Basketball League — Privacy Policy
Who we are and what this covers
Basketball League (the "Game") is published by Northern Digital Systems LLC ("we" or "us"), 4077 Liberty Ave, Ogden, UT 84403. This policy explains what the Game collects, why we collect it, who receives it, and the choices you have. Questions: info@northerndigitalsystems.com. Your use of the Game is also governed by our Terms of Service.
Information we collect
We collect the information below to run the Game. You can play as a guest without giving us an email address.
- Account details. A random player ID, your username, and a friend code. If you register by email, we store your email and a salted hash of your password (never the password itself). If you sign in with Google, we store your Google account identifier and verified email.
- Age and agreement record. The Game asks for your birth month and year. This is checked on your device only; we do not store or receive your birthdate or age. We record that you confirmed you are 13 or older, which versions of these documents you accepted, and when.
- Gameplay data. Your career, league, roster, inventory, season and draft progress, game results, time played, last-seen time, and timezone. Game logic runs on our server, so this data is stored there.
- Anti-cheat data. Signed tickets and gameplay input logs that your device sends so our server can verify results. We replay the input logs to check the result and then discard them. We keep the verified game results, such as your score and match summary, until you delete your account.
- Purchases. The product purchased, coins granted, and the Google Play purchase token. Google Play processes payment; we never receive your card number.
- Rewarded-ad records. When an ad session was issued, whether the reward was granted, and the ad network's transaction ID. We use this to enforce the 10-minute cooldown and prevent duplicate rewards, and we keep these records until you delete your account.
- Social data. Your friend list and your username and profile stats, which other players can see.
- Device and technical data. Device model, operating system, app version and build, a per-launch session ID, user-agent string, crash and error reports, and your IP address (used for abuse throttling and server logs; it is not saved in our database). If you allow notifications, we also store a push notification token.
- Data stored on your device. Save files and a cache are stored on your phone in unencrypted form and may be included in your device's backups. Uninstalling the Game removes them from your phone.
The Game does not ask for your precise location, contacts, photos, camera, or microphone.
How we use information
We use your information only to run, secure, and improve the Game.
- Provide your account, save your progress, and run leagues and matches.
- Fulfill purchases and rewarded-ad rewards.
- Verify results, detect cheating, and prevent fraud and abuse.
- Send notifications you have allowed.
- Diagnose crashes and fix bugs. Diagnostic reports go only to our own server, are used only for our internal troubleshooting, are not shared with third parties or used for advertising, and are kept for 14 days.
- Keep the community safe and act on abuse.
- Meet legal obligations and enforce our Terms of Service.
We do not use your information for personalized advertising or to build advertising profiles. We do not sell your personal information.
Who we share information with
We share information only with the services and people below, and only as needed for the stated purpose.
| Recipient | What they receive | Why |
|---|---|---|
| Google Play (Billing) | Product ID, purchase token, obfuscated account and profile IDs | Verify purchases and prevent fraud |
| Google AdMob | Device and advertising identifiers, IP address, ad interactions, and diagnostic information | Show rewarded ads, confirm rewards, and prevent ad fraud |
| Google Sign-In (only if you use it) | Your Google ID token | Verify your sign-in |
| Expo push service, Firebase Cloud Messaging, and browser push services (web only) | Push token and notification text, which may include league names, the username of someone who invites you, and player names | Deliver notifications you allow |
| Cloudflare | Network traffic to our server | Security and delivery |
| IONOS (hosting provider), United States | All data stored on our server | Run the Game |
| Other players | Username, friend code, and profile stats | Social features |
We may also disclose information when the law requires it, to protect the safety of players or the public, or in a merger or sale of our business. We do not sell your information to data brokers.
Ads and rewarded ads
The Game shows rewarded ads through Google AdMob, and only when you choose to watch one. After you collect a reward, you can watch another ad after a 10-minute cooldown, which our server tracks.
We request non-personalized ads only. AdMob may still collect device identifiers such as your Android advertising ID, your IP address, and ad interaction and diagnostic data, under Google's own privacy practices. You can reset or delete your advertising ID in your Android settings.
Age requirement and children
The Game is for people 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from them.
When you first open the Game, it asks for your birth month and year and checks them on your device. If you are under 13, the Game stops and nothing from that screen is sent to us.
If we learn that an account belongs to someone under 13, we will flag it and delete the account and its data after review. If you believe a child under 13 is using the Game, email info@northerndigitalsystems.com.
Players under 18 need a parent or guardian's permission to play and to make purchases.
How long we keep information
We keep information only as long as we need it for the purposes above.
| Data | How long we keep it |
|---|---|
| Account and gameplay data | Until you delete your account. Guest accounts inactive for 360 days are deleted, unless the account ever bought coins. |
| Age and agreement record | For the life of the account |
| Login sessions | 90 days, renewed while you play |
| Diagnostic and crash reports | 14 days |
| Rewarded-ad records | Until you delete your account |
| Anti-cheat input logs | Input logs are not stored. Verified game results are kept until you delete your account. |
| Purchase records | Kept after you delete your account, for as long as needed to prevent double-crediting and for tax and accounting records |
| Server backups | Nightly backups are kept for 14 days, so deleted data can remain in backups for up to 14 days |
| Server logs | Short-lived rotating logs, which may include IP addresses |
Deleting your account and your choices
You can delete your account at any time. In the Game, go to Settings and choose Delete account. If you cannot open the Game, use our web request page at https://retrobasketball.northerndigitalsystems.com/account-deletion.html or email info@northerndigitalsystems.com from the address on your account. We respond within 30 days.
When you delete your account, we delete your profile, login sessions, push tokens, friendships, and career, league, and inventory data. We also delete your ratings, squads, and rewarded-ad records. We keep a record of coin purchases (Google Play purchase token, order number, product, amount, and date) after deletion, to prevent double-crediting and for accounting. Once your account is deleted, the record has no name, email, or link to your account. Diagnostic reports lose their link to your account and are deleted after 14 days. Deleted data may remain in backups for up to 14 days. If other people play in a league you were in, the league carries on without you: another member becomes commissioner and your team goes back to the computer.
Guests who have uninstalled. Delete your account in Settings before you uninstall the Game. If you have already uninstalled, we may not be able to verify that a guest account is yours, because guests have no email or password. Guest accounts that have never bought coins and are inactive for 360 days are deleted automatically. If you bought coins as a guest, send us your Google Play order number and we will use it to find and delete the account.
Other choices:
- Turn off notifications at any time in your device settings.
- Reset or delete your advertising ID in your Android settings.
- Play as a guest to avoid giving us an email address.
Depending on where you live, you may have the right to ask us to access, correct, or delete your personal information. Email us and we will respond within the time the law requires. We will not treat you differently for making a request.
Security and where data is processed
We protect data in transit with HTTPS, store passwords only as salted hashes, and store login tokens only as hashes. No system is perfectly secure, so we cannot guarantee the safety of your information.
Our game server is hosted by IONOS in the United States, behind Cloudflare. The Game is offered in the United States only, and your data is processed in the United States.
Changes and contact
If we make a material change to this policy, we will update the version and ask you to accept it again in the Game.
Northern Digital Systems LLC
4077 Liberty Ave, Ogden, UT 84403
info@northerndigitalsystems.com