Rewind Fantasy
Privacy Policy
Last updated 27 September 2026
Rewind Fantasy is a daily game, not a data business. There is no advertising on it, no cookies, no tracking pixels, and nothing here is sold or shared for marketing. We do count visits and look at where people click, so we can tell what works — and neither is ever linked to who you are. This page says exactly what is collected and who else touches it.
Rewind Fantasy is operated by RR6 Consulting ("we", "us"), which is the controller of the personal data described below. Questions, requests and complaints go to rewindfantasyinfo@gmail.com.
What we collect
Automatically, on every visit
Opening the site creates an anonymous account so you can play without signing up. That account is a random identifier and nothing else — no name, no email, no profile. If you never sign in, that identifier and any rounds attached to it are all we hold.
If you create an account
- Your email address, whether you sign up with a password or through Google
or Apple. From Google and Apple we request only the standard sign-in scopes
(
openid, email, basic profile) and we store the email address. - A display name you choose. It is yours to pick and to change.
When you play
- The seven players you drafted, your score, how many seconds were left when you submitted, and the date you played.
- Nothing about your device beyond what any web server sees.
Versus, where friends draft against each other on one phone, is kept on that phone. The names typed in, the picks and the results never reach us: our server hands out the week and scores the finished rosters from player identifiers alone, and keeps neither. All we record is a count of games started and finished each day, and how many players each had.
How the site is used
Three things. The first two are not connected to your account, your display name or your email; the third is kept with a daily challenge round, which is.
- Visit counts, through Vercel Web Analytics: which pages and screens were viewed, the site that sent you, your country, and your browser, operating system and device type. Vercel tells visitors apart only by a code worked out from the request, which changes every day, so no visitor can be followed from one day to the next or from one website to another. It sets no cookies. We see totals, never individuals.
- Where people click, recorded by us: which screen was showing, where on it the click landed, the size of the window, whether it was a phone, tablet or computer, the name of the part of the page that was clicked (such as the Play button), and whether that part does anything. Each visit gets a random code, made fresh every time the page loads and kept only in the page's memory, so we can tell one visit's clicks from another's. We never record anything you type or any text shown on the page.
- The kind of screen a game was played on: phone, tablet or computer, worked out from the width of the window. For the daily challenge it is kept with that day's round; for Versus it is added to the day's count of games, which holds no account, no week and no score. Nothing else about your device is sent or kept.
Referral links
Every player has a short referral code, and the link in a shared score carries it (for example
rewindfantasy.com/?r=K7QM2X). When someone opens the site for the first time through
that link, we record that their anonymous account arrived through that code. Only someone new to
the site is recorded, and only the first link they arrive through counts.
We use it to count how many people each player has brought to the game — how many visited, how many went on to play, and how many signed up — and may use those counts for referral rankings or rewards.
Groups
If you create or join a group, we keep the group's name, its invite code, who created it, who is in it and when each member joined. Leaving a group removes you from it. Deleting a group removes every member from it; we keep a record that the group existed, with its name, so an old invite link can say it was deleted. Your rounds are never changed by a group. To stop invite codes being guessed, we note the time of each code you enter that does not work, against your account, and allow twenty an hour; the code itself is not kept.
Shared score links
When you share a daily score to Facebook, we make a link for that one result with its own random
code (for example rewindfantasy.com/s/7KQM2XAB). Anyone who has the link, and any site
that shows a preview of it, can see that result's date, score, percentage and seven result marks.
The link does not show your name, your display name or anything else about you, and nothing in the
link leads to your other results. It is kept for as long as the result is.
Password reset requests
To stop the reset form being used to flood an inbox, we limit it to three emails per address per hour. To count that we keep a one-way fingerprint of the address — a SHA-256 hash, which cannot be turned back into the address — with the time it was asked for, and we delete it within a day. We do not store the address itself, and the record is not linked to any account.
Display names that get refused
Display names run through a word filter. When one is refused, the text you tried is recorded along with your account identifier. That log exists for one reason: it is the only way we ever find out the filter has wrongly refused a legitimate name. It is not used for anything else. Group names go through the same filter, and a refused one is recorded the same way.
What we do not collect
Nothing that links how you use the site to you: the visit counts and clicks described above are never tied to your account. The one link between accounts we keep is the referral record described above. No advertising or advertising identifiers. No cookies, and no tracking across other websites. No location beyond the country a visit comes from. No payment details — the game is free and takes no payments. We do not sell, rent or share personal data for anyone's marketing, and we never have.
