Privacy Policy

This privacy notice for Viking Software LLC, doing business as Madden Tools ("Madden Tools", "we", "us", or "our"), describes how and why we collect, store, use, and share ("process") your information when you use our website at https://madden.tools and the tools and services we offer through it (the "Services").

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use the Services. If you have questions, contact us at [email protected].

1. What Information Do We Collect?

Information you provide to us

When you create an account, make a purchase, or contact us, we collect information you provide, which may include:

• your email address and account name;
• profile information from a third-party sign-in provider (such as your name, email address, and profile picture) if you choose to sign in with a social or platform account;
• content you create in the Services, such as saved playbooks and league names, settings, and imported league data; and
• the contents of messages you send us, such as support emails.

Payment information

Purchases are processed by Stripe, our payment processor. Your full payment card details are collected and stored by Stripe, not by us; we receive and retain records of your purchases (such as what you bought, when, and the amount paid). You can review Stripe’s privacy policy at https://stripe.com/privacy.

Information collected automatically

When you use the Services we automatically collect certain technical information, such as your IP address, browser and device characteristics, and server logs of the pages you request. This information is needed to maintain the security and operation of the Services.

With your consent (see Section 3, Cookies and Advertising), we also collect product analytics about how you use the Services, such as pages viewed and features used, through PostHog and Google Tag Manager, and we load advertising pixels from Meta, TikTok, Reddit, and Google that share limited information about your visit with those platforms. With that same consent, we may also send Google a hashed form of your email address so it can match you to a Google account (see Section 4). We additionally collect error and crash reports through Sentry so we can find and fix problems; error reports may include technical details about your browser and the state of the page when the error occurred.

We do not collect or process sensitive personal information.

2. How Do We Process Your Information?

We process your information to:

• provide the Services, including creating and managing your account (through our authentication provider, Clerk) and delivering the features you use;
• process purchases and manage your entitlements to paid features;
• send transactional and service communications, such as receipts, account notices, and league notifications;
• send marketing and promotional emails about our products, features, offers, and content, which you can opt out of at any time using the unsubscribe link in any marketing email or by contacting [email protected];
• understand how the Services are used so we can improve them, using consent-gated analytics;
• maintain the security of the Services and prevent fraud and abuse; and
• comply with our legal obligations.

3. Cookies, Analytics, and Advertising

We use cookies and similar browser storage technologies in two ways. Essential storage is always used: it keeps you signed in, remembers your preferences, and makes core features work. Optional storage covers analytics and advertising: when you first visit, a consent banner asks whether we may collect this information.

If you accept, we load product analytics tools (PostHog and Google Tag Manager) and advertising pixels from Meta, TikTok, Reddit, and Google. The advertising pixels tell those platforms that a visit or action happened on our site, which is how we measure our advertising and show ads to people who have visited us. If you decline, none of these tools are loaded: no analytics events are collected and no advertising pixels fire.

You can change your decision at any time using the Cookies link in the site footer, which clears your saved preference and asks again. You can also clear this site’s data in your browser, or contact us at [email protected].

Most web browsers include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and we do not currently respond to DNT browser signals. If a standard we must follow is adopted in the future, we will inform you in a revised version of this privacy notice.

4. When and With Whom Do We Share Your Personal Information?

We share personal information with service providers that process it on our behalf under contractual protections, only as needed to run the Services:

• Clerk (authentication and account management);
• Stripe (payment processing);
• PostHog (product analytics, only with your consent);
• Google (Tag Manager, only with your consent);
• Sentry (error monitoring); and
• DigitalOcean (cloud hosting and content delivery).

Advertising partners. If, and only if, you accept the consent banner described in Section 3, the advertising pixels we load share limited information with Meta, TikTok, Reddit, and Google: typically your IP address, browser and device information, and the fact that you visited a page or took an action on our site. We use this to measure our advertising and to reach people who have visited us. These platforms are advertising companies, not service providers acting only on our behalf, and they may use what they receive under their own privacy policies.

