pigskinlab.com
Home › Privacy

Privacy policy

Last updated .

The short version

Without an account you can use Ask for 10 free questions and look around the dashboards and graphics they build, open dashboards and graphics people share with you, and use every page (the stats, team, player, game, model and Trend Watch pages, Fantasy, and the home, about, glossary and legal pages); more questions, and saving, editing, sharing or exporting anything, need a free account. Without one, the site does not ask for your name or email (the feedback form asks for an email only if you want a reply). It sets one cookie of its own, pl_anon, a random anonymous ID (and, only if you arrive through a creator’s referral link, pl_referral; see below): it counts your free Ask questions and is what your signed-out activity is recorded under (see Activity below); nothing in it says who you are. Ask answers 10 questions without an account, then needs a free account with a confirmed email address; dashboards and graphics you make live in your own browser, and, when you press "Save to my account" (free, for every account), on this site’s server under your account, with their names and whether you pinned them, until you delete them or the account. They are in "Download my data".

If you make an account, the site stores your email address, a scrambled (hashed) form of your password if you set one, how you made the account (with Google, a password or an emailed link) and on which of our sites, Google's ID number for you if you use "Continue with Google", whether you asked for feature emails (and when), the teams whose Tuesday pack email you asked for (and when), a sign-in cookie, and, while you are signed in, a record of what you do on the site (see Activity below). It emails you when you ask for a sign-in link, and otherwise only if you tick a box: when new features launch, and on Tuesdays with a link to the weekly pack of a team you chose. The few things that leave your browser are listed below, with who receives them.

Who handles your data

Pigskin Lab is run by Obegi Software LLC (Mason Obegi), a Washington limited liability company. Everything the site keeps is in its own database, on servers run by Railway, its hosting provider. Nothing is sold. These companies handle some of it to make the site work, each under its own privacy policy:

  • Railway runs the server and its database (Railway's privacy policy).
  • Cloudflare sits in front of the site: every request passes through it, and it counts page views with Cloudflare Web Analytics, which sets no cookies and records, for each view, the page, the site that sent you to it, your browser and your country (Cloudflare's privacy policy).
  • Resend delivers the site's emails: sign-in links, feature emails and Tuesday team pack emails if you ask for them, and the copy of a feedback message sent to the site owner (Resend's privacy policy).
  • Google, only if you choose "Continue with Google" to sign in, and for the fonts the pages load (Google's privacy policy).
  • Stripe takes tips through the tip jar; your card details go to Stripe, never to this site.
  • Sleeper, only if you link a fantasy league: the site asks Sleeper for the league you name (see Fantasy leagues below).

Accounts

An account holds: your email address (or, for a sponsored account the site owner made with a username, that username and no email), a hash of your password (scrypt) if you set one (an account made with Google has none until you choose one), a hash of a recovery code, how the account was made (with Google, a password or an emailed link) and on which of our four sites you started, Google's ID number for you if you have used "Continue with Google", whether you asked for feature emails and when you last changed that, the teams whose Tuesday pack email you asked for (when you asked, and which game it last emailed you about), and whether it has Pro (sponsored accounts, made by the site owner for people the owner gives a login to, have Pro for free). It also holds the dashboards and graphics you save to it (their contents, names and whether you pinned them), until you delete them or the account. Nothing is sold or shared.

One account for four sites: the same account signs you in to Pigskin Lab and to our sister sites HoopVision Lab (hoopvisionlab.com), Batter Lab (batterlab.com) and Rinkside Lab (rinksidelab.com), all run by the same person. Pigskin Lab keeps the account (your email, the password hash, Pro, and how the account was made). When you sign in on a sister site, it sends you here; after you sign in here, that site's server is given your account number, your email, whether you have Pro and how the account was made (with Google, a password or an emailed link), through a one-time code that works once, for one minute, and only for that site. Each site then keeps its own sign-in cookie and its own record of what you do on it. Signing out on one site signs you out of that site only. "Download my data" here includes what the sister sites keep about your account, and deleting your account here deletes it on all four.

