Home › Privacy

Privacy Policy

This privacy policy explains what BoxBoxF1Fantasy collects and how the site uses it.

Last updated: 2026-08-11

Official-team sync update (12 August 2026): If a Pit Wall member chooses official-team sync, we store the selected team name and slot plus its normalized lineup, round, score, rank, budget, transfers and chip status. We do not ask for or store a Formula 1 password, and we do not retain the raw Formula 1 response.

Information we collect

Most BoxBoxF1Fantasy features do not require an account. If you email us, we receive the email address and any information you choose to include. If you register for Beat V13, we process your email address, confirmation status and later any team identifier, score screenshot or verification information you submit for the challenge.

Pit Wall member accounts

Pit Wall membership is purchased through Ko-fi. For member access, we process the payment email, tier name, payment date, entitlement status and Ko-fi transaction identifiers supplied by Ko-fi. If you use member tools, we also store the F1 Fantasy team, budget, free-transfer count, email preferences and personalized recommendations you choose to associate with your account. Supabase securely hashes and verifies Pit Wall passwords and provides database hosting; BoxBoxF1Fantasy never stores readable passwords. Vercel hosts the website and server functions; Resend delivers password-recovery and simulation emails. Private team records use row-level access controls so an authenticated member can access only their own records.

Ko-fi webhooks report successful payments but not cancellations. Access therefore expires automatically after the latest paid period unless a new payment is received, with a short processing grace period. We may reconcile current status against Ko-fi's member records. Member sign-in uses secure, HttpOnly session cookies; the browser does not receive database administrator credentials or decide whether an entitlement is paid.

Beat V13 registration and email updates

Registration uses a double-opt-in process: submitting an address sends a time-limited confirmation link, and the address is registered only after that link is opened before the stated deadline. Resend processes confirmation messages, subscriber records, delivery events and unsubscribes on our behalf. Registered entrants also receive V13, simulation and competition updates. Every broadcast includes an unsubscribe link, and you can ask us to remove your address.

Analytics

The site uses Google Analytics to understand aggregate traffic, page usage and engagement. Analytics data may include device/browser information, approximate location, referrer, pages viewed and interaction events. This helps improve the site and understand which pages are useful.

Cookies and local storage

Google Analytics and, when enabled, Google AdSense may use cookies, web beacons or similar technologies. The site also uses browser local storage for convenience features such as saved scenario settings. Local-storage data stays in your browser unless a feature clearly says it will be submitted. Pit Wall sign-in uses first-party session cookies that are restricted from JavaScript access and are used only to keep the member securely signed in.

Advertising and Google AdSense

BoxBoxF1Fantasy is prepared to display advertising supplied by Google AdSense. When ads are enabled, Google and its advertising partners may process IP address, device/browser information, cookie identifiers and ad interactions to deliver and measure ads, prevent fraud and abuse, and show personalized, non-personalized or limited ads depending on your region, consent choices and browser settings.

Google explains how it uses information from sites that use its services in How Google uses information from sites or apps that use its services. Where consent is legally required, the site will use a Google-certified consent interface so visitors can accept, reject or manage non-essential advertising purposes before they are used.

External links

BoxBoxF1Fantasy links to third-party sites such as Google, social platforms, YouTube, Ko-fi, PayPal and data sources. Those sites have their own privacy policies and practices.

Data sharing

We do not sell personal information. Information may be processed by service providers used to host, authenticate, email, analyze, advertise on and maintain the site, only for those services and subject to their terms.

Retention and your choices

Email subscription data is kept until you unsubscribe or ask for deletion, except for limited suppression or delivery records needed to honour an unsubscribe and protect email deliverability. Saved Pit Wall teams and recommendation history are retained while they support the member convenience service and for a reasonable period after membership ends, so they can return if you renew; you may ask us to delete them sooner. Payment and webhook records may be retained where reasonably needed for entitlement, accounting, fraud-prevention, legal or dispute purposes. Beat V13 entry and score-verification evidence is kept through challenge administration and prize verification, then removed when it is no longer reasonably needed, unless a longer period is required for legal, tax or dispute purposes. Advertising consent choices can be revisited through the consent interface when it is active. You may request access, correction or deletion by contacting us.

Contact

For privacy questions, email boxboxf1fantasy@gmail.com.