Customer lists we send to Google. Separately from the pixels, we may send Google a list of customer email addresses so it can match them to Google accounts and show our ads to those customers, or to people Google judges to be similar to them. The addresses are hashed before they leave us, which means they are scrambled into a one-way code that Google cannot read back as an email. We only ever include people who accepted the consent banner. If you declined, or never answered it, you are not in any list we upload. To be removed from a list we have already sent, email us at [email protected] and we will delete you from it.

We do not sell your personal information for money. However, some state privacy laws define "sale" and "sharing" broadly enough to cover both the advertising pixels and the customer lists described above. You can prevent that sharing entirely, and at any time, by declining the consent banner or by using the Cookies link in the site footer. We honor that choice by not loading the pixels at all and by leaving you out of any customer list we send.

We may also share information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business, and where required to comply with law or protect our rights.

5. Where Is Your Information Processed?

The Services are hosted on DigitalOcean infrastructure in the United States. If you access the Services from outside the United States, you understand that your information is transferred to, stored in, and processed in the United States, where privacy laws may differ from those of your jurisdiction.

6. How Long Do We Keep Your Information?

We keep your personal information only as long as necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax or accounting requirements). In general, that means we retain account information for as long as you have an account with us. When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it, or, if that is not possible (for example, because it is stored in backup archives), we will securely store and isolate it from further processing until deletion is possible.

7. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security. Transmission of personal information to and from the Services is at your own risk.

8. What Are Your Privacy Rights?

You may review, change, or terminate your account at any time. You can request access to, correction of, or deletion of your personal information by emailing [email protected]. Upon a request to terminate your account, we will deactivate or delete your account and information from our active databases, although we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and comply with applicable legal requirements.

Marketing emails: you can opt out of marketing emails at any time using the unsubscribe link included in every marketing email or by contacting [email protected]. Transactional and service emails (such as receipts and account notices) are sent as part of the Services regardless of your marketing preference.

Withdrawing consent: where we rely on your consent to process your personal information (such as analytics), you have the right to withdraw your consent at any time as described in Section 3. Withdrawal does not affect the lawfulness of processing before the withdrawal.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority (https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm). If you are located in Switzerland, contact details for the data protection authorities are available at https://www.edoeb.admin.ch/edoeb/en/home.html.

9. Do We Collect Information From Children?

The Services are intended for users who are at least 13 years of age, and we do not knowingly collect personal information from children under 13. If we learn that anyone under the age of 13 has provided personal information to us without verifiable parental consent, we will delete that information as quickly as is reasonably practical. If you believe a child under 13 has provided us personal information, contact us at [email protected].

10. Do California Residents Have Specific Privacy Rights?

Yes. If you are a California resident, California law grants you specific rights regarding your personal information. In the preceding twelve (12) months we have collected the following categories of personal information: identifiers (such as email address, account name, and IP address); commercial information (records of your purchases); and internet or other similar network activity (analytics about your use of the Services, collected only with your consent). We have not collected other categories of personal information.

Sharing for cross-context behavioral advertising. We do not sell personal information for money. If you accept the consent banner, the advertising pixels described in Section 4 share identifiers and internet activity information with Meta, TikTok, Reddit, and Google, and we may send Google a hashed form of your email address in a customer list, both of which California law may treat as "sharing" for cross-context behavioral advertising. You have the right to opt out, and you can exercise it directly at any time by declining the consent banner or by using the Cookies link in the site footer, which stops those pixels from loading and keeps you out of any customer list we send. You may also email us at [email protected].

You have the right to request that we disclose what personal information we collect, use, and disclose; the right to request deletion of your personal information, subject to exceptions provided by law; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising your privacy rights. To exercise these rights, email us at [email protected]. We will verify your request by matching the information you provide against information we hold, and we may deny a request from an authorized agent without proof of valid authorization. California’s "Shine The Light" law also permits California residents to request, once a year and free of charge, information about our disclosure of personal information to third parties for their direct marketing purposes; we do not make such disclosures.

11. Do We Make Updates to This Notice?

Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is accessible. If we make material changes, we may notify you by prominently posting a notice of the changes or by sending you a notification directly.

12. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, email us at [email protected].

13. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To make such a request, email [email protected] from the address associated with your account. We will consider and act upon any request in accordance with applicable data protection laws.