Activity: while you are signed in, the site records what you do on it, with the time: the pages you open (see Page addresses below) and how long they stay open, the name of the site that sent you, if another site did (never its full address), the buttons, links, menus and switches you use (their words, and which widget or card they belong to), the numbers, dates and colours you pick, which widgets are on your dashboard after each change, what you type into Ask and what it built, the dashboards and graphics you save, open and delete, the share links you make, whether you are on a phone, tablet or computer (from the screen's width), and sign-ins and sign-outs. It never records what you type into any other text box (passwords, emails, titles, notes, the "Wrong answer?" line). It is used to see what works and fix what does not, is never sold or shared, is included in "Download my data" on your account page, and is deleted with your account. Single actions are kept for 90 days; after that they are folded into daily totals (how many of each thing, per day), which are kept for a year.

Activity while signed out: the site records the same kinds of actions with the time, under the random anonymous ID in the pl_anon cookie: the pages you open (see Page addresses below) and how long they stay open, the name of the site that sent you, if another site did, the buttons, links, menus and switches you use, the numbers, dates and colours you pick, which widgets are on your dashboard, that you asked Ask something, whether it answered and what kind of dashboard it built, when you reach the 10 free questions, and whether you are on a phone, tablet or computer (from the screen's width). It does not record your IP address, your browser's name or version, or what you type into a text box: not passwords, emails, titles or notes, and not the words of your Ask questions (those go into the anonymous Ask log below, as for everyone, and are never part of a page's address in these records: see Page addresses). Anything shaped like an email address is cut out of these records before they are kept. It is used to see what works and fix what does not, and is never sold or shared. These records are kept for 365 days, then deleted. If you later make an account or sign in in the same browser, what was recorded under that ID is linked to your account (the link itself is kept for 400 days, or until the account is deleted): from then on it is part of your account's activity, included in "Download my data" and deleted with the account. To start over, delete the site's cookies in your browser: your next visit gets a new ID that nothing ties to the old one, and the old records stay anonymous until they are deleted.

Page addresses: for each page you open and each link you use, the activity record (signed in or out) keeps only the path of its address (such as /build or /player/…), never what follows the "?" in it: not the Ask question a link carries (/build?ask=…), not a dashboard in coded form. The one exception is a campaign tag from an ad or a campaign link (?ref=, utm_campaign or utm_source, and only when it is letters, digits, - and _), which is how the site tells which ads bring visitors who use it; the tag says nothing about who you are. The page you first arrived on is recorded as it was before the page changes its address, cut the same way. Records made before October 12, 2026, which kept the full address, have been cut the same way.

Counting, for everyone: to see which pages and features get used and which nobody uses, the site counts, per day, how many times each page is opened and each feature is used (for example "Download PNG: 12"), how many visits arrive, on what kind of screen (phone, tablet or computer, from its width only), and from what kind of site (a search engine, social media, a sister site; never the address). Each count is only a feature name and a number, with whether the visitor was signed in. The counting stores nothing in your browser; it keeps no IP address, no browser name or version, nothing typed, and nothing that could tell one visitor from another. Counts are kept for 400 days.

When you ask for a sign-in link (also how a forgotten password is replaced), the site sends one email to your address through Resend, our email provider, which receives your address and the message to deliver it (see Resend's privacy policy). The link works once, for 20 minutes; the server keeps a hash of it with your email address and the time it was used, until a clean-up removes it (clean-ups run from time to time as new links are sent, at the earliest a day after the link expires).

