Privacy

Last updated: August 12, 2026

Big12ology is a personal fan project — static websites about Big 12 football. Three of the four sections have no accounts and set no cookies at all. The fourth, the pools, has one of each, and only if you choose to sign in.

The short version

• No ads, no trackers, nothing sold to anybody, ever.
• The tiebreaker, the schedule and the attendance tracker have no accounts and set no cookies. They do count what gets used — anonymously, with no identifier of any kind, so the counts cannot be tied to you or to each other. The details are below.
• If you sign in to the pick’em: one cookie, a display name you choose, and we never receive your email address, your real name or your profile picture — not from Google, not from GitHub, not at all.

What the other sections collect

• Nothing you type. On the tiebreaker, the schedule and the attendance tracker there are no forms, sign-ups, or comment boxes. What we do count is which features get used, with no identifier attached — Analytics describes exactly what is sent.
• No cookies there. Interactive features (like the tiebreaker what-if simulator) run entirely in your browser’s memory and forget everything when you close the tab.
• Three things in local storage, and all three are yours. If you pick light or dark mode, that choice is saved under b12-theme so the page does not flash the wrong theme next time. If you collapse a card, which cards you closed is saved under b12-cards, per page. And if you pick winners in the tiebreaker’s Lab, that scenario is saved under b12-lab so leaving the page and coming back does not wipe the board — the same picks that are already in the address bar, kept because the site’s own navigation drops them. None of the three leaves your device, none is sent to us, and clearing your browser data removes all of them. The pick’em adds no key of its own beyond the sign-in cookie described below.

Signing in to the pick’em

You sign in with Google or GitHub. We ask each of them for the least they will give us:

• Google is asked for the openid scope and nothing else. Not email, not profile. What comes back is a signed token containing an opaque subject identifier.
• GitHub is asked for an empty scope, which grants no access to anything, and we then read the numeric account id from its public user endpoint. We use the numeric id rather than your username because a username can be changed and then registered by somebody else.

We do not store the identifier either provider gives us. We store a keyed hash of it, using a secret that is not in the database. A copy of our database without that secret cannot be linked back to any Google or GitHub account. The access token GitHub issues is used for exactly one request and then discarded; it is never stored.

Your provider will know that you signed in to this site, and when. That is visible to them regardless of what we do, and it is the trade you are making by using them to sign in. Their policies apply to their side of it: Google’s Privacy Policy and GitHub’s Privacy Statement.

The cookie

Signing in sets one cookie, __Host-b12s. It holds a random value and nothing else — no name, no identifier, nothing readable. It is HttpOnly (JavaScript cannot read it), Secure (it is never sent unencrypted), SameSite=Lax (it is not sent from other sites’ forms), and it lasts 30 days. Signing out deletes it.

A second cookie, __Host-b12oauth, exists for the ten seconds between clicking “Continue with Google” and arriving back here. It carries the one-time values that prove the round trip is the same one you started, and it is deleted the moment you land.

There is no consent banner, and that is deliberate rather than an oversight. Both cookies are strictly necessary to a service you asked for by pressing a sign-in button, which is the one category that does not require consent. We do not set any cookie for analytics, advertising or measurement, and the counting described under Analytics stores nothing on your device at all — no cookie, no local storage, no identifier — which is precisely why there is nothing for a banner to ask you about. If that ever changes, this page changes first.

One honest limitation: signing out revokes your session immediately in our database, but the cached copy at Cloudflare’s edge can take up to about a minute to catch up. Signing out on a shared computer is effective; it is not instantaneous everywhere on earth.

What is public

The pick’em leaderboard is public and indexable by search engines. On it, anybody can see the display name you chose, your record, and the team you said you follow, if you said. After a week locks, the picks you made that week become public too, along with the overall split of how everyone picked each game — that is the point of the game.

Your display name and your team are the only things you publish, so choose them accordingly: the name does not have to be your name and we would rather it were not, and the team is optional. Nothing else about you is shown to anyone.

What we store, and for how long

• An account row — a generated id, your display name, when you signed up, and when you last changed your name. Kept while the account exists.
• Previous display names. Kept so that a name cannot be used abusively and then abandoned to escape it.
• A keyed hash of your provider identifier, as described above.
• Your picks, and what they scored. Kept indefinitely — they are the record of the season.
• Sessions — a hash of the cookie value, a creation time and an expiry. Never the cookie itself. Expired sessions stop working after 30 days.
• A keyed hash of the IP address you signed up from. Never the address itself, and it is not linked to anything you do afterwards. It exists so that twenty accounts appearing from one place in an hour can be looked at by a person. It is never used to block anybody automatically: this is a college football site, and shared campus and dorm connections are the normal case rather than the suspicious one.
• Which team you follow, if you tell us. This is public — the team’s mark appears beside your name on the leaderboard. It is optional, you can change it at any time, and choosing nothing is a perfectly good answer.

