Scope and controller
This policy applies to sec-scorecard.com and the SEC Scorecard services available through that domain. SEC Scorecard is operated by Tolga K. through TolgaTek. It does not cover the independent privacy practices of external sites linked from team profiles, source lists, sponsorships or support buttons.
Questions or requests about this policy can be sent to tolga.k@outlook.com. Please do not include passwords or authentication codes in an email.
Information stored on your device
SEC Scorecard uses browser storage for functional preferences such as theme, analytics consent and unsigned prediction drafts. These values allow the application to remember your choices. They remain on the device unless imported into a signed-in account, cleared through the product where available or removed through browser settings.
Authentication libraries may also use browser storage to maintain a signed-in session. Necessary session cookies protect requests to the SEC Scorecard API. These functional technologies are used to provide the service and are separate from optional analytics.
Account and participation data
If you register, Microsoft Entra External ID processes authentication and SEC Scorecard receives an account identifier and email address. The service can store your favorite team, score predictions, prediction timestamps, notification preferences, game responses, feedback and fan-chat messages or reactions associated with the account.
This information is used to provide cross-device picks, receipts, community summaries, account settings, moderation and requested notifications. Public or community features may show a display name derived from the account and the favorite-team identity you choose. Administrative access is limited to operating, protecting and moderating the service.
When you choose to share a weekly receipt, SEC Scorecard saves a public snapshot of that card and its share text. Anyone with the link can view it without signing in. The snapshot excludes your email and account identifier. External services such as X may cache the shared image separately.
Optional analytics
Google Analytics loads only after you select “Allow analytics” on the production site. When allowed, it helps measure visits, navigation and campaign performance. SEC Scorecard configures analytics storage as granted while keeping advertising storage, ad-user-data and ad-personalization consent denied. Google Signals and advertising personalization signals are disabled.
SEC Scorecard does not intentionally send account details, score predictions, chat messages or feedback text to Google Analytics. You can reopen Analytics settings in the footer and decline. Revoking consent clears accessible Google Analytics cookies for the site and reloads the page when needed to remove active history listeners.
Service providers and external links
Microsoft Azure hosts the web application, API and account-related storage. Microsoft Entra External ID handles registration and authentication. Google Analytics processes optional measurement after consent. ESPN public services supply schedule and score information displayed by the product. Email delivery providers may process notification and verification messages requested by users.
Stripe hosts the optional support checkout, and external school, conference, ESPN, NCAA and reference links open services governed by their own policies. SEC Scorecard does not receive your full payment-card details from a hosted Stripe checkout.
Retention and security
Account data is retained while needed to provide the service, preserve prediction receipts, meet security or legal obligations and resolve disputes. Operational logs and abuse-prevention records may be kept for a limited period appropriate to protecting the application. Data stored only in your browser follows your browser’s retention and deletion controls.
SEC Scorecard uses HTTPS, authenticated API requests and access controls intended to protect information. No online system can guarantee absolute security. If you believe an account or the service has been compromised, contact the publisher promptly without emailing secret credentials.
Your choices and requests
You can decline optional analytics, change a favorite team, manage available notification settings, sign out and clear local browser data. Depending on where you live, you may also have rights to request access, correction or deletion of personal information and to object to or restrict certain processing.
Send a request from the account email when possible. SEC Scorecard may need to verify identity and may retain limited records when legally required or necessary for security. A response will explain any request that cannot be completed in full.
Children and policy changes
SEC Scorecard is a general-audience football service and is not directed to children under 13. The service does not knowingly seek personal information from children under 13. A parent or guardian who believes a child submitted information can contact the publisher for review.
This policy may change as features or providers change. The updated date at the top reflects the latest published version. Material changes will be described in the product when appropriate rather than concealed by silently changing the date.