Last updated 5 August 2026
Contra Holdings LLC, a Utah limited liability company is the controller of personal information processed through HexMetrics at hexmetrics.app. This policy explains what we collect and what we do with it.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under United States state privacy laws.
Where the GDPR or UK GDPR applies, we rely on the following Article 6 bases:
We do not deliberately collect special category data under Article 9. Please do not put sensitive personal information into a team name, a league name, or a message.
We do not currently show any advertising. There is no advertising network on this site, no advertising cookies, and nothing that profiles you for advertising purposes.
If that changes, this section and our Cookies and Local Storage page change with it, and any advertising we do run will be contextual, selected from the content of the page rather than from a profile of you.
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. We ask for a date of birth at signup and refuse accounts below 13. If you believe a child under 13 has given us information, contact us and we will delete the account and its data.
A parent or guardian of a user under 13 may ask us to review, delete, or stop further collection of that child's information by writing to privacy@hexmetrics.app.
We do not sell personal information. We share it only with service providers who process it on our instructions, and only as far as they need it:
| Provider | What it does | What it sees |
|---|---|---|
| Cloudflare, Inc. | Hosting, edge delivery, application database, key-value and coordination storage, and cookieless site analytics | All Service data at rest, plus request metadata including IP address |
| Resend | Transactional email (verification and password reset) | Your email address and the contents of those messages |
| Google Fonts | Web font delivery | Your IP address and user agent when a page loads |
| NFL club sites and their content networks | News article images and video thumbnails in the media sections | Your IP address and user agent when an image loads |
| Podcast hosting and measurement services (including Podtrac, Omny, Megaphone, Simplecast, Libsyn, Acast and Triton Digital) | Podcast artwork, and audio streaming when you press play on an episode | Your IP address and user agent. Podtrac and similar services exist to count listens for the publisher |
| YouTube (Google LLC) | Video playback, where a club posts to YouTube | Your IP address and user agent once you press play. We embed the no-cookie player, which sets nothing until then |
We may also disclose information where we are legally required to, where it is necessary to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.
We are based in the United States and our providers operate globally. If you are in the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred to and processed in the United States. Where a transfer mechanism is required, we rely on the European Commission Standard Contractual Clauses, together with our providers' own transfer frameworks.
| Data | Retention |
|---|---|
| Account record, including date of birth | For as long as the account exists, then deleted within 30 days of deletion request |
| Refresh token cookie | 24 hours from issue |
| Sessions and revoked tokens | Until expiry, then purged |
| Email verification and password reset tokens | Until used or expired, whichever is first |
| Failed sign-in counters | Until the lockout window passes |
| League, draft and roster records | For the life of the league, and retained for other members of that league after you leave it |
| Backups | Up to 30 days, after which deleted data ages out |
A league is shared. Deleting your account removes your account record, but it does not erase a completed draft from the other members who took part in it.
Passwords are stored hashed. Sessions use short-lived tokens, and the refresh token is held in a cookie that JavaScript cannot read. Traffic is served over HTTPS. Sign-in is rate limited and locked out after repeated failures.
No system is perfectly secure, and we do not promise that ours is. If we become aware of a breach affecting your personal information, we will notify you and any required regulator without undue delay, and within 72 hours where the GDPR requires it.
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to obtain a portable copy, to object to or restrict processing, and to withdraw consent.
If you are in California, you also have the right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, and we do not use or disclose sensitive personal information for purposes that require an opt-out. We will not discriminate against you for exercising any right.
To exercise a right, write to privacy@hexmetrics.app from the email address on your account. We respond within 30 days, or 45 days where the law allows an extension and we tell you why.
If we refuse a request, you may appeal by replying to our response with the word "appeal". We will review it and give you a written answer. If you remain unhappy, you may complain to your data protection authority, or in the United Kingdom to the Information Commissioner's Office.
We do not run advertising or cross-site tracking, so there is no cross-site tracking behaviour for a browser signal to switch off. Our traffic measurement is cookieless and aggregate and carries no persistent identifier, so there is no profile to suppress and nothing an opt-out could single out. We honour Global Privacy Control signals to the extent they apply to anything we do.
We will update this policy when our practices change, and will revise the date at the top when we do. Questions: privacy@hexmetrics.app.