Privacy Policy
Last updated: 13 September 2026
DOWNS is a free weekly fantasy football game at downsgame.com. This policy describes what the game stores, why, and what you can do about it. It is short because DOWNS collects very little.
Plainly
- We do not ask for your email address, your real name, or your phone number — and we have no way to store them.
- We set no cookies.
- There is no analytics, no advertising, and no third-party code of any kind on this site.
- We never sell or share your information.
- You can erase yourself from the menu, under Account.
What we collect
If you create an account
- A username you choose. It is shown to other players on leaderboards and in head-to-head groups, so choose one you are comfortable being seen. Please don't use your full name or anything else you would rather keep private.
- A password, stored only as a bcrypt hash. We cannot read it, and we cannot recover it for you — an admin can only replace it with a temporary one.
- The date your account was created.
If you play as a guest
A random identifier is generated in your browser and kept in its local storage. It is sent with your picks so the game can show them back to you. It is not linked to you, to any account, or to any other site — it is a way of recognizing the same browser, and nothing more. Clearing your browser's site data removes it, and the picks stored against it become unreachable.
However you play
- Your weekly picks, and the scores and letters worked out from them.
- Any multiplier locks you set, and when you set them.
- Head-to-head group membership, and any display name you choose for a group. A display name is shown to everyone in that group.
- In-app notifications the game has sent you, such as your results for a week.
Technical
Your IP address is held in memory to rate-limit sign-in attempts, so that nobody can guess passwords at speed. It is not written to our database. Our hosting provider keeps its own request logs, as any web host does.
What we store in your browser
None of this is a cookie, none of it is sent to anyone but us, and none of it is used for tracking or advertising:
fantasyAuthToken— your sign-in token. Without it you would be signed out on every page load.fantasyGuestId— the guest identifier described above.fantasyDraftGuestData,guestPicks,guestScores— a local copy of a guest's picks and results, so the page can render before the server answers.fantasyDarkMode— whether you chose the dark theme.
Who we share it with
Nobody. There are no analytics providers, advertising networks, tag managers, or content delivery networks involved — every script, style and font on this site is served by us. The only outside link on the page is a plain link to our community on reddit.com, which loads nothing until you click it.
Our hosting provider, Railway, necessarily stores the database and runs the server on our behalf. We would disclose data if we were legally required to.
Some of what you do is public inside the game by design: your username and results appear on leaderboards, and your picks and display name are visible to the other members of any head-to-head group you join.
Where your data is kept
In the United States. The database and the server are hosted there by Railway.
How long we keep it
- Your account — until you delete it.
- Your picks and results — for the current season and past seasons, so that leaderboards, trophies and head-to-head history stay accurate.
- Guest picks — kept until the guest data is deleted from the browser.
Your choices
Both of these are in the menu, under the ☰ button, on the Account row:
- Change Password — changing it signs out every other device.
- Delete My Account — described below.
Guests have no account and so have neither of these. Clearing your browser's site data removes the guest identifier, after which the picks stored against it can no longer be reached.
What deletion actually does
Deleting your account releases your username, erases your password, signs you out everywhere, and deletes your notifications. Your account ceases to exist and the username becomes available again.
Children
DOWNS is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, write to us at the address below and we will remove it.
Security
Passwords are stored as bcrypt hashes and are never logged. Sign-in tokens can be revoked, and changing your password revokes all of them. Sign-in attempts are rate-limited. No system is perfectly secure, and we hold almost nothing that would be worth stealing — but we would tell you if something happened that affected you.
Changes
If this policy changes, the date at the top changes with it. If a change materially affects what we do with your data, we will say so in the game.
Contact
For anything about this policy, or about your data: admin@downsgame.com.