Privacy Policy
Last updated October 2026
This policy explains what information MMAFL collects, why it's collected, and how it's used. MMAFL is currently operated as an individual project during a closed beta, not by a registered company.
1. Who is responsible for your data
The data controller is Matthew Duffy, an individual, operating MMAFL during a closed beta. Contact: support@mmafantasyleagues.com.
2. Information collected
| Data | Purpose |
|---|---|
| Email address | Account login, password reset, beta approval notifications |
| Username | Public display name within leagues |
| League & team data | Fighter picks, predictions, chip usage, scores |
| Basic usage data | Standard server logs (such as request activity and IP addresses) for debugging and security |
Your username, picks, predictions and scores are visible to other members of the leagues you join. Your email address is not shown to other users.
No payment information is collected, as the platform does not process payments.
3. How information is used and legal basis
Information is used solely to operate the platform: authenticating users, running leagues, calculating scores, and communicating important account updates (such as beta approval status).
We process your data to provide the service you signed up for (running your account, leagues and scoring), and for our legitimate interests in keeping the platform secure and working. We do not rely on consent for any tracking.
4. Browser storage
MMAFL uses only strictly necessary browser storage, such as the login session set by Firebase Authentication. We do not use cookies or similar technologies for analytics, advertising or tracking, so no cookie banner is shown.
5. Third-party services and where data is processed
Authentication is handled by Firebase Authentication (a Google service), which stores your email address and sign-in details and manages login credentials on the platform's behalf. Application data (leagues, teams, selections) is stored in a hosted PostgreSQL database provided by Supabase in Canada.
Google and Supabase act as processors on our behalf. Where data is processed outside the EU/EEA, the provider relies on appropriate safeguards such as Standard Contractual Clauses.
No personal data is sold, rented, or shared with advertisers or data brokers. No third-party analytics or advertising trackers are used at this time.
6. Data retention
Account and league data is retained for as long as your account remains active. When you request deletion, your personal data is removed within 30 days. Server logs are kept for up to 30 days. As noted in the Beta Terms, data may be reset or modified during the beta period as the platform evolves.
7. Your rights
You may request access to, correction of, or deletion of your personal data at any time by contacting support@mmafantasyleagues.com. Account deletion requests will be processed as promptly as reasonably possible.
You also have the right to object to or restrict processing, to receive your data in a portable format, and to lodge a complaint with the Spanish data protection authority (AEPD, www.aepd.es) or your local supervisory authority.
8. Security
Data is transmitted over encrypted (HTTPS) connections. No method of storage or transmission is completely secure.
9. Children's privacy
The platform is not directed at, and should not be used by, individuals under the age of 18.
10. Contact
Questions about this policy or your data can be directed to support@mmafantasyleagues.com.