Your data, plainly
Privacy policy
Last updated: October 9, 2026
Short version: we collect what it takes to run your league, we never sell it, and you can ask us to delete it at any time.
What we collect
- Your account. Your email address, username, and password. Passwords are stored only in scrambled (hashed) form, so we can't read them. If you sign in with Google, Google shares your basic profile with us: your name, email address, and profile picture. If you sign in with a code, we email that code to you.
- Your profile. Your PSN / Gamertag, plus anything you choose to add: display name, photo, bio, console, Discord user ID, X handle, and stream or YouTube links.
- Your league activity. Teams, games, scores, box scores, recruiting, Legacy Points, news, and the other records you or your league's admins enter.
- Images you upload. Screenshots and photos (more on those below).
- Billing records. If you buy a plan, a Stripe customer ID and your subscription status. Nothing else about your payment.
- Technical logs. Like most websites, our hosting providers record standard request details, such as IP address and browser type, for security and troubleshooting.
How we use it
To run LegacyCFB: sign you in, show your leagues, keep your league's history, send the emails you need (sign-in codes, password resets, and answers to league applications), and post to your league's Discord when your league turns that on.
We don't sell your information, we don't show ads, and we don't share it with anyone except the services listed below that help run the site.
Who can see it
Other members of your leagues see your profile and your league activity, and your league's admins can manage your league records. Some league pages, like a league's home page, news, and leaderboard, can be viewed by visitors who aren't signed in.
Images you upload
Photos are resized and re-saved before we store them, which strips hidden details such as the GPS location your phone attaches (animated GIFs are kept as uploaded). Images are stored on Cloudflare R2 and served from a public web link, so anyone who has the link can view the image.
Payments
Payments run through Stripe. You enter your card on Stripe's own checkout page and manage or cancel your plan in Stripe's billing portal, so your card number never touches our servers. Stripe's handling of your payment details is covered by Stripe's privacy policy.
AI features
When you or your league use an AI feature (reading a game screenshot, writing league news, or creating an image), the screenshots, photos, text, and league details involved are sent to Google's Gemini service to produce the result.
Services that help run LegacyCFB
- Render hosts the site and its database.
- Cloudflare sits in front of the site, stores uploaded images, and relays our requests to Discord and Google.
- Stripe processes payments.
- Resend delivers our email.
- Google provides Sign in with Google (if you use it), the Gemini AI service, and the site's fonts.
- Discord receives league updates, such as scores, cards, and articles, when a league connects its Discord channels. If you add your Discord user ID, our posts can mention you and our bot can send you direct messages about your league.
- YouTube and Twitch video players are embedded on League TV pages to show live streams.
Cookies
We set only the cookies the site needs to work: one that keeps you signed in (it lasts 90 days and resets each time you visit), one that protects forms from forgery, and a short-lived one that carries one-time notices. Your light/dark theme choice is saved in your own browser. We use no advertising or analytics cookies and don't track you across other sites. Embedded YouTube or Twitch players can set their own cookies when a stream loads.
Keeping and deleting your data
We keep your information while your account is open. To delete your account, email [email protected] from the address on your account and we'll delete it. You can also email us for a copy of your information or to fix something that's wrong.
League records other members rely on, like game results, standings, and league history, may stay in that league after your account is gone.
Children
LegacyCFB isn't meant for children under 13, and we don't knowingly collect their information. If you believe a child under 13 has an account, email us and we'll delete it.
Changes and contact
If we change this policy, we'll update the date at the top, and we'll let you know on the site or by email about significant changes. Questions about your privacy? Email [email protected].