Privacy Policy

Effective May 26, 2026

Saturdays (“we,” “us”) is a college football recommendation service operated at watchsaturdays.com. This page explains what data we collect, what we do with it, and how to exercise your rights over it.

What we collect

Account data

When you sign up we collect:

Email address (required)
Password, hashed and stored by our auth provider — we never see the plaintext
Birthdate (required, used solely to verify you’re 13 or older). We never use birthdate for marketing, advertising, analytics, or any other purpose. Accounts indicating an age under 13 are not created.
Name, username, phone number, country code, and avatar (optional, set during onboarding)
Favorite teams and conferences (up to 3 each, used to personalize recommendations)

Subscription data

Payment processing is handled entirely by Stripe. We never see, store, or transmit your card number, CVC, or full billing address. We store only the Stripe customer/subscription IDs, your plan (monthly or Season Pass), and the period dates — enough to know whether your subscription is active.

Usage

We log basic request metadata (IP address, user agent, timestamps) on our servers, primarily for security and operational debugging. We do not run analytics scripts that track you across other websites.

How we use it

To run your account and authenticate you across sessions
To personalize game recommendations based on your favorite teams and conferences
To bill your subscription and tell you about billing problems (renewal failures, cancellations)
To respond to support requests you send us
To monitor and protect the service from abuse

We do not sell your personal data, and we don’t share it with advertisers.

Service providers

The third parties that help us run Saturdays:

Supabase — authentication and database (your account row + favorites)
Stripe — subscription billing
Vercel — hosting and serverless functions
Vercel KV (Upstash Redis) — caches live game data shared across server instances

Live game data is sourced from third-party sports data providers. None of your account or usage data is sent to them — we only read game scores, rankings, and play state from them.

Cookies

We use a small number of essential cookies, primarily a session cookie that keeps you signed in. We do not use third-party tracking or advertising cookies.

Your rights

Every Saturdays user, anywhere, can:

Edit name, username, phone, birthdate, avatar, and favorites at any time on the Account page.
Cancel your subscription from the same page (Manage billing → opens the Stripe portal, or Settings → Subscriptions on iOS). Access continues until the end of the paid period.
Delete your account. The Account page has a Delete account button. This cancels your subscription, removes your favorites and profile, and erases your data from our database. Stripe retains payment-receipt records as required by tax law.
Export your data. Request a copy of your account data by emailing us (see Contact below). We respond within 30 days.

Regional rights

Saturdays is currently available to residents of the United States and Canada. As availability expands, additional regional protections apply and are listed below for reference. Email support@watchsaturdays.com to exercise any of these rights.

United States (CCPA & state privacy laws)

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comparable laws have the right to know what personal data we collect, request a copy, correct inaccuracies, and request deletion. We do not sell personal data. We will not discriminate against you for exercising these rights.

Canada (PIPEDA)

Canadian residents may request access to and correction of their personal data and may file a complaint with the Office of the Privacy Commissioner of Canada if they believe we’ve mishandled it. For residents of Quebec, additional rights under Law 25 apply — including the right to request a transcript of automated decisions affecting you.

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

For users in the EEA, the UK, or Switzerland, the data controller is Saturdays, operated by Leo Low, Charlotte, North Carolina, United States.

Our lawful bases for processing under GDPR Article 6 are:

Performance of a contract (Art. 6(1)(b)) — operating your account, processing your subscription, and delivering the recommendation engine you signed up for.
Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, anti-abuse, server logs, and operating the ranking algorithm. We’ve balanced these interests against your privacy and concluded the processing is minimal and expected.
Consent (Art. 6(1)(a)) — push notifications and any future marketing email lists. You can withdraw consent at any time in Account → Notifications, or by unsubscribing.
Legal obligation (Art. 6(1)(c)) — retaining transaction records for tax and dispute purposes.

You have the right to access, rectify, erase, restrict, port, or object to our processing of your personal data, plus the right to lodge a complaint with your national supervisory authority (for example, the UK ICO, the French CNIL, or your national equivalent). We respond to verified requests within 30 days at no cost.

International data transfers. Saturdays’ infrastructure (Supabase, Stripe, Vercel, Upstash) is hosted in the United States. Transfers of personal data from the EEA, UK, or Switzerland to the US rely on the European Commission’s Standard Contractual Clauses (SCCs) and each provider’s data processing agreement.

EU/UK Representative. We do not currently have an establishment in the EU or UK. An Article 27 representative will be appointed before Saturdays is made available in those regions; this section will be updated with their contact details at that time.

Australia (Privacy Act 1988 & Australian Privacy Principles)

Australian residents may request access to and correction of their personal data and may complain to the Office of the Australian Information Commissioner.

Mexico (LFPDPPP)

Mexican residents may exercise ARCO rights — Access, Rectification, Cancellation, and Opposition — by emailing us. Complaints may be directed to INAI, Mexico’s data protection authority.

New Zealand (Privacy Act 2020)

New Zealand residents may request access to and correction of their personal data and may complain to the Office of the Privacy Commissioner.

Data retention

Account and subscription data is retained while your account is active and for a short window after deletion to handle disputes and refund requests. Server request logs roll over within 30 days.

Children

Saturdays is not intended for children under 13. Onboarding requires a birthdate that confirms you are at least 13. We do not knowingly collect data from younger users; if we learn we have, we’ll delete it.

Security

We use HTTPS everywhere. Passwords are hashed by our auth provider. Subscription data is protected by row-level security so each user can only read their own record. We can’t guarantee perfect security on the internet, but we treat your data the way we’d want ours treated.

Changes to this policy

If we make a material change we’ll update the effective date at the top and, for significant changes, notify you by email before the change takes effect.

Contact

Questions, requests, or concerns: support@watchsaturdays.com.