Privacy Policy

ScrambleSpot is a companion app for families competing in World Cube Association (WCA) speedcubing competitions. This policy explains what we collect, why, and the limited ways we use it.

ScrambleSpot is an independent, unofficial third-party product. It is not affiliated with, endorsed by, or sponsored by the WCA.

Information we collect

Account information from sign-in providers

When you sign in, we receive a basic profile from your provider:

• WCA sign-in: your WCA user ID, WCA ID (if any), name, email address, and avatar URL.
• Google sign-in: your Google account's stable user identifier (Google's sub claim), name, email address, and profile picture URL.

We also store an encrypted OAuth access token and refresh token from your sign-in provider so we can make authorized requests on your behalf (for example, to look up your WCA registrations). These tokens are kept server-side and in an encrypted session cookie; they are never exposed to client-side JavaScript.

Information you add inside the app

• Tracked cubers — WCA IDs of cubers you want to follow. When you add a cuber, we look up their publicly available WCA profile (name, country, age range, personal best results, registered competitions) and cache that snapshot to render schedules and predictions.
• Family setup — the family display name, any co-parent members you invite, and the role each member holds within the family.
• Watchlist — additional WCA IDs you want to view on competition detail pages without push notifications.

Push notification data

If you opt in to push notifications, your browser provides a push subscription consisting of an endpoint URL and a pair of public keys. We store this so we can deliver notifications you've configured (e.g., "Marcus competes in 5 minutes").

Operational logs

Our hosting provider (Vercel) records standard server logs for each request: IP address, user agent, URL path, and response code. We use these only to operate the service and investigate problems.

What we do not do

• We do not sell your information.
• We do not share your information with advertisers.
• We do not use third-party tracking or analytics scripts.
• We do not store WCA passwords. All sign-in happens through OAuth with the WCA website or Google.

How we use information

• To run the app. Show your family's tracked cubers, their competition schedules, live results, and predictions; remember your settings; deliver the notifications you've opted into.
• To diagnose problems. Server logs help us investigate errors and outages. We avoid logging request bodies that could contain personal information.
• To improve the product. We may analyze aggregate, non-identifying usage of features (for example: how accurate our advancement predictor is across all rounds) to improve the app over time.

Public WCA data

ScrambleSpot reads publicly available competitor data from the WCA website and from WCA Live (results, schedules, registrations). This data is published by the WCA and the people who organize competitions — we do not collect it from you. We cache it briefly to keep the app responsive and to reduce load on the WCA's servers.

Third-party services we rely on

• WCA (worldcubeassociation.org) — sign-in provider and source of competition data.
• Google — alternate sign-in provider.
• WCA Live — source of live results during competitions.
• Vercel — application hosting.
• Neon — managed Postgres database where account, family, and subscription data is stored.
• Web Push services (such as Apple Push Notification service, Firebase Cloud Messaging, and Mozilla autopush) — used by your browser to deliver push notifications you've opted into.
• cron-job.org — external scheduler that pings our notification cron endpoint at regular intervals.

Each of these providers has its own privacy practices. We share only the data needed for the service to function.

Cookies

We use a single cookie, scramblespot_session, which carries your sign-in state in encrypted form. It is essential to keep you signed in between page loads. We do not use tracking or advertising cookies.

Children

ScrambleSpot is designed for parents and adult or teen competitors. A parent typically signs in with their own account and adds their child's public WCA ID to track them. We do not knowingly collect personal information directly from children under 13. If you believe a child has signed in or that personal information about a child has been provided to us inappropriately, contact us at hello@scramblespot.com and we will delete the data promptly.

Data retention

We retain account, family, and subscription data while your account is active. If you ask us to delete your account, we remove your profile, family memberships you created, your tracked cubers, your watchlist, your push subscriptions, and your notification history. Some operational log entries may persist for a limited period for security and reliability purposes.

Your choices

• Sign out from the Family / You tab at any time.
• Disable push notifications from the same tab, which removes your push subscription from our database.
• Remove tracked cubers or watchlist entries from the Family tab.
• Leave a family you joined via invite, which returns you to a fresh personal family.
• Request account deletion by emailing us at hello@scramblespot.com.

Security

All requests to ScrambleSpot use HTTPS. Session cookies are encrypted with a server-side secret. OAuth tokens are kept inside the encrypted session cookie and never exposed to the browser. Database access is restricted to our serverless functions.

No system is perfectly secure. If you believe you've discovered a security issue, please email us at hello@scramblespot.com before disclosing it publicly.

International users

ScrambleSpot is operated from the United States. By using the app, you understand that information we collect may be processed and stored in the United States, which may have different data protection rules than your home country. Where applicable laws (such as GDPR) give you specific rights to access, correct, or delete your data, you can exercise those rights by contacting us.

Changes to this policy

We may update this policy as the product evolves. When we make material changes we'll update the "Last updated" date at the top of this page. Significant changes will also be announced inside the app the next time you sign in.

Contact

Questions or requests related to this policy: hello@scramblespot.com.