"Continue with Google" (if you choose it): the button sends you to Google to pick an account, and Google sends you back with a one-time code that this site's server trades with Google for your email address, whether Google has verified it, and Google's ID number for you. Nothing else is asked for (no name, photo, contacts or Google data), and no Google script is loaded on this site's pages: Google learns only that you chose to sign in here. The account stores that email, Google's ID number for you, and that it was made or last signed in with Google; it has no password unless you set one. For the rest, see Google's privacy policy. During the sign-in a short cookie, pl_g, holds a random check for 10 minutes, so the code only works in the browser that started it.

Feature emails: if you tick the box ("Email me when new features launch"), your email is used only to tell you about new features, never sold or shared; untick it anytime in your account settings, on any of the four sites. The box is unticked unless you tick it, and the account keeps when you last ticked or unticked it, as the record of your choice. Such an email would be delivered through Resend like a sign-in link, with a one-click unsubscribe link that works without signing in.

Tuesday team pack email: if you tick "Email me this team's pack every Tuesday" on a team's page (signed in, with a confirmed email address), your email is used only to send you, on Tuesdays in the season after a game of that team, one email with a link to the team's weekly pack, never sold or shared. The box is unticked unless you tick it. The account keeps which teams you chose and when you ticked each, as the record of your choice, and which game it last emailed you about, so no game is emailed twice. The email is delivered through Resend like a sign-in link and has a one-click unsubscribe link for that team that works without signing in; unticking the box on the team's page stops it too, and deleting the account removes the choice. The pack itself is drawn only when you open the link.

Using the site without an account sets one cookie, pl_anon: a random number made by the server, kept for a year, that your browser's scripts cannot read. It counts how many of your 10 free questions you have used and is the anonymous ID your signed-out activity is recorded under (see Activity). The count (how many questions, and when you reached the limit or made an account) is kept until the ID has gone unused for 400 days; it holds nothing else. It is not shared with anyone. Deleting the cookie in your browser's settings starts a new ID. A signed-in account's answered questions are counted per day, for the limit of 100 a day, and those counts are kept for 35 days.

Signing in sets one cookie, pl_sid, that keeps you signed in for up to 60 days. It is only a random key; the server stores a hash of it with the time it was made and last used, so that signing out, changing your password or "sign out everywhere" end it (the record of one that simply expires is cleared out from time to time). It is not used for anything else.

Arriving through a creator's referral link (an address with ?ref= and their code) sets one more cookie, pl_referral, holding only that code, for 60 days; if you make an account in that browser, the code and the date are stored with the new account to credit the creator who shared the link (an existing account is never changed, and the creator is shown only how many people signed up through it, never who).

To stop password guessing, failed sign-ins are counted in the server's memory, per email and per IP address, over a one-hour window; the count is never written to the database.

On your account page you can tick or untick feature emails and delete the account; on a team's page, its Tuesday pack email. Deleting removes the account and every sign-in straight away, here and on the three sister sites.

What stays in your browser

The site saves these in your browser's local storage, on your device only. Clearing the site's data in your browser deletes them.

  • Your current dashboard, your saved dashboards and your Ask conversation
  • Your current graphic in the graphics maker, and widgets you copied to paste elsewhere
  • Fantasy leagues you linked while signed out (the site, the league id, your team and a label), and the fantasy scoring you chose
  • Your light or dark theme, and whether the add panel was open
  • Your Pro pass code, if you bought one
  • For a short while when the site sends you to sign in: the page to come back to, the action you were taking, the question you asked at the free limit (so it is asked again once you are back), and a feature-email choice waiting to be saved

And these in session storage, which your browser clears when you close the tab: a campaign tag you arrived with, what you typed into Ask on the home page, and whether you closed the tip bar.

What the server receives

Like any website, the server receives the pages and data your browser asks for, which includes your IP address and browser type. It uses them to answer the request. The browser type is also read, in memory only, to leave headless browsers and scripts out of the counts and the signed-out records; it is not written down. The site’s own test browsers are left out the same way by a cookie, lab_automated, that is set only when a page is opened with ?automated=1 in its address; it holds nothing but that mark. It keeps recent answers in memory to serve them faster; that memory is cleared whenever the server restarts and holds no account or profile of you.

