Privacy Policy

Overview

This Privacy Policy explains how Wiggy handles information when you use the dashboard, Google sign-in, football widgets, and related admin tools.

Wiggy uses Google as its only sign-in method. Wiggy also uses Vercel Analytics and Vercel Speed Insights in the frontend to understand page traffic and performance.

Information we collect

• Google account information: Google account ID, verified email address, email verification status, full name, given name, family name, profile image, locale, and a phone number when Google provides one after consent.
• Authentication and session information: generated access tokens, session IDs, token expiration, sign-in method, user agent, IP address, session revocation status, and related security timestamps.
• Dashboard information: saved widget selections, widget configuration, layout positions, column count, lock settings, and football team or competition preferences.
• Browser storage: the frontend stores the access token, dashboard layout, dashboard widgets, dashboard background preset or custom background photo, and guide-display preference in localStorage on your device.
• Admin and operations information: admin role, account state, admin action reasons, audit events, before-and-after records for admin changes, application logs, football API usage windows, worker controls, and football sync run history.
• Football data: public football competitions, teams, matches, standings, scorers, and related metadata used to power widgets and admin data screens.
• Analytics and performance information: Vercel Analytics can record page views, routes, referrers, general location, device type, browser, and operating system in aggregated form. Vercel Speed Insights collects web performance metrics such as Core Web Vitals.

How we use information

• To authenticate users with Google and maintain secure sessions.
• To personalize the dashboard and keep widgets, layout, and preferences available across visits.
• To show football data and keep imported football records current.
• To operate admin features, manage roles, revoke sessions, investigate issues, and maintain audit history.
• To protect the service, prevent abuse, debug failures, and improve reliability.
• To understand aggregate usage and performance through Vercel Analytics and Vercel Speed Insights.

Google API data

Wiggy requests Google OAuth access for OpenID Connect, email, profile, and phone-number read access. Wiggy uses Google data only for sign-in, account display, role assignment, session security, and user-facing dashboard features.

Wiggy's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How information is shared

• Google receives OAuth requests and provides account information after you grant consent.
• Vercel may process page-view and performance data through Vercel Analytics and Vercel Speed Insights when those services are enabled.
• Football data providers may receive API requests for public football information used by widgets and admin imports.
• Hosting, database, logging, and infrastructure providers may process information needed to run Wiggy.
• Authorized admins can view account, session, audit, log, and football operations information inside the admin panel.
• Wiggy does not sell Google user data or use it for advertising, credit, lending, or surveillance purposes.

Retention

Account and dashboard records are kept while the account is active or until an admin deletes or soft-deletes them. Sessions remain until they expire or are revoked. Admin audit events and operational logs may be retained for security, accountability, and troubleshooting.

Information stored in localStorage remains on your device until you sign out where supported, clear browser storage, or remove it manually.

Your choices

• You can choose not to sign in with Google. Without Google sign-in, Wiggy cannot provide an authenticated dashboard.
• You can review or revoke Wiggy access in your Google Account permissions.
• You can clear localStorage in your browser to remove device-stored tokens and preferences.
• You can ask the Wiggy project administrator to review, revoke, delete, or restore account access where the deployment supports it.

Security

Wiggy uses OAuth state checks, bearer-token authentication, token expiration, session revocation, admin role checks, and audit logging to protect access. No system is perfectly secure, so use Wiggy only with accounts and data appropriate for this project.

Children

Wiggy is not directed to children under 13 and should not be used by children under 13.

Changes

Wiggy may update this Privacy Policy as the project changes. The effective date above identifies the latest published version.

Contact

For privacy questions, contact the Wiggy project owner or administrator who provided access to this deployment.