Privacy Policy

What We Collect

Spengine has no public sign-in. There is no account to create, so there is no profile, no saved list, and no search history attached to you. What we hold is narrow:

• Messages you send through the contact form — your name, your email address, and what you wrote. They reach us as an email.
• Anonymous records of sponsored and apparel results being shown or clicked. These carry no name, account, device or session identifier — see “Advertising and Analytics” below.
• Ordinary server logs kept by the hosting platform when your browser requests a page. We do not build anything on top of them or use them to identify visitors.
• Two functional cookies set by the authentication library the site uses. They hold a CSRF token and a return URL — not an identifier for you — and are not used for tracking or advertising.

What We Do Not Collect

• We do not keep a search history for you. The only place a query is stored is on an anonymous advertising record, where it sits with nothing that says who typed it.
• We do not personalise results. Two people running the same search get the same results in the same order.
• We run no third-party advertising or analytics scripts, no tracking pixels, and no fingerprinting.
• We do not sell, rent, or trade personal information, and we do not build advertising profiles.

How We Use Information

• To read and reply to messages you send us
• To report to advertisers on what ran, and to decide what to stock in the shop
• To keep the site working and to blunt abuse of public endpoints
• To comply with legal obligations

Information Sharing

We do not sell, trade, or rent your personal information. Limited sharing happens in three cases: with the service providers that run the site for us (hosting, database, and email delivery), where the law requires it, and in aggregate form that identifies nobody.

Advertising and Analytics

When a sponsored result or an apparel link is shown to you or clicked, we record that it happened. Those records hold the advertiser or retailer, the item, and the search context — the school, sport, and query the result appeared against. They do not contain a name, an account, or any identifier that ties the event back to you, and they are not used to build a profile or to target advertising. We use them to report to advertisers on what ran, and to decide what to stock in the shop.

An impression is only counted once the item has actually been visible on your screen. No third-party advertising scripts, ad-network tags, or tracking pixels run on Spengine.

Athlete Listings

Spengine is a directory. Every athlete listing is drawn from a roster the athletic department already publishes on its own site, and every result links back to that page. We index what the school posts — name, sport, class year, specialty, hometown — and we do not host athlete profiles, add anything a school has not published, or ask athletes for information.

Because the school's roster is the source, that is also where a correction has to happen: fix it there and the change reaches us on the next refresh, along with everyone else who reads that page. If a listing is wrong in the meantime, or an athlete would rather not be listed at all, tell us and we will re-check it against the school's page or remove it.

Data Security

All traffic to Spengine is encrypted in transit over HTTPS. The site runs on managed platforms — Vercel for hosting, Neon for the database — and inherits their access controls, patching, and backups. The most useful thing we do for your security is hold very little: with no accounts and no passwords, there is almost nothing about a visitor to lose.

Your Rights

There is no account to log into, export, or close, because there is none to begin with. In practice that means:

• If you have emailed us — we hold that message and your address. Ask and we will tell you what we have, correct it, or delete it.
• If you are an athlete — see “Athlete Listings” above. We will re-check your listing against your school's page or remove it on request.
• Advertising records — these carry no identifier for you, so we cannot single out yours to show or delete. That is a consequence of collecting nothing that points at you, not a refusal.
• Wherever you are — if the law in your jurisdiction gives you a right we have not listed, tell us and we will honour it.