Privacy policy

The short version

Without an account you can use every page (the stats, standings, team, player and game pages, the models, Trend Watch), use Ask for 10 questions, look around the dashboards and graphics they build, and open dashboards and graphics people share; more questions, and saving, editing, sharing and exporting, need a free account. Without one, Rinkside Lab does not ask for your name or email (the feedback form asks for an email only if you want a reply). It sets one cookie of its own, nhl_anon, a random anonymous ID: it counts your free Ask questions and is what your signed-out activity is recorded under (see Activity below); nothing in it says who you are. Ask answers 10 questions without an account, then needs a free one. Dashboards and graphics you make live in your own browser, and, when you press "Save to my account" (free, for every account), on this site’s server under your account, with their names and whether you pinned them, until you delete them or the account. They are in "Download my data".

One account works on all four of our sites: Pigskin Lab, Batter Lab, HoopVision Lab and Rinkside Lab. Pigskin Lab (pigskinlab.com) keeps it: your email address, a scrambled (hashed) form of your password, whether it has Pro, and whether you asked for feature emails; its privacy policy covers that. Rinkside Lab keeps your email, a sign-in cookie, and a record of what you do on this site, signed in or out (see Activity below). The few things that leave your browser are listed below, with who receives them.

Who handles your data

Rinkside Lab is run by Obegi Software LLC (Mason Obegi), a Washington limited liability company. Everything the site keeps is in its own database, on servers run by Railway, its hosting provider. Nothing is sold. These handle some of it to make the site work, each under its own privacy policy:

• Railway runs the server and its database (Railway's privacy policy).
• Cloudflare sits in front of the site: every request passes through it, and it counts page views with Cloudflare Web Analytics, which sets no cookies and records, for each view, the page, the site that sent you to it, your browser and your country (Cloudflare's privacy policy).
• Pigskin Lab (pigskinlab.com), our sister site, run by the same company, keeps your account and signs you in; it emails you about your account (Pigskin Lab's privacy policy).
• Resend delivers the emails: those about your account, sent by Pigskin Lab, and the copy of a feedback message sent to the site owner (Resend's privacy policy).
• Stripe takes tips through the tip jar; your card details go to Stripe, never to this site.

Accounts

One account for four sites: signing in on Rinkside Lab takes you to Pigskin Lab, which keeps the account and its password, and back. Pigskin Lab then tells this site's server, through a one-time code that works once, for one minute, and only for Rinkside Lab, your account number there, your email and whether the account has Pro (sponsored accounts, made by the site owner for people the owner gives a login to, have Pro for free). Rinkside Lab keeps those, and never your password. Dashboards and graphics you save to your account ("Save to my account", free for every account) are kept on this site's server under it, with their names and whether you pinned them, until you delete them or the account. Nothing is sold or shared. On Pigskin Lab's sign-in page you can also choose "Continue with Google": Google then tells Pigskin Lab your email address and that Google has verified it, nothing else, and no Google script is loaded on these sites' pages (Pigskin Lab's privacy policy has the details). This site is told only whether the account was made with Google, a password or an emailed link, to count sign-ups.

Activity: while you are signed in, the site records what you do on it, with the time: the pages you open (see Page addresses below) and how long they stay open, the name of the site that sent you, if another site did (never its full address), the buttons, links, menus and switches you use (their words, and which widget or card they belong to), the numbers, dates and colours you pick, which widgets are on your dashboard after each change, what you type into Ask and what it built, the dashboards and graphics you save, open and delete, the share links you make, whether you are on a phone, tablet or computer (from the screen's width), and sign-ins and sign-outs. It never records what you type into any other text box (passwords, emails, titles, notes, the "Wrong answer?" line). It is used to see what works and fix what does not, is never sold or shared, is included in "Download my data" on your account page, and is deleted with your account. Single actions are kept for 90 days; after that they are folded into daily totals (how many of each thing, per day), which are kept for a year.

Activity while signed out: the site records the same kinds of actions with the time, under the random anonymous ID in the nhl_anon cookie: the pages you open (see Page addresses below) and how long they stay open, the name of the site that sent you, if another site did, the buttons, links, menus and switches you use, the numbers, dates and colours you pick, which widgets are on your dashboard, that you asked Ask something, whether it answered and what kind of dashboard it built, when you reach the 10 free questions, and whether you are on a phone, tablet or computer (from the screen's width). It does not record your IP address, your browser's name or version, or what you type into a text box: not passwords, emails, titles or notes, and not the words of your Ask questions (those go into the anonymous Ask log below, as for everyone, and are never part of a page's address in these records: see Page addresses). Anything shaped like an email address is cut out of these records before they are kept. It is used to see what works and fix what does not, and is never sold or shared. These records are kept for 365 days, then deleted. If you later sign in to Rinkside Lab in the same browser, what was recorded under that ID is linked to your account (the link itself is kept for 400 days, or until the account is deleted): from then on it is part of your account's activity here, included in "Download my data" and deleted with the account. To start over, delete the site's cookies in your browser: your next visit gets a new ID that nothing ties to the old one, and the old records stay anonymous until they are deleted.

