1. Public information
Current weekly team choices and the administrative audit are not included in the public response.
2. League state
League storage contains display names, opaque enrollment identifiers, pool tier, survival state, revision, period history, weekly picks, used teams, game and period data, winner records, and operational audit events.
Audit facts use allowlisted operational fields. Pick audit events intentionally omit the selected team and game so an unrevealed choice is not exposed there.
3. No player account data
Final Clock does not create player accounts or request player email addresses, passwords, phone numbers, profile credentials, or payer identity. Application identities are limited to the administrator roster.
4. Administration
In production, an administrator signs in with Google through Firebase Authentication. The server uses Firebase Admin to verify the ID token, issues an HTTP-only signed Firebase session cookie only after roster authorization, and rechecks the exact email-and-subject match against the active Firestore administrator roster on every request. There are no player authentication identities or player sessions. Local development uses an explicit, non-production Administrator fixture.
5. Browser and network
- Pages use no third-party scripts, fonts, advertising, analytics, or payment service.
- The public browser makes one read-only status request.
- Administrative writes go through the server, which rechecks the active roster role and trusted time.
- API, HTML, and private responses use restrictive cache, framing, content, permission, and referrer policies.
- The application rate limiter temporarily counts requests by the network address visible to the service. Production also requires provider-side abuse controls and monitoring.
6. Retention
Production enrollment, picks, game state, and audit events are retained in durable league storage until the organizer's reviewed retention or correction procedure changes them. Production authentication is provider-backed; the application does not create player sessions. Local-development fixture state and rate-limit counters reset with the local process.
7. Security limits
Public display names are intentionally visible to anyone who can reach the public board. The private Admin workspace contains current choices and operational history.