Privacy Policy

The short version

Ninety Bound is a guest web app first. Most of what you set — club, home city, travel prefs, watches, RSVPs — is stored on your device in the browser. You can keep using the site that way. If you choose to create an optional account (when that is offered), we collect your email to run the account and send a verification message. We do not sell personal information. We use Vercel Web Analytics for anonymized page views so we can see which pages people use. We also load a Travelpayouts affiliate tracking script on travel routes (matches, watch, inbox, stadiums, plans) so outbound travel-partner visits can be attributed, and an Impact.com Publisher Tag on those same routes so partner-link impressions can be attributed. We do not load those scripts on account, privacy, or about pages. Vercel Analytics is not an ads-profiling or marketing-cookie stack; Travelpayouts and Impact are third-party affiliate scripts, not a display-ad network we sell data into.

What stays on your device

The app uses your browser's local storage (not an account cloud) for preferences and in-app state. That may include:

• Travel profile: followed club, home city, origin airport, how far you'll drive, fly budget, and preferred airline or hotel brands
• Display prefs such as compact match list
• Fixtures you mark to watch
• Inbox alerts, including schedule-change notes the app builds locally
• Going / Maybe RSVPs
• Travel picks (which flight or hotel row you chose for a match)
• Personal notes on an away-match plan. Guests keep a draft on this device. Signed-in accounts store notes on the profile, keyed by match and kept separate from flight and hotel picks.
• Stadium-plan tips you add on this device, plus local helpful votes
• A last-seen schedule snapshot so the app can notice kickoff or listing changes
• Whether you finished setup

You start as a guest. Setup can optionally save an email on this device so Settings can show it — that on-device field is not sent anywhere and does not create an account. Most people leave it blank. If you request a coming-soon league (onboarding or Settings), you type an email so we can confirm the request and later tell you if that listed league ships. That waitlist address is stored in a private server file keyed by league, not on the public counts API.

Clearing this site's data in the browser resets on-device preferences. If you created an optional account, contact us and we will help delete that server-side record.

Optional account

An account is optional. Guest local storage keeps working either way. Creating an account is offered in Settings when the account APIs are enabled for this deployment. If you create an account we collect:

• Email, used to identify the account, send verification or password-reset messages, and — only if you opt in — watch alert emails
• A password you choose (we store an argon2id hash with a unique salt — never the password itself)
• Encrypted prefs you explicitly save for cross-device sync after the email is verified

On the server, email is stored as an HMAC lookup plus AES-256-GCM ciphertext so we can send mail. Prefs that you sync are also AES-256-GCM ciphertext. Keys and the HMAC pepper live in environment variables, not in the data files and not in git. We do not log your email, password, tokens, cookies, salts, or decrypted prefs — only a user id and an event code.

The account is not active until you verify the email. After you register or try to log in, you stay on a check-your-email screen until that link works. We will not send watch alerts or match digests, will not sync prefs, and will not let an unverified login into the app. You can resend the verification message; that path is rate-limited.

Watch alert emails are opt-in in Settings (daily by default, or twice a day / weekly). They are not a promo newsletter. Each alert has one reason, a plain-text and HTML body, and an unsubscribe link. Fare alerts also include a stop-watching link. Watch alerts, when enabled later, come from alerts@ninetybound.com with replies to hello@ninetybound.com.

Verification and password-reset messages are sent with Resend from noreply@ninetybound.com when that integration is on. Resend has its own policy. We do not log the address.

Browser notifications

Settings can ask this browser for notification permission (the standard Notification API). If you allow it, the app may show a local notification in this browser for alerts it creates on your device. We do not run a push server, and we do not send notifications from our side when the site is closed.

What our servers and host may see

Like most websites, our host and CDN may log ordinary request data — for example IP address, user agent, and the URL you requested. We do not treat those logs as a marketing profile.

When the app loads the schedule, the request URL may include your followed club, home city, origin airport, drive hours, and fly budget so we can classify drive vs fly on the server. Weather requests may include a venue and match date. Those parameters exist to serve the page, not to sell a dossier about you.

