Legends of Limerick — Privacy Policy

Plain-language privacy policy for the closed beta. It describes what data we collect, why, and what you can do about it.

Last updated: 2026-06-13

Beta + lawyer-review caveat. This policy was written in plain language for the closed-beta audience and a lawyer hasn't reviewed it yet. We'll post a notice and refresh the "Last updated" line above before public launch. If a change materially affects your rights, we'll email you.

1. Who we are

Legends of Limerick is a small project run by an individual operator in the United States. We expect to migrate this section to name a US limited liability company before public launch; for the closed beta, the operator is the contracting party.

The site is hosted in the United States. By using the site you agree that your data is transferred to and processed in the US. If you live in the EU/UK or another jurisdiction with stronger data-protection rules, those local rules grant you additional rights that this policy does not limit — see "International users" below.

2. What we collect

2a. Information you give us

Account details — your username, email address, and a hashed password (we never store your password in plaintext).
The limericks and other content you submit — including titles, lines, edits, and version history.
Your votes, favorites, and thumbs ratings on other users' content.
Optional notes when you suggest an invitee, flag a limerick, or send feedback via the in-app widget.
Email-preference settings you choose on the Account page.

2b. Information we collect automatically

Request logs — your IP address, browser user-agent, the path you requested, and the time of the request. Logs are kept for short-term operational troubleshooting; see "Retention" below.
Session cookies — required to keep you logged in. See "Cookies" below for the full list.
Last-login timestamp — recorded when you sign in successfully, used internally for beta-cohort retention analysis.

2c. Information from third parties

We do not buy or import personal data from data brokers, social networks, or anyone else.

3. Why we collect it

To run the service — show you the right tournaments, count your votes, recover your password, render your limericks back to you.
To send transactional email — registration confirmation, password reset, tournament-activate notifications, account-deletion warnings, email-change verification. You can opt out of the optional tournament notifications on the Account page; transactional email about your account (password reset, deletion warning) is always sent because the contract requires it.
To prevent abuse — rate limiting on login attempts, password-reset requests, and tournament submissions; content moderation on submitted limericks.
To investigate operational problems — debugging errors, tracing slow pages, understanding why something broke.
To plan the product — aggregated beta-cohort retention analysis (how many users were active in the last 7 / 30 days).
Future: to serve advertisements — we are not running ads today. When advertising starts (planned for after public launch via Google Ad Manager and Google AdSense), we will update this policy and notify users. See "Advertising" below for the planned disclosures.

4. Who we share it with

We use third-party services to operate the site. Each one receives only the data needed for the specific task. We do not sell your personal data to anyone, and we have not done so in the past 12 months.

Service	Purpose	Data it sees
SendGrid (Twilio)	Sends transactional email	Your email address, your author name, the message body
OpenAI Moderation API	Pre-screens submitted limericks for prohibited content	The text of the limerick at submission time
Anthropic Claude API	Generates limericks for in-house "bot" accounts and drafts tournament themes (operational use only — your submissions are not input to these calls)	None of your content directly
Render	Hosts the application and the database	Everything at rest in the database; everything in transit through the server
Cloudflare	DNS for the legendsoflimerick.com domain	None — DNS-only configuration; no traffic proxies through Cloudflare
Sentry (planned)	Application error tracking — currently disabled, will be enabled before public launch	Stack traces and the surrounding request context, which may incidentally include your user ID; will be configured to scrub email + IP from error payloads
Google AdSense + Google Ad Manager (planned, Phase 3)	Serves advertisements on the vote page once monetization is enabled	Information described in Google's ad policies — including IP address, browser fingerprint, cookies set by Google's ad library, and the page you visited. Google's policies are linked under "Advertising" below.

5. Cookies and similar technologies

The site uses a small number of cookies and similar storage that are strictly necessary to operate it:

Session cookie — keeps you logged in. Server-side session backed by the database; the cookie carries only an opaque session id.
CSRF token — protects POST requests from cross-site request forgery.
Anonymous-vote cookie — set if you vote without an account, used to remember which matchups you've already seen.
Text-size preference — remembers the font size you've chosen on the vote page.

