Stable contracts
Versioned APIs, typed errors, signed cursors, and deprecation windows.
Preparing the decision deskLoading
Public platform documentation, policies, service status, support, and accessibility commitments.
Optional usage analytics starts only after you accept analytics cookies. PostHog processes consented page-view information using its United States service. URL query strings are removed; automatic click and form capture and session replay are disabled. Use Cookie preferences in the footer to decline or withdraw analytics consent; withdrawal stops future analytics capture.
This notice describes CapOrCup account and service data. Public hockey records are kept separate from private account sessions and workspace data. The current release does not activate payments, paid plans, self-serve exports, or self-serve deletion controls.
When you sign in, Supabase processes your email, provider identifier, authentication metadata, and session cookies. Vercel delivers requests and may process routine network metadata. When configured, Sentry receives sanitized technical errors; request bodies, cookies, headers, query strings, and user identity are removed by application policy, and session replay is disabled.
We use account information to authenticate and secure the service, authorize private work, respond to requests, diagnose failures, and meet legal obligations. We do not sell personal information. Providers may process information outside Canada, including in the United States, where local law applies.
Account and workspace records are retained according to their operational purpose and applicable legal requirements. CapOrCup does not publish a fixed deletion promise until the production request workflow can measure it. The production privacy-request mailbox is not active yet, so the current release does not accept accounts or personal-information requests; that limitation remains visible until an end-to-end mailbox canary passes.
Safeguards include encrypted transport, server-side session validation, scoped authorization, row-level data controls, CSRF protection for protected changes, minimized diagnostics, and private-by-default work. No Internet service can guarantee absolute security. Accounts are not intended for children under 13 without appropriate guardian consent.
Effective: August 15, 2026 · Version 1.1
Canonical storage responded and verified source health was read.
Versioned APIs, typed errors, signed cursors, and deprecation windows.
Health, readiness, source state, incidents, and SLO evidence.
WCAG-aligned navigation, interactions, semantics, and media.
CapOrCup does not flatten “true,” “projected,” “believed,” and “argued” into the same feed.
Executed agreements, official registries, notices, reports, and authorized feeds.
Neutral calculations, research, rule interpretation, and model output with versions.
Contract-authorized aggregate belief is labelled as market evidence, never an official event.
Attributed third-party opinion stays visibly separate from neutral analysis.
Missing, stale, disputed, withheld, and unavailable are first-class states. See the methodology, source registry, and correction ledger.