Public schedule, standings, and weather sources (including ingest feeds and the U.S. National Weather Service) are used for product content. We do not send your name or email to those services.

Cookies and local storage

Travel prefs such as city, drive hours, and brand filters still live in local storage on this device. If you tap OK on the home About and Privacy notice, we store a small technical flag (`nb.legalPromoSeen`, with a same-site `nb_legal_promo_seen` cookie fallback) so that banner does not return on any league schedule. If you browse without an account, we mint a stable guest id (`gst_…`) in a first-party HttpOnly `__Host-nb_guest` cookie (id only, 30 days, renewed when you save prefs) and store the leagues and teams you follow in a private server file keyed by that id. First paint uses local storage on this device. That cookie is technical, not an advertising cookie, and JavaScript cannot read it. If you clear cookies, the guest id is gone and that server row is unreachable — we cannot look it up without the id. Signing in does not automatically copy guest follows onto the account. After a verified login we may ask whether to bring follows from this browser. We do not set a cookie banner today. Our host or the web framework may still use strictly technical cookies to operate the site. If you sign in to an optional account, we also set a first-party HttpOnly session cookie (`__Host-nb_account`) so the server can tell verified sessions. A separate pending cookie is never treated as a signed-in session. The Travelpayouts affiliate script we load on travel routes may use cookies or similar storage so travel partners can attribute bookings that start here. The Impact.com Publisher Tag may set a first-party cookie and track impressions for affiliate attribution when you view those travel pages. We do not use cookies to run a general ads-profiling network across the web.

Analytics

We use Vercel Web Analytics for anonymized page views and traffic so we can understand which pages are used. It is not an ads-profiling or marketing-cookie stack, and we do not sell personal information from it.

To count unique visitors, the site also keeps an anonymous device id: a random number stored in a first-party `nb_device` cookie (1 year, SameSite=Lax) with a local storage copy. At most once per day the browser tells our server "this device visited today". We store the id, the first and last day it was seen, how many days it has been active, and, from its first visit only, the `utm_source` / `utm_campaign` tag and the referring site's host name (not the full address). We do not store your IP address, browser details, or anything that names you. If you save follows as a guest or sign in to an account on that device, we link the device id to that guest id or account and record the earliest day any of your linked devices was first seen, so we can tell how long people browse before signing up. Clear your cookies and local storage to reset the id.

Affiliate tracking

We load a Travelpayouts affiliate tracking script (tp-em.com) on travel routes only (not `/`, `/privacy`, `/about`, `/account/*`, or Settings). It is there so that if you leave Ninety Bound and book with a travel partner we work with, the visit can be attributed. We also load an Impact.com Publisher Tag (utt.impactcdn.com) on those same travel routes. It may set a first-party cookie and record impressions so partner links you view can be attributed. We do not use either script as an ads-profiling or remarketing stack of our own, and we do not sell personal information from them. Travelpayouts, Impact, and the booking sites you land on have their own policies.

What we do not do

• We do not sell personal information.
• We do not use Vercel Analytics for ads profiling or a marketing-cookie stack.
• We do not run a display-ad tracking network. A quiet Fanatics merch unit may appear on the matches list and links out to Fanatics. It is not a display-ad pixel. We do load the Travelpayouts affiliate script and the Impact.com Publisher Tag described above for outbound partner attribution.
• We do not process payment cards on this site. There is no paid plan or subscription checkout.

Links that leave Ninety Bound

Flight and hotel icons open a dated Aviasales search (Travelpayouts). Compare links go to Google Flights or Google Hotels for that stadium and the day-before / day-after match window. A Fanatics merch unit may send you to Fanatics. When those clicks start here, Travelpayouts or Impact may attribute them to Ninety Bound. Social icons link to Instagram, X, Facebook, and TikTok. Those services have their own policies. Once you leave, their rules apply.

Children

This site is for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children. If you think a child saved information here, clear the site data in the browser or contact us and we will help as we can.

Changes

If this policy changes, we will update the date at the top of this page. We may not have a separate notice channel. Check back here if you want the current wording.

Contact

For common questions, DM us on Instagram or X @NinetyBound.