What we collect, why, how long we keep it.

Who we are

Hashmark is a product of VaultSpark Studios LLC, a US-registered limited liability company. References to “we,” “us,” or “Hashmark” mean VaultSpark Studios LLC operating the Hashmark service.

What we collect

• Identity. Your Discord account ID, username, and avatar URL when you sign in. Email if you opt into the mailing list or are billed.
• Franchise data. The contents of the Companion App exports you send us — team rosters, schedules, stats, scouting payloads. This is the product's primary input.
• Usage. Page views and feature events through self-hosted PostHog. No third-party trackers.
• Errors. Exception traces through self-hosted Sentry. PII is scrubbed from traces server-side.
• Billing. Stripe customer ID, subscription state, billing email. Card data never reaches our servers.

What we do not collect

• Real NFL data outside what you yourself send us via your franchise export
• Save-file contents, Madden install paths, or anything from your local machine outside the explicit Companion export
• Discord servers you belong to outside the leagues you connect
• Ad identifiers, cross-site cookies, or marketing pixels

Why we collect it

We collect identity to authenticate you, franchise data to render the product, usage and errors to make the product better, and billing data to charge you. We do not sell data to third parties. We do not run an ad network. We do not condition product access on accepting marketing communications.

How long we keep it

• Identity: while your account is active, plus 90 days after deletion for support and abuse review
• Franchise data: while your account is active. Deleted within 30 days of account deletion
• The Playoff Vault: parent-cascade deleted with the league it belongs to — never silently dropped
• Usage: 90 days, aggregated thereafter
• Errors: 30 days
• Billing: as required by US tax law (currently 7 years)

Sharing

We share data with three categories of processors, named: Anthropic (for AI generation), ElevenLabs (for voice synthesis), Stripe (for payments). Each processes the minimum data necessary for the function described. None receives your data for the purpose of training their own models or marketing to you.

We share data with law enforcement only on a valid US legal process. We have not received any such request to date; we will publish a transparency report annually starting at public beta.

Your rights

You can export your franchise data, in full, in JSON, from your account page at any time. You can delete your account from the same page; deletion runs inside 30 days. If you are in California or the EU, you also have the right to ask us in writing for the specific data we hold and to correct it — write to [email protected].

Changes

When we change this policy materially, we will email active users and post a note on the changelog. Cosmetic edits (typos, link corrections) we do silently with a revised effective date.