"View the SQL": for the data a page loads, and for each Ask answer, the server keeps the database queries that produced it, with the address the page asked for (for Ask, that includes the question you typed, but not the dashboard you asked it about), in its memory for up to two hours, under a random code sent only with that answer, so the button can show them. A query that reads or writes account, activity, feedback or other personal data is never kept. Nothing about who asked (no account, cookie or IP address) is kept with them; they are never written to the database or to disk, and they go when the server restarts.

Your IP address is held only in the server's memory, to apply per-visitor limits: on requests per minute, on share links, and on free Ask questions and new anonymous IDs per day (300 answers and 60 new IDs per address a day). It is never written to the database, and the server's memory is cleared whenever it restarts. The hosting provider (Railway) and the network in front of the site (Cloudflare) keep standard request logs under their own policies.

When you press Share, the dashboard's settings (its widgets, their layout and title) and the Ask request that built it are stored on the server under a short link, so anyone with the link can open it. Nothing about you is stored with it. The server counts how many times each link is opened. A shared link is kept until you ask for it to be taken down. The longer link in your browser's address bar carries the settings in the address itself and is not stored.

Send feedback

Only if you send it: the "Send feedback" form (the Beta tag, the footer, the tip bar) stores your message, the email address you give for a reply if you give one, the page you sent it from and the time. Nothing else is stored with the message: not your IP address and not your account, even when you are signed in (your activity, while you are signed in, shows that you used the form, as with any button, never what you wrote). The site owner reads it on a private usage page and is sent a copy by email through Resend, our email provider (which receives the message to deliver it; see Resend's privacy policy). If you gave an email address, a reply to that copy goes to it. Your IP address is held in the server's memory to limit one visitor to five messages an hour, and is never written down. Messages are deleted after 365 days; to have yours removed sooner, contact [email protected].

The creator portal's form ("Work with Mason" on /creators, for signed-in accounts) is different: it is about working with the site owner, so it is stored with your account (its email or username), your brand name and referral code if you have them, what the message is about, the message, and the way to reach you if you give one, and the copy emailed to the site owner says who it is from. It is limited to five messages an hour per account, deleted after 365 days, and deleted with your account.

Ask: what happens to what you type

When you use Ask, the words you type, and a short description of the dashboard you are asking about (for example "Brock Purdy, 2025, week 1"), are sent to the server. The site's own code reads them; they are not sent to any AI service or other outside company.

The microphone button next to Ask uses your browser's own speech recognition, and only after you press it and allow the microphone. While it listens, your browser sends the audio to its maker to turn into text (Google for Chrome, Microsoft for Edge, Apple for Safari), under that company's privacy policy. This site never receives or stores your voice: only the words that appear in the box, and only when you press a button to send them, exactly as if you had typed them. Pressing the button again, or pausing, stops listening.

Ask requests are kept for up to 365 days to improve answers: the question, result, selected public sports filters and any wrong-answer note. New requests are associated with your account while signed in, or a random anonymous visitor ID while signed out. The site owner can inspect these requests on a private usage dashboard. This log does not store IP addresses or identify a signed-out visitor by name. Each request also carries one word for the site owner's report: visitor, owner, test account or automated. Every person is simply "visitor". Older anonymous requests cannot reliably be assigned to an account. Signed-in request records are included in your account data download and deleted with the account. Please do not type personal information into Ask.

Please don't type personal information into Ask.

Fantasy leagues

To show your fantasy league, the Fantasy page reads it from the league’s own site. Today that is Sleeper, whose league data is public to read: you type a Sleeper username, and the site asks Sleeper for that user’s leagues, then for the league you pick (its teams, owners’ display names and avatars, rosters, lineups, weekly points and moves). No password is asked for and nothing is posted to Sleeper. Team avatars are fetched from Sleeper through this site so the page loads nothing from elsewhere.