Page addresses: for each page you open and each link you use, the activity record (signed in or out) keeps only the path of its address (such as /build or /player/…), never what follows the "?" in it: not the Ask question a link carries (/build?q=…), not a dashboard in coded form. The one exception is a campaign tag from an ad or a campaign link (?ref=, utm_campaign or utm_source, and only when it is letters, digits, - and _), which is how the site tells which ads bring visitors who use it; the tag says nothing about who you are. The page you first arrived on is recorded as it was before the page changes its address, cut the same way. Records made before October 12, 2026, which kept the full address, have been cut the same way.

Counting, for everyone: to see which pages and features get used and which nobody uses, the site counts, per day, how many times each page is opened and each feature is used (for example "Download PNG: 12"), how many visits arrive, on what kind of screen (phone, tablet or computer, from its width only), and from what kind of site (a search engine, social media, a sister site; never the address). Each count is only a feature name and a number, with whether the visitor was signed in. The counting stores nothing in your browser; it keeps no IP address, no browser name or version, nothing typed, and nothing that could tell one visitor from another. Counts are kept for 400 days.

Emails about your account (confirming your address, a sign-in link when you forget your password where email is set up, "your password was changed"; an account with no email resets its password with the recovery code saved when it was made) are sent by Pigskin Lab, which keeps the account, through Resend, its email provider (see Resend's privacy policy). This site sends one kind itself, through Resend too: a copy of a "Send feedback" message, to the site owner (below).

Feature emails: if you tick the box ("Email me when new features launch", at sign-up on Pigskin Lab or in your account settings on any of the four sites), your email is used only to tell you about new features, never sold or shared; untick it anytime in your account settings. The choice, and when you last changed it, is kept on the account at Pigskin Lab; Rinkside Lab only reads and changes it there for you.

Using the site without an account sets one cookie, nhl_anon: a random number made by the server, kept for a year, that your browser's scripts cannot read. It counts how many of your 10 free questions you have used and is the anonymous ID your signed-out activity is recorded under (see Activity). The count (how many questions, and when you reached the limit or made an account) is kept until the ID has gone unused for 400 days; it holds nothing else. It is not shared with anyone. Deleting the cookie in your browser's settings starts a new ID. A signed-in account's answered questions are counted per day, for the limit of 100 a day, and those counts are kept for 35 days.

Signing in sets one cookie, nhl_sid, that keeps you signed in for up to 60 days. It is only a random key; the server stores a hash of it with the time it was made and last used, so that signing out or "sign out everywhere" end it (the record of one that simply expires is cleared out from time to time). Signing out here signs you out of Rinkside Lab only; the other sites keep their own sign-in. While you sign in, a second cookie, nhl_sso, holds a random value for up to half an hour, so the answer from Pigskin Lab is only accepted in the browser that asked for it; it is deleted once you are signed in. Neither is used for anything else.

Passwords are checked on Pigskin Lab, not here. The one exception: bringing an older account made on Rinkside Lab itself into your account asks for that old account's password; failed tries are counted in the server's memory, per account and per IP address, to slow guessing, and never written to the database.

On your account page you can download everything Rinkside Lab keeps about your account, and delete it: that removes what this site keeps, its activity and every sign-in here straight away (you confirm with your email address, and must have signed in within the last half hour). Pigskin Lab's "Download my data" includes this site's part too, which Pigskin Lab asks this site for directly. Deleting the account itself, on Pigskin Lab, deletes it on all four sites.

What stays in your browser

The site saves these in your browser's local storage, on your device only. Clearing the site's data in your browser deletes them.

• Your current dashboard and your saved dashboards, and the board's zoom
• Your current graphic in the graphics maker, and widgets you copied to paste elsewhere
• Your light or dark theme
• For half an hour after the site sends you to sign in, the page to come back to and the action you were taking (and, at the free Ask limit, the question you asked, so it is asked again once you are back)

And these in session storage, which your browser clears when you close the tab: a campaign tag you arrived with, what you typed into Ask on the home page, a dashboard or graphic on its way from one page to the maker that opens it, and whether you closed the tip bar.

