics
Consent & Objection
- Withdraw consent for data processing
- Object to certain uses of your information
- Restrict processing of your personal data
How to Exercise Your Rights: Access and portability are self-service — use Download My Data under Account Management on your profile page (or the same option in the mobile app) to get an immediate machine-readable copy of everything we hold about you. Account deletion is self-service in the same place. For anything else, contact us or email [email protected]. We log every request we receive and respond within 30 days, which meets both the GDPR one-month deadline and the CCPA/CPRA 45-day deadline.
Children's Privacy
Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. Registration on every platform is age-gated: we ask for your date of birth when you create an account, check it against the 13+ minimum, and then discard it - the date is not written to your account or retained anywhere. On Android we additionally use the Google Play Age Signal. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
For users between 13 and 18, we encourage parental guidance as outlined in our Fair Play & Responsible Participation policy.
International Data Transfers
Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws than your jurisdiction. In particular, our error-monitoring provider (Sentry) processes error and diagnostic data in the United States, and our network-edge provider (Cloudflare) processes traffic at data centres worldwide. The service providers listed above operate in a number of jurisdictions; we can tell you where a specific provider processes your data on request.
When we transfer your information internationally, we ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.
Third-Party Links and Services
Our website may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to these third-party services, and we are not responsible for their privacy practices.
We encourage you to review the privacy policies of any third-party services you access, including Google's Privacy Policy, Facebook's Privacy Policy, and any golf data providers we integrate.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy with a new "Last updated" date, sending email notifications for significant changes, and displaying prominent notices on our platform.
Your continued use of our services after any changes constitutes acceptance of the updated Privacy Policy.
Contact Us
DCS Ventures, LLC, operating as Leaderboard Fantasy Sports. If you have any questions or need assistance, we're here to help:
We value your input in maintaining a positive fantasy sports community.
Related Policies: This Privacy Policy should be read in conjunction with our Terms of Service, Cookie Policy, and Fair Play & Responsible Participation policy.