Privacy

Last updated September 22, 2026

B&O Football is a private NFL pick'em pool run by one person for a group of friends, for entertainment. It is not a business, and nothing here is sold, rented, shared for advertising, or used to train anything. This page says plainly what the site stores and who can see it.

Who runs it

Greg Barlin, at gbarlin@gmail.com. That is the address for any question on this page, and for a request to see, correct or delete what the site holds about you.

Who can be here

Only people the pool manager has already added. There is no sign-up: an account exists because someone was invited into the pool, and signing in with an address the roster does not know creates nothing and gets you no further.

What the site stores

• Who you are — your name, the email address or addresses you sign in with, and the screen name you chose for the season.
• What you did in the pool — your picks, which ones you made key picks, your weekly and season scores, and results from past seasons.
• Anything you fill in on My Account — the optional details there are stored as you typed them, and are shown only to you and the pool manager. Nothing you enter anywhere on this site is a card number, a bank detail or a credential for another service, because there is nowhere here that asks for one and nowhere to put one.
• How you sign in — depending on what you set up: a hashed password (hashed with PBKDF2, never stored or recoverable in readable form), the identifier of a connected Google account, and the public half of any passkey. A passkey's private half never leaves your device and is never sent here.
• A basic activity log — when a sign-in happened and which method it used, so that "somebody signed in as me" is a question with an answer.

The site sets one cookie. It identifies your signed-in session and nothing else. There are no advertising or tracking cookies, no analytics, no pixels, and no third-party scripts anywhere in the app.

Who can see it

• Other players see your screen name, your standings position, and your picks once that week's games have started — that is the point of a pool. They never see your email address, and never anything you entered on My Account.
• The pool manager additionally sees email addresses and what you entered on My Account, because he is the person running the pool.
• Nobody else. The pool is not public and not indexed.

The services it runs on

Three, and only for what they say:

• Cloudflare hosts the site and the database, so everything above is stored on Cloudflare's infrastructure.
• Resend delivers sign-in emails. It handles the address a link is sent to.
• Google, and only if you choose to use "Continue with Google". The site asks Google for two things — that you are signed in, and your verified email address — and stores your Google account identifier so it can recognize you next time. It asks for nothing else, receives no other profile information, and can see nothing in your Google account. You can disconnect it at any time from My Account.

The app's pages also load a font from Google Fonts, which means Google's font servers see the IP address of anyone loading the site. This page does not — it uses whatever font your device already has.

The site reads live scores from ESPN. That is a one-way request for public game data and sends nothing about you.

A few screens link out to other websites. Following one takes you off this site to somewhere that sees you as its own visitor and applies its own privacy policy. This site sends nothing about you along with you.

How long it is kept

• Pool history stays. This pool has records back to 2012 and the archive is most of its appeal, so results, picks and standings are kept indefinitely.
• Sign-in links stop working 15 minutes after they are sent.
• Sessions expire after 180 days of not being used.
• What you entered on My Account is yours to change or clear from that screen whenever you like.

Leaving

Email gbarlin@gmail.com and your account, email addresses, My Account details and sign-in methods will be removed. Past results stay in the pool's record — a season's standings do not make sense with a row cut out of them — and can be shown under a name rather than tied to your account, if you would rather.

Security, honestly stated

Sign-in tokens are stored hashed, passwords are hashed with PBKDF2, traffic is encrypted in transit, and what you enter on My Account is visible only to you and the manager. This is a carefully built personal project rather than an audited commercial system, and it is worth knowing that: do not reuse an important password here, and a passkey or Google is the stronger choice if you want one.

Changes

If this page changes in a way that matters, the pool gets told. The date at the top always reflects the current version.