Privacy.

Who runs the site

Gary Cislo runs First&One, an NFL site at https://www.firstandone.com. The apex domain redirects there.

Privacy questions: privacy@firstandone.com.

First&One is a news shelf (The Wire), fantasy desk pages, a draft page, and a connection game (Six Degrees). Fans can sign in with Google or X when that sign-in is turned on. Staff use a separate email and password. Public pages do not show a Google or X name or email.

What stays in your browser

The site stores these items in your browser. They are not a First&One account.

• A Wire archive of up to 400 stories, and a one-day map of pins. The map is tied to the calendar day in that browser.
• A short on-device event log (the key is f1-events-v1), capped at the last 800 events. The insights screen says this log is for that browser only. That screen is not a public page. It opens only if this browser has been marked with a local admin flag, which is set by visiting with ?admin=1. That flag is not a server login.
• Six Degrees seat keys for a challenge, a streak record, and a mute setting.
• An in-progress Power Rankings board and the notes on it. The key is fo.power-rankings.draft.v1. Those notes stay in this browser unless you share a link. Sharing puts the order, and any notes you chose to include, into the address. Anyone with that link can read them. We don't save notes. Opening a shared link sends its address, including any notes, to our hosting provider, which may keep it in request logs. A mute choice is stored as fo.power-rankings.mute.

Clearing this site's data in your browser removes these items. That does not delete a fan account stored on the server. Sign-out ends the session in this browser.

What is stored on the server

Six Degrees challenge boards

A challenge row holds the game setup, each seat's result (time, degrees, and whether that seat resigned), and seat keys. The public read of a challenge does not include the seat keys. Anyone with the challenge link can read the board. The id is in the link. There is no email column, and there is no delete for these rows in the app.

Fantasy questions

You can send a question with an optional display name, a league format, and a week label. The form rejects an @ sign and phone-like text in the question and the name. The table has no email column and no user id. Answered questions can be shown on the public answered list. The list uses a staff-edited public question when one is set, and it does not show the handle you typed unless staff turns that on. Otherwise it says From the First&One Desk. A declined question stays in the database with the answer cleared. There is no delete for these rows in the app. Reading a ranking or an answer does not store anything about the reader.

The draft page

The draft board is a static First&One mock. The fan mock builder runs in the browser. A shared mock is the link itself: team, pick, and prospect ids from the First&One list. It is not saved on a server, in an account, or as a contest. There is no place to type a title, a name, or a note. Opening a shared link sends its address to our hosting provider, which may keep it in request logs.

Power rankings

Staff rankings are stored on the server. A week holds a rank, a movement, and a blurb for each of the 32 teams. Those rows contain no reader data. We don't save notes. Opening a shared link sends its address, including any notes, to our hosting provider, which may keep it in request logs. The reader's board lives in this browser, and in a share link when the author includes it.

Google and X sign-in

When fan sign-in is turned on, a fan signs in with Google or with X. Google and X are the providers. We use the account so Six Degrees can keep unfinished games (up to five) and a rating.

Google sign-in asks Google for the openid, email, and profile scopes. We store a name, a profile image, and the email only when Google says email_verified is true.

X sign-in asks X for users.read, tweet.read, and users.email. It does not ask for offline.access. From X we receive the handle, the name, the profile image, and an email only when X has verified that email. We store the name and the profile image. We store the email only when it is verified. If X sends no verified email, we store a placeholder address made from the X user ID (x-<id>@users.invalid). We do not store the unverified address. We do not store the X handle. We do not store posts.

We keep the Google or X account ID that links the sign-in. The sign-in library stores an access token for that Google or X link. That token is encrypted. The ID token is not stored. A refresh token is not stored. We do not store other profile fields from Google or X.

Session rows store an IP address and a user agent, as plain text, along with the session token and when it expires.

A Google or X sign-in does not make someone staff. Staff sign-in is a separate email and password for at most two allowlisted addresses, each marked on the server. Signing in with Google or X does not attach to a staff account.

Public pages show a generated handle such as Player 4821. They do not show the Google or X name, the profile image, or the email. Staff can set a short public name. If they do not, the Player handle stays.

We keep the name, email, image, and encrypted access token while the fan account exists. The ID token is not stored. A refresh token is not stored. This page does not set an automatic deletion date. Deletion is by request to privacy@firstandone.com. Say it is a deletion request and include the email address on the Google or X account. We do not store the X handle. If the X account had no verified email, include the X handle. We look up the X user ID from that handle. We then remove that fan account: the name, email, image, session (including the IP address and user agent), and the Google or X sign-in link. Six Degrees ratings and saves tied to that account are removed with it when we process the request.

If Google and X are not turned on for a build, the fan buttons are not shown. A guest who leaves a Six Degrees game still loses that game in the browser.

What other people can see

• Answered fantasy questions. The handle you typed is hidden unless staff turns it on.
• Six Degrees standings, as a generated handle such as Player 4821. That list does not show an email, an account name, or an OAuth name unless staff has set a display name.
• A Six Degrees board, if they have the challenge link.
• A Power Rankings share link. It contains the team order and any notes the author chose to share. Anyone with the link can read that order and those notes. We don't save notes. Opening a shared link sends its address, including any notes, to our hosting provider, which may keep it in request logs.
• A fan mock share link. It contains the round length, prospect ids, and the teams that own the picks. Anyone with the link can read that mock. It is not saved on a server. Opening a shared link sends its address to our hosting provider, which may keep it in request logs.
• Nothing in the on-device Wire archive, event log, or seat-key storage, unless you share the device or the link.

Other services the pages load

Every page loads a font stylesheet from fonts.googleapis.com (Google Fonts: Archivo and IBM Plex Sans) and a script from https://grok.com/grok-app-builder/extensions.js. Player images may load from static.www.nfl.com. Some cards link to x.com.

The Wire refresh pulls public news feeds from our server, including Google News. Those requests go out as the site. There is no account.

No third-party analytics pixel was found in the app pages. The event log above stays in the browser. This page does not claim that those other services set no cookies.

Addresses used to limit requests

The server uses the first forwarded address on a request as an in-memory rate-limit key for reading a challenge, creating a challenge, joining a challenge, submitting a result, starting a rematch, locking a pair, locking a blind pick, and publishing a power rankings week. That key lives in the memory of that server instance. It is not written to the challenge table or the fantasy table. It is not a stored history. A new instance does not keep it.

How long it stays

Browser items stay until you clear this site's data in that browser. The pin map is treated as empty on a new calendar day. The event log drops older events after 800.

Challenge rows and fantasy questions have no delete in the app. The code does not set a retention period for them. The rate-limit keys are memory only and are not a stored history.

Children

The site does not ask for a date of birth and does not have an age gate. It is a general NFL site. It is not a children's product.