What is kept, and where: the league you link is remembered as four things only: the site, the league’s id, your team’s number in it, and a label (the league’s and your team’s names). Signed out, they stay in your browser’s local storage. Signed in, they are kept on your account, and leagues linked in this browser before you signed in are moved to it. Nothing about your league mates is stored: the league is read from Sleeper and kept in the server’s memory for up to ten minutes (team avatars for up to a day). What you type into the Fantasy page’s Ask goes into the same Ask log as above (the words and what was understood, nothing about who asked).

For how long, and how to delete it: until you press Unlink on the Fantasy page, which removes it at once, or delete your account, which removes every linked league with it. "Download my data" on your account page includes them. Clearing the site’s data in your browser removes the ones kept there.

Later, ESPN private leagues and Yahoo will need a sign-in from those sites (ESPN’s two browser cookies, or Yahoo’s permission). When they come, they will be offered only to signed-in accounts, stored encrypted, never written to a log, and deleted when you unlink; this page will say so before they do.

Payments (Pro passes and tips)

Payments are handled by Stripe. Your card details go to them, never to this site. See Stripe's privacy policy. A tip is a payment on that provider's own page: this site receives and stores nothing about it.

For a Pro pass, this site stores a scrambled (hashed) form of your pass code, the Stripe checkout reference and the expiry date. If you add the pass to your account, the account keeps the same scrambled form, never the code, so the pass works wherever you sign in; the code itself stays only in the browser you bought it or typed it in, and in the email it came in. Stripe tells this site the email address you gave at checkout, which is used once, to email you your pass code through Resend, and is not stored. A pass's record is deleted 90 days after the pass runs out, used or not, and taken off any account it was on; ask and yours will be deleted sooner.

Ads

When ads are on and served by Google AdSense, Google and its partners may use cookies or similar identifiers to show and measure ads, and may personalise them based on your visits to other sites. Where the law requires it (for example in the EU and UK), you are asked for consent first through Google's consent message. You can manage personalised ads at Google Ad Settings and read how Google uses information from sites that use its services. Pro pass holders see no ads.

Other services the pages load

Fonts come from Google Fonts, which receives your IP address when the font files load. Cloudflare, in front of the site, adds its Web Analytics script to the pages; it counts page views without cookies, with the page, the referring site, the browser and the country of each.

Children

The site is not aimed at children under 13 and does not knowingly collect information from them. If you think a child under 13 has given us personal information, contact [email protected] and it will be deleted.

Your rights and choices

Depending on where you live, you may have the right to see the personal data the site keeps about you, to have it corrected or deleted, to get a copy, and to object to how it is used. You can do most of this yourself:

  • "Download my data", on your account page, gives you a copy of what the site keeps about your account (the account itself, saved dashboards and graphics, linked leagues, daily Ask counts and activity, signed in and signed out), here and on the three sister sites.
  • Deleting your account, on the same page, removes it and its saved dashboards, graphics, linked leagues and activity here straight away, and tells the three sister sites to delete theirs at the same moment (one that cannot be reached is told again until it has).
  • Feature emails can be switched off in your account settings, or with the unsubscribe link in any such email.
  • A team's Tuesday pack email can be switched off on that team's page, or with the unsubscribe link in any such email.
  • Clearing the site's data in your browser removes everything kept there, and the pl_anon cookie with it.

For anything else (a feedback message, a Pro pass record, a share link you want taken down, or a question about your data), contact [email protected]. Records kept under the anonymous ID, and the Ask log, say nothing about who you are, so they cannot be looked up by person; they are deleted on the schedule above.

The site does not sell personal data or share it for advertising.

Changes

If this policy changes, the date at the top changes with it. Material changes to how data is used will be noted on the site.

Who runs this site

Pigskin Lab is run by Obegi Software LLC (Mason Obegi), a Washington limited liability company. Contact: [email protected].