What is stored on your device
We set no cookies. These are kept in your browser's own storage:
| Your sign-in session | Kept in localStorage by our authentication provider so you stay signed in
between visits. Clearing your browser data signs you out. |
|---|---|
| Sign-in notes | Kept in sessionStorage: which provider you last pressed, whether a sign-in has
already been retried, and whether a provider was unavailable, so that if a sign-in bounces
back with an error we can recover it. They last as long as the tab. |
| A round you are playing | Kept in sessionStorage: which unlimited round is running, and a roster whose
submission got no answer, so that reloading the page picks the round back up instead of
losing it. Cleared once the round is scored, and gone when the tab closes. The results of the
last unlimited round you finished, and which screen you were on and how far down it, so that
reloading the page shows you the same thing; replaced by the next round, and gone when the tab
closes. |
| A Versus game | Kept in localStorage: the last setup (how many players, their names, the draft
type) and the game on the phone — the week, the picks and, once it is scored, the
results — so a closed tab does not lose it. Cleared when you start another game or
discard it. None of it is sent to us. |
| A group invite you opened | Kept in localStorage if you opened an invite link: its code, until you have
joined or the code turns out not to work, so signing in first does not lose it. At most a
day. |
| A referral code you arrived with | Kept in localStorage if you opened the site through a shared link: the code
until our server has recorded it, and then a note that it has been handled, so a later link
is not counted again from the same browser. |
None of it is used to track you, here or anywhere else.
Who else processes it
We use a small number of service providers. They act on our instructions and may only use the data to provide their service to us.
| Supabase | Database and sign-in. Holds your account, display name and rounds, and the click records described above. Hosted on Amazon Web Services in the United States (US East, Ohio). |
|---|---|
| Vercel | Hosts and serves the site, and counts visits (Vercel Web Analytics). Keeps ordinary server logs, which include IP addresses. Processed in the United States. |
| Resend | Sends account email — confirmation and password reset. Receives your email address. |
| Google Fonts, jsDelivr | Serve the typefaces and one JavaScript library the page loads. As with any resource a browser fetches, they receive your IP address as part of the request. |
| Google, Apple | Only if you choose to sign in with them, and only then. Their own privacy policies govern what they do with that. |
Where your data lives. Our database and hosting are in the United States. If you use the site from elsewhere, your data is transferred there.
What other players can see
If you have signed in and chosen a display name, that name and your score appear on the daily leaderboard. Your lineup does not, and that is deliberate — showing it would spoil the day for anyone who has not played yet. Your email address is never shown to anyone. Guests are not ranked and do not appear at all.
A player can see how many people arrived through their own referral link, went on to play and signed up — never who they are.
In a group, the other members see your display name, when you joined, and your Daily Challenge record — how many rounds you have played, your average, best and daily percentages of the best lineup, your streak, and the days you topped the group — over your whole history, including rounds played before you joined. They never see your lineups. Anyone with a group's invite code can join it, so share the code only with people you want in it.
How long we keep it
- Your account and rounds: for as long as the account exists.
- Anonymous accounts: every visit creates one, so most are empty. Empty ones older than 30 days are deleted.
- Refused display names: kept while we are still tuning the filter.
- Click records: deleted after 90 days.
- Referral records: for as long as both accounts exist. If you arrived through a link and never played or signed up, the record is deleted with your empty anonymous account after 30 days.
- Visit counts: Vercel keeps the totals for up to 12 months.
Your choices
Email rewindfantasyinfo@gmail.com and we will:
- Delete your account, which removes your profile and every round attached to it.
- Send you a copy of what we hold about you.
- Correct anything that is wrong.
You can change your display name yourself at any time from the account panel in the menu.
Depending on where you live you may have further rights — to object to or restrict processing, or to complain to your data protection authority. Ask us and we will help rather than make you argue for it.
Children
Rewind Fantasy is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, write to us and we will remove it.
Security
Accounts and game data are protected by row-level security in the database, which means one player's queries cannot reach another's rounds. Scoring is computed on the server and never sent to the browser during a round. No system is perfect, and we do not claim otherwise.
Changes to this policy
If this policy changes materially we will update the date at the top of this page. Continuing to use the game after a change means you accept it.
Contact
RR6 Consulting
rewindfantasyinfo@gmail.com