We do not store your email address, because we never ask for it. That has a consequence worth knowing before you sign up: there is no password reset and no way for us to recover your account, because there is nothing to send a recovery link to. Your account is reachable only through the provider you signed in with. You can link both Google and GitHub to the same account, and that is the only backup there is.

Deleting your account

You can delete your account from the account page. When you do, we remove the link to your Google or GitHub identity, clear the signup hash, sign you out everywhere, and rename you to something anonymous like deleted-4f2a91.

Your picks are kept, under that anonymous name. We are telling you this plainly because it is a real limit on erasure rather than a technicality: a public leaderboard where past weeks develop holes is not an honest record, and everybody else’s standing depends on those games having been picked. What is deleted is every link between those picks and you.

Children

The pick’em involves a public leaderboard and an account, so it is not intended for children under 13, and we ask that they not sign in. The rest of the site is just football statistics and anyone is welcome to read it. If you believe a child has created an account, write to us and we will remove it.

Hosting

The sites are built and stored on GitHub Pages and delivered through Cloudflare, which also provides DNS. Both are ordinary web infrastructure and both may log request metadata — including your IP address, the page you asked for, and your browser’s user-agent string — for security and operational purposes. Neither we nor they use that to build a profile of you. See the GitHub Privacy Statement and Cloudflare’s Privacy Policy.

Cloudflare’s role changed when the pick’em launched. For the static sections it is a content delivery network passing pages along. For the pick’em it also runs our code and holds our database, which makes it a processor handling your account and your picks on our behalf, not merely a pipe.

Analytics

Two things count what happens here, and neither of them counts you.

Page views come from Cloudflare Web Analytics, a privacy-first measurement tool: no cookies, no persistent identifiers, no fingerprinting, and no cross-site tracking. It gives us aggregate counts (page views, referrers, countries) and nothing about you as an individual.

What happens on a page is counted by us, on our own server, because a page view cannot tell us whether anybody actually used the thing the page is for. When you close a tab, your browser sends us a short list along these lines: a page was read to 75% for 40 seconds; the what-if simulator was given 12 picks; a card was collapsed. That is the whole of it. There is no identifier in that message — not a cookie, not a number stored in your browser, not one generated for the occasion — so two visits cannot be told apart from one, and nothing can be followed from one day to the next. We built it that way on purpose, and the honest consequence is that we cannot answer questions like “how many people came back” about anybody who is not signed in. We would rather not know.

Four specifics, because vagueness here is how a promise stops meaning anything:

• Which page it was, and nothing more of the address. Each message is filed under the page it came from — /tiebreaker/lab.html — taken from the ordinary referring-page header your browser already sends. Anything after a ? is discarded, and any path that is not a plain page on this site is recorded as the word other rather than stored.
• Your what-if picks are never sent. They live after the # in the address bar, and the part after a # is not transmitted to a server — it is not in the header just described and it is not in the message. That is exactly why we can tell that a shared scenario was opened without ever learning what was in it.
• Nothing free-form is accepted. The server matches every message against a short fixed list of permitted words — five kinds of event and fifteen details between them — and throws away anything else, so there is no field a search term, a name or a scenario could travel in.
• Global Privacy Control is honored, as is the older Do Not Track header. Send either and nothing is counted at all. Every feature still works; we simply do not learn that you used it.

These counts are kept for 90 days and then expire on their own. They are never joined to your pool account, and they could not be: there is no identifier in them to join on. There is no row belonging to you to ask us to delete, because there is no row that belongs to anybody.

External links and data sources

Links to other sites (GitHub, collegefootballdata.com, big12sports.com, and others) are governed by those sites’ own privacy policies. Game data is fetched from third parties by our build servers, not by your browser — your browser never talks to a sports data provider. The attendance tracker does load its own data files from this site as you use it, which is an ordinary request to this site like any other.

The one time your browser talks to somebody else is when you choose to sign in: pressing “Continue with Google” or “Continue with GitHub” sends you to them and back. Nothing on any page of this site loads anything from Google or GitHub until you press one of those buttons.

Changes and contact

If this policy changes (for example, if analytics tooling changes), this page will be updated with a new date. Questions: dept@big12ology.com.