Privacy
locked is a fantasy football ranking game. This page describes exactly what it stores, who processes it, and how to have it removed. It is written to be read, not to be long.
Playing without an account
You can play without signing up. On your first visit the app creates an anonymous account for you. It is a random identifier, with no email or name attached. Your picks are stored against that identifier so they survive a page refresh.
That anonymous identity lives in your browser. If you clear your browser data or switch devices, it is gone and cannot be recovered.
If you create an account
Creating an account stores your email address. You can sign in with Google, in which case Google also gives us the name and profile picture on your Google account, or with an email and password, in which case the password is stored hashed by our authentication provider and is never visible to us.
Upgrading from a guest account keeps your existing identifier, so your picks carry over.
The email reminder list
If you enter your email on the holding page, we store the address and the date you submitted it. That is the entire record. No name, no tracking pixel, no profile.
It is used once, to tell you the game is live. To be removed before then, email privacy@lockedgame.com.
What is kept in your browser
A few small values are stored locally on your device and never sent to us: your light or dark theme choice, and whether you have already seen the intro screen, the how-to-play guide, a given week's results, and the prompt asking if you want to install the app.
No advertising or analytics cookies are set.
Who processes your data
- Supabase: database and sign-in.
- Vercel: hosting and request logs.
- Cloudflare Turnstile: bot protection on sign-in and the email form. It runs invisibly, with no visual indication and nothing for you to click. See Cloudflare's Turnstile Privacy Addendum.
- Resend: sends password reset emails, only when you ask for one.
Where player data comes from
NFL rosters and scoring come from the public Sleeper API. That request is made by our server, on a schedule, for all players at once. Nothing about you is sent to Sleeper. It does not know you exist.
What we do not do
- We do not sell your data, and we do not share it for advertising.
- We do not build a profile of you across other sites.
- We do not email you except for the one launch reminder, if you asked for it, and password resets you request.
Removing your data
Email privacy@lockedgame.com and we will delete your account, your picks, and your place on the reminder list. If you played as a guest, clearing your browser data removes your only link to those picks.
Changes
If this page changes in a way that affects what is collected, the date below changes with it.
Last updated: 25 August 2026