Last updated: 2026-08
What we do not collect
Browsing the league asks for no sign-up, no email and no personal detail, and sets no cookies. We use no third-party tracking or analytics on any page, show no advertising, and neither sell nor share data.
Only taking part in Predict & Win requires an account; the section below covers it.
What is logged automatically
As with any website, requests pass through Cloudflare's infrastructure, which may keep short-lived technical logs for operation and protection. We do not access those logs to identify anyone and do not link them to any person.
The data shown
Everything shown here is public search results for commercial websites, available to anyone running the same query. It concerns no individual and contains no personal data.
Predict & Win account data
This section applies only to people who create an account. Browsing the league needs no account and collects nothing from you.
| What we collect | Why | How it is stored |
|---|---|---|
| Nickname | To show on the predictors board | As text — it is public by design |
| Email address | Verification, password reset, notifying winners | Never shown to any visitor, never returned by any endpoint |
| Password | Signing in | PBKDF2-SHA256 hash with a unique salt — the password itself is never stored |
| Session token | Keeping you signed in | SHA-256 hash; the token itself lives in a cookie on your device |
| Your predictions and points | Scoring and ranking | Linked to your account |
| IP fingerprint | Rate limiting and abuse prevention | A one-way hash, never the address itself |
What we do not collect from members
Only your nickname is ever shown. We ask for no real name, no phone number, no address and no payment details. We run no advertising and no third-party tracking on league pages.
Where your data lives
The prediction system runs on a completely separate database from the league's. Your account data never mixes with the scan log, and the scan log holds nothing about you.
Who sees it
We do not sell or share your data. Two external services are used for two specific purposes: Cloudflare Turnstile to verify you are not a bot at registration, and Amazon SES to send verification and password-reset codes. Neither receives more than its function requires.
Retention and deletion
Account data is kept while the account exists. Unverified accounts are deleted automatically after one hour. You may request deletion of your account and everything tied to it at any time — we comply. Scan results remain, as they are not about you.
Cookies
We use one functional cookie to hold your session after signing in (esl_p), set HttpOnly and Secure. We use no tracking or advertising cookies.
External resources
Fonts load from Google Fonts and site icons from a public icon service; those providers receive an IP address by virtue of the file request. Badges and medals are served from our own domain.
Contact
For any privacy question, or a request concerning your company's data, use the contact details on the league rules page.