Security policy

Accounts and sign-in

• Sign-in is handled by a managed authentication service. The app never sees or stores your password.
• Google sign-in is available; when you use it, Google confirms your identity and the app receives only your email address and account id.
• Your session is kept in your browser's local storage and is cleared when you sign out.

League data

• All traffic between your browser and the servers runs over HTTPS.
• Database rules restrict reads and writes to the leagues you belong to. Owners can change only their own team; commissioner-only actions are checked on the server, not in the browser.
• Nightly game simulation runs as a scheduled server job. It writes league progress only — it never touches account credentials.
• The solo sandbox runs entirely in your browser and stores nothing on the server.

Reporting a vulnerability

If you find a security problem, email brianfarra@gmail.com with steps to reproduce. Please give a reasonable window to fix the issue before sharing it publicly, and avoid accessing other people's league data while testing. Reports are welcome from anyone; there is no bounty program.

What this page is not

Timeless Baseball League makes no certification or regulatory compliance claims and has not been independently audited. Treat it as a game, not as a system of record.