Privacy Policy

What We Collect

Spengine has no public sign-in. There is no account to create, so there is no profile, no saved list, and no search history attached to you. What we hold is narrow:

• Messages you send through the contact form — your name, your email address, and what you wrote. They reach us as an email.
• Anonymous records of sponsored and apparel results being shown or clicked. These carry no name, account, device or session identifier — see “Advertising and Analytics” below.
• Anonymous records of how the search box is used: the words searched, which suggestion or result was picked and where it sat in the list, and how many results came back. Each record carries a random code your browser makes and replaces every day, and nothing else that could identify you — see “Advertising and Analytics” below.
• Ordinary server logs kept by the hosting platform when your browser requests a page. We do not build anything on top of them or use them to identify visitors.
• Two functional cookies set by the authentication library the site uses. They hold a CSRF token and a return URL — not an identifier for you — and are not used for tracking or advertising.
• Two items in your browser's local storage, neither of them a cookie and neither sent when your browser requests a page: that daily random code, replaced every day at midnight UTC; and a list of your last eight searches, which the search box shows when you click into it while it is empty. That list never leaves your browser — we never receive it. Remove a search from it with its ×, or clear this site's data in your browser to remove both.

What We Do Not Collect

• We do not keep a search history for you. Searches are recorded anonymously: no name, email, account or IP address is stored with them, and the code that groups one day's searches is random and replaced the next day, so no record can be traced to a person or linked to their searches on another day. The recent searches the box shows you are kept in your own browser, not by us.
• We do not personalise results. Two people running the same search get the same results in the same order.
• We run no third-party advertising or analytics scripts, no tracking pixels, and no fingerprinting.
• We do not sell, rent, or trade personal information, and we do not build advertising profiles.

How We Use Information

• To read and reply to messages you send us
• To report to advertisers on what ran, and to decide what to stock in the shop
• To keep the site working and to blunt abuse of public endpoints
• To improve search suggestions and results, using the anonymous search records described below
• To comply with legal obligations

Information Sharing

We do not sell, trade, or rent your personal information. Limited sharing happens in three cases: with the service providers that run the site for us (hosting, database, and email delivery), where the law requires it, and in aggregate form that identifies nobody.

Advertising and Analytics

When a sponsored result or an apparel link is shown to you or clicked, we record that it happened. Those records hold the advertiser or retailer, the item, and the search context — the school, sport, and query the result appeared against. They do not contain a name, an account, or any identifier that ties the event back to you, and they are not used to build a profile or to target advertising. We use them to report to advertisers on what ran, and to decide what to stock in the shop.

An impression is only counted once the item has actually been visible on your screen. No third-party advertising scripts, ad-network tags, or tracking pixels run on Spengine.

To improve search, we also record how the search box is used: the words of a search (once you have paused typing for a second, never each keystroke), which suggestion or result was picked and its position, which part of the site it happened on, and how many results came back. Each record carries a random code your browser makes and replaces every day, so one day's searches can be counted together, but never across days and never back to you. We do not store your IP address, name, email, account, or any device fingerprint with these records. We delete them after 90 days; what we keep after that is a count for each search phrase — how often it was searched, how many separate daily codes searched it, and how often a result was picked.

Athlete Listings

Spengine is a directory. Every athlete listing is drawn from a roster the athletic department already publishes on its own site, and every result links back to that page. We index what the school posts — name, sport, class year, specialty, hometown — and we do not host athlete profiles, add anything a school has not published, or ask athletes for information.

Because the school's roster is the source, that is also where a correction has to happen: fix it there and the change reaches us on the next refresh, along with everyone else who reads that page. If a listing is wrong in the meantime, or an athlete would rather not be listed at all, tell us and we will re-check it against the school's page or remove it.

Data Security

All traffic to Spengine is encrypted in transit over HTTPS. The site runs on managed platforms — Vercel for hosting, Neon for the database — and inherits their access controls, patching, and backups. The most useful thing we do for your security is hold very little: with no accounts and no passwords, there is almost nothing about a visitor to lose.

Your Rights

There is no account to log into, export, or close, because there is none to begin with. In practice that means:

• If you have emailed us — we hold that message and your address. Ask and we will tell you what we have, correct it, or delete it.
• If you are an athlete — see “Athlete Listings” above. We will re-check your listing against your school's page or remove it on request.
• Advertising records — these carry no identifier for you, so we cannot single out yours to show or delete. That is a consequence of collecting nothing that points at you, not a refusal.
• Search records — these carry no identifier for you, only a random code your browser replaces every day, so we cannot look up or delete the searches you made. That is a consequence of collecting nothing that points at you, not a refusal. They are deleted after 90 days in any case.
• Wherever you are — if the law in your jurisdiction gives you a right we have not listed, tell us and we will honour it.