What the server receives

Like any website, the server receives the pages and data your browser asks for, which includes your IP address and browser type. It uses them to answer the request. It keeps recent answers in memory to serve them faster; that memory is cleared whenever the server restarts and holds no account or profile of you.

“View the SQL” lists: the database queries behind a page you loaded, with the values they ran with (such as the players, clubs and seasons asked about) and the address of each request the page made (which can include what you typed into the search box), are kept in the server’s memory for up to 2 hours under a random code that only your browser is given, so the button can show them. They are never written to disk or linked to you or your cookie.

Your IP address is held only in the server's memory, to apply per-visitor limits: on requests per minute, on questions and share links per ten minutes, and on free Ask questions and new anonymous IDs per day (300 answers and 60 new IDs per address a day). It is never written to the database, and the server's memory is cleared whenever it restarts. The hosting provider (Railway) and the network in front of the site (Cloudflare) keep standard request logs under their own policies.

When you press Share link, the dashboard or graphic (its widgets or rows, their layout and title) is stored on the server under a short link, so anyone with the link can open it. Nothing about you is stored with it. The server counts how many times each link is opened. A shared link is kept until you ask for it to be taken down.

Ask: what happens to what you type

When you use Ask, the words you type, and the plan of the dashboard you are asking about (which players, teams, seasons and stats), are sent to the server. The site's own code reads them; they are not sent to any AI service or other outside company.

The microphone button next to Ask uses your browser's own speech recognition, and only after you press it and allow the microphone. While it listens, your browser sends the audio to its maker to turn into text (Google for Chrome, Microsoft for Edge, Apple for Safari), under that company's privacy policy. This site never receives or stores your voice: only the words, exactly as if you had typed them.

The server keeps a log of Ask requests, to find the ones it fails to understand: the words you typed, whether a dashboard was built, what it understood and, when it could not build one, what it said. The text of each request is kept anonymously for 365 days, then deleted: the log itself does not include your IP address or anything else that says who you are (the account activity above does, while you are signed in). Please don't type personal information into Ask.

If you press "Wrong answer?" under an answer, that request is marked in the log, with the note you add if you add one. If you arrive by a link with a campaign tag (a ?ref= or utm_ tag, as in an advert), the tag is counted once a day per tag and kept with your Ask requests, to see which links bring people who use the site; the tag itself says nothing about who you are (it is also part of the page address in the activity record, above).

Feedback

Only if you send it: the "Send feedback" form (the Beta tag, the footer, the tip bar) stores your message, the email address you give for a reply if you give one, the page you sent it from and the time. Nothing else is stored with the message: not your IP address and not your account, even when you are signed in (your activity, while you are signed in, shows that you used the form, as with any button, never what you wrote). Only the site owner reads it, on a private usage page and in a copy emailed to the owner through Resend (the email carries the message, the page and the reply address you gave, so a reply reaches you). Messages are deleted from the site after 365 days; to have yours removed sooner, contact [email protected].

To limit the form to five messages an hour per visitor, your IP address is held in the server's memory to count them. It is never written to the database.

Tips

The tip jar is a link to a payment page run by Stripe. Your card details and billing email go to Stripe, never to this site, and this site stores nothing about a tip. See Stripe's privacy policy.

Other services the pages load

Cloudflare, in front of the site, adds its Web Analytics script to the pages; it counts page views without cookies, with the page, the referring site, the browser and the country of each. Nothing else comes from other companies' servers: the fonts are the site's own.

Children

The site is not aimed at children under 13 and does not knowingly collect information from them. If you think a child under 13 has given us personal information, contact [email protected] and it will be deleted.

Your rights and choices

Depending on where you live, you may have the right to see the personal data the site keeps about you, to have it corrected or deleted, to get a copy, and to object to how it is used. You can do most of this yourself:

• "Download my data", on your account page, gives you a copy of what Rinkside Lab keeps about your account (saved dashboards and graphics, daily Ask counts and activity, signed in and signed out).
• Deleting it, on the same page, removes what Rinkside Lab keeps straight away; deleting the account on Pigskin Lab removes it on all four sites.
• Feature emails can be switched off in your account settings on any of the four sites.
• Clearing the site's data in your browser removes everything kept there, and the nhl_anon cookie with it.

For anything else (a feedback message, a share link you want taken down, or a question about your data), contact [email protected]. Records kept under the anonymous ID, and the Ask log, say nothing about who you are, so they cannot be looked up by person; they are deleted on the schedule above.

The site does not sell personal data or share it for advertising.

Changes

If this policy changes, the date at the top changes with it. Material changes to how data is used will be noted on the site.

Who runs this site

Rinkside Lab (rinksidelab.com) is run by Obegi Software LLC (Mason Obegi), a Washington limited liability company. Contact: [email protected].