Privacy Policy

How The Sport Stack collects, uses, shares, and protects your personal information.

[Effective date — set before publishing] · Applies to [The Sport Stack]

This is a plain-language template provided for general information — it is not legal advice. Items in [brackets] are placeholders. Have it reviewed and completed by qualified counsel for your jurisdiction before you rely on or publish it.

Introduction and Scope

This Privacy Policy explains how [The Sport Stack] ("we", "us", "our") collects, uses, shares, and protects personal information when you visit or use our website and related services (collectively, the "Service"). The Service is a data-driven sports analytics platform covering MLB, NFL, and MMA that publishes model projections, best bets, player-prop edges, line-shopping boards, and a public record of the operator's own previously staked plays. It is provided for informational and entertainment purposes only.

This Policy applies to personal information we process through the Service. It is designed to be read alongside our Terms of Service (/terms), Cookie Policy (/cookies), and Disclaimer (/disclaimer). By using the Service, you acknowledge the practices described here. If you do not agree, please do not use the Service.

Today the Service is offered free of charge and does not require a user account. This Policy also describes practices that will apply once user accounts and, potentially, paid subscription tiers are introduced, so that our commitments are clear in advance. Features described as forward-looking do not operate until they are launched.

Who We Are (Data Controller)

For the purposes of the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the data controller responsible for your personal information is:

Operator: [The Sport Stack]
Legal operating entity: [legal operating entity — to be confirmed]
Privacy contact: [privacy@thesportstack.example]
General/legal contact: [contact@thesportstack.example]

If you have questions about this Policy or how we handle your personal information, please contact us at [privacy@thesportstack.example].

What Personal Information We Collect

We aim to collect only what we need. What we collect depends on how you interact with the Service and which features are live at the time.

Information we collect today (no account required):

Server and access logs, including your IP address, the pages and resources you request, referring URLs, timestamps, and error data.
Device and browser information, such as browser type and version, operating system, screen and viewport characteristics, and general device type.
Usage and analytics data, such as which pages, boards, and features you view, and how you navigate the Service.
Cookie and local storage flags, such as your age-acknowledgment status and your cookie-consent choice, and similar small preference indicators. See our Cookie Policy (/cookies) for details.

Information we would collect once accounts launch (forward-looking):

Account details, such as your email address, username, and a securely hashed password (we do not store passwords in plain text).
Preferences and settings you configure, such as favorite sports, teams, or display options.
If paid subscription tiers are introduced: billing and transaction details necessary to process your subscription. Payments would be handled by a third-party payment processor, and we would not store full payment card numbers on our systems. We may retain limited information such as a subscription status, plan, and partial identifiers returned by the processor.

We do not intentionally collect special categories of data (such as health, biometric, or precise geolocation data), and we ask that you not submit such information to us.

How We Use Personal Information

We use personal information for the following purposes:

To operate, maintain, and deliver the Service and its content.
To secure the Service, prevent fraud and abuse, and diagnose and fix technical problems.
To remember your preferences and choices, including your age acknowledgment and cookie-consent selection.
To understand and improve how the Service is used through analytics and aggregated measurement.
Once accounts exist: to create and manage your account, authenticate you, and communicate with you about your account, security, and Service-related matters.
Once paid tiers exist: to process subscriptions, manage billing, and provide related support.
To comply with applicable law, respond to lawful requests, and enforce our Terms of Service (/terms).

We do not use your personal information to place, broker, or facilitate any wager. The Service does not accept bets and does not handle, hold, or transfer customer funds.

Legal Bases for Processing (GDPR / UK GDPR)

If you are in the EEA or the UK, we process your personal information only where we have a valid legal basis. The bases we rely on, mapped to purpose, are:

Consent — for non-essential cookies and similar technologies, and for any optional communications you opt into. You may withdraw consent at any time.
Legitimate interests — to secure and improve the Service, understand usage through analytics, prevent fraud and abuse, and maintain server and access logs. We balance these interests against your rights and freedoms.
Performance of a contract — once accounts and paid tiers exist, to create and manage your account, provide the features you request, and process subscriptions you purchase.
Legal obligation — to comply with applicable laws, retain certain records, and respond to lawful requests from authorities.

Where we rely on legitimate interests, you have the right to object, as described in the "Your Rights" section below.

Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to make the Service work, remember your choices (such as your age acknowledgment and cookie-consent selection), and measure usage. Some of these are essential to the Service; others are used only with your consent where required.

For a fuller description of the specific technologies we use, their purposes, and how to manage them, please see our Cookie Policy (/cookies).

How We Share Personal Information

We do not sell your personal information. We share personal information only in the limited circumstances described below.

Service providers and processors — vendors that help us run the Service under our instructions, including hosting and content-delivery (CDN) providers, Supabase (our database and backend provider), our analytics provider, and, if paid tiers launch, a third-party payment processor. These providers may process personal information only to provide services to us and are bound by appropriate confidentiality and data-protection obligations.
Legal and safety disclosures — where we reasonably believe disclosure is required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of [The Sport Stack], our users, or others, or to enforce our Terms of Service (/terms).
Business transfers — in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be transferred as part of the transaction, subject to this Policy or a successor policy.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

International Data Transfers

We and our service providers may process and store personal information in countries other than the one in which you reside, including in the United States. These countries may have data-protection laws that differ from those in your country.

Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement or Addendum [SCC / transfer-mechanism details — to be confirmed with counsel], or transfers to jurisdictions recognized as providing an adequate level of protection. You may contact us at [privacy@thesportstack.example] for more information about these safeguards.

Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Server and access logs are typically retained for a limited period for security, troubleshooting, and abuse-prevention purposes, then deleted or aggregated.