1. Who we are
TBC Cricket Club ("we", "us", "our") operates the website at legumpire.com and the related player-management application (the "Service"). This policy explains what personal information we collect when you register, sign in, or otherwise interact with the Service, how we use it, and the choices available to you.
2. What we collect
- Account information — email address (required), and, when you sign in with Google, the display name and account identifier returned by Google OAuth.
- Player profile — first / last / preferred name, phone number, batting and bowling preferences, primary role, experience level, self-rated ratings, prior-season ranks, t-shirt details, optional profile photo, and any notes you choose to provide.
- Availability and selection data — your availability responses for scheduled match dates, draft status, team assignment, and roster position.
- Authentication artefacts — short-lived one-time passcode hashes (never plaintext) used by our email sign-in flow, and session tokens issued after sign-in.
- Usage and diagnostic data — pages visited, clicks, and error reports automatically captured by our analytics and monitoring providers (see Section 4).
3. How we use it
- To run the season — registration, draft, team formation, fixtures, and availability tracking.
- To authenticate you and keep your account secure.
- To communicate with you about your registration, match days, and other operational matters (sent via Resend).
- To improve the Service through aggregate, de-identified usage analysis.
- To meet legal obligations and respond to legitimate requests from authorities.
4. Processors we share data with
We use the following third-party processors. Each is bound by their own privacy commitments; we share only what is necessary to operate the Service.
- Google — OAuth sign-in (when you choose to use it).
- Neon — managed PostgreSQL database hosting.
- Vercel — application hosting and edge networking.
- Resend — transactional email delivery (one-time codes, notifications).
- Sentry — server and client error monitoring.
- PostHog — product analytics (page views, feature usage).
- Vercel Blob / S3-compatible storage — profile photo storage.
We do not sell or rent personal information. We do not share data with advertisers or data brokers.
5. Cookies and analytics
We use a small number of cookies and similar storage mechanisms (localStorage) to keep you signed in and to remember your preferences. Where analytics cookies are used, you will be asked for consent on first visit and can withdraw consent at any time by clearing site data or contacting us.
6. Data retention
We keep account and player records for as long as your account is active and for a reasonable period afterwards to support historical season records, statistics, and contractual or audit obligations. One-time passcodes expire within ten minutes. Error and analytics events are retained for a limited period in line with each provider's defaults. You can request deletion at any time (see Section 7).
7. Your rights
Depending on your location, you may have rights to access, correct, export, or delete the personal information we hold about you, to object to or restrict certain processing, and to withdraw consent. Australian residents have additional rights under the Privacy Act 1988 (Cth). To exercise any of these rights, contact us using the details in Section 9.
8. Security
We use industry-standard practices to protect your information, including encrypted transport (HTTPS), hashed one-time codes, and access controls on the underlying database. No system is perfectly secure; we encourage you to use a strong, unique password (if applicable) and to sign out on shared devices.
9. Contact
For privacy questions, requests, or complaints, please contact us at hello@legumpire.com.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified to registered players by email or via an in-app notice. The "Effective" date at the top of this page reflects the current version.