None of these are used for advertising or analytics today. None are shared with third parties.

When advertising launches, Google's ad library will set additional cookies to deliver and measure ads. We will surface a consent banner where required and update this section before that ships.

6. Your rights

You can do all of the following directly inside the site without contacting us:

Update your email or password on the Account page.
Archive specific limericks from your My Limericks page so they no longer appear in tournaments or browse views.
Delete your account by clicking "Delete my account" on the Account page. We schedule the delete immediately and permanently remove the account after a 90-day grace period during which you can sign back in to cancel. Tournament entries you submitted stay in their tournaments (so other voters' brackets aren't disrupted) but your authorship is anonymized.
Send us feedback with the floating Feedback widget visible on every page after sign-in.

For everything else — including a copy of the personal data we hold about you, correction of inaccurate data, or any request that doesn't fit the in-app options — email bschesvold@gmail.com. We aim to respond within 30 days.

7. Children

The site is not intended for children under 13. We do not knowingly collect personal information from anyone under 13. If you learn that a child under 13 has registered, please email us and we will remove the account and its content.

8. International users

We are based in the United States and the site is operated from the United States. If you access the site from outside the United States, your information is transferred to, processed, and stored in the United States.

EU and UK residents. If you live in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR. These include the right to access, correct, delete, and obtain a copy of your personal data; the right to restrict or object to certain processing; and the right to lodge a complaint with a supervisory authority. To exercise any of these rights, email bschesvold@gmail.com. Our legal basis for processing your account data is contract (you registered an account); for security and abuse-prevention logs, our basis is legitimate interest.

California residents. If you live in California, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know, the right to delete, and the right to correct your personal information. We do not sell or share your personal information for cross-context behavioral advertising as defined under those laws. To exercise any CCPA/CPRA right, email bschesvold@gmail.com.

A more comprehensive international-compliance posture (including a consent management platform for EU users) will land before advertising starts. If you have questions in the meantime, please contact us.

9. Security

We take reasonable steps to protect your information:

The site is served over HTTPS only.
Passwords are hashed with BCrypt before storage; we never store, log, or display them in plaintext.
Application secrets (database credentials, third-party API keys, SMTP credentials) are managed as encrypted environment variables in our hosting provider's secret store.
Logs and error tracking are configured to avoid recording passwords, full email addresses, or session tokens.

No system is perfectly secure. If we ever discover a data breach affecting your information, we will notify you by email and post a notice on the site as required by applicable law.

10. Retention

Active accounts — kept as long as the account is open.
Accounts marked for deletion — soft- deleted immediately, permanently purged after the 90-day grace period unless you sign in and restore.
Tournament entries and votes you submitted — retained indefinitely to preserve tournament results, with author information anonymized after account deletion.
Request logs — rolled daily; archived files kept for short-term operational use.
Email-change tokens, password-reset tokens, and invite tokens — purged after they expire or are used.
Reported limericks and curator decisions — retained for the audit trail, even after the related accounts are deleted.

11. Advertising (planned for Phase 3)

We do not currently serve ads. When advertising launches (planned for after public beta), it will be through Google Ad Manager and Google AdSense. Google and its partner ad networks use cookies to serve ads based on a user's prior visits to this site or other sites.

Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and other sites on the internet. You can opt out of personalized advertising by visiting Google's Ads Settings. More information about Google's use of cookies for advertising is available at policies.google.com/technologies/ads.

When advertising launches we will surface a cookie-consent banner where required, register the site's authorized ad partners in /.well-known/ads.txt, and update this policy accordingly.

12. Changes to this policy

We will update this policy as the site evolves — particularly before public launch, before advertising starts, and after the formal lawyer review. When we change it, we will update the "Last updated" date at the top of this page. If a change materially affects your rights, we will email you.

13. Contact

Questions, complaints, data-access requests, or deletion requests: bschesvold@gmail.com.