Privacy policy · Cobalt Pool

The short version

Cobalt Pool is a private hockey pool for a known group of people. It collects the minimum needed to run the game: who you are, what you picked, and how your tokens moved. It has no advertising, no analytics, no trackers, and no third parties. Nothing is sold or shared.

What is collected

When you sign in with Google, Google tells us three things:

Your Google account identifier (a number Google assigns to your account). We store this. It is how the pool recognises you on your next visit.
Your name. We store this as your display name, which is what other players see on the pool page. You can change it.
Your email address. We store this, so the pool can email you about the game — a reminder if you have not put your picks in, or a note if something about your account needs attention. It comes from your Google account, and it is refreshed each time you sign in so it stays current.

We never see your Google password. Sign-in happens on Google's own page and we receive only the result.

While you use the pool, we record:

Your picks - the game, the team, the stake, and whether it won.
Your token balance and every change to it, with a reason.
Your cycle progress, and your achievements.
Your avatar colour, and the time you last visited. The last-visit time exists so the pool page can show who has gone quiet - the point of a pool is that people keep playing.

Server logs record requests and errors, including sign-ins, bet placements, and administrative actions. They are what makes a problem diagnosable, and administrative actions are recorded permanently with the reason given, because a token pool where balances can change silently is not one anybody should trust.

What is not collected

No advertising identifiers, and no advertising of any kind.
No analytics or tracking scripts. The site runs no third-party JavaScript.
No cookies beyond the one that keeps you signed in. It is HttpOnly (JavaScript cannot read it) and SameSite (it is not sent from other sites).
No location, no device fingerprinting, no contact list.
No payment information. Tokens in this pool are virtual and have no monetary value.

Who can see it

Other players in the pool can see your display name, your avatar initial, your balance, your picks once each game's deadline has passed, and your cycle progress. That is the game. They cannot see your email address; it is visible only to the pool administrator, and only for the purposes described above.

Other players can also see your past picks — which team you took, what you staked, and whether it won — but only once that game's betting deadline has passed. Picks for any game that is still open stay hidden, so nobody can read your pick and copy it. The same rule applies to everyone, including you: a pick of yours is hidden from other players for exactly as long as it is hidden from theirs.

The pool administrator can see everything in the database, including the full history of every balance change, which is necessary to correct mistakes and is the point of keeping an auditable ledger.

Nobody else. Data is not sold, shared, or transferred to any third party. The only outside service involved is Google, and only to sign you in.

What your email address is used for

Only pool administration: reminders to make your picks, notification of achievements or awards, and anything that affects your account. Examples of the last kind are a correction to your balance, or telling you the pool is moving or closing.

No marketing, and nothing unrelated to this pool.
Never shared, sold, or given to any third party.
No third-party mailing service is involved. Mail comes from the pool operator directly.

You can ask to stop receiving email at any time — see your choices below — and you can also ask for the address to be deleted while keeping your account, in which case you simply will not hear from the pool by email.

Where it lives

On a private server belonging to the pool operator, in a PostgreSQL database. It is reachable over HTTPS. Access to the server is limited to the operator.

How long it is kept

For as long as the pool runs, and for as long as the operator keeps a backup. Token history is kept indefinitely on purpose: the ledger is the record of what happened, and a pool whose history can be quietly edited is not one worth playing.

Your choices

You can ask the operator to see everything held about you, to correct it, or to remove you from the pool. Removal deactivates your account rather than deleting it, so the ledger stays consistent for everyone else - your name stops appearing on leaderboards and your account can no longer sign in, but the historical record of bets and balances remains, because other players' totals depend on it.

You can also ask to have your email address removed without leaving the pool. It is stored separately from everything else, so removing it does not affect your account or your history — you would simply not receive pool email, and it would be added again the next time you sign in unless you ask for it to stay off.

Write to [email protected].

Children

The pool is not intended for anyone under 13, and it is not open to the public.

Changes

If this policy changes, the date at the top changes with it. Material changes will be mentioned in the pool.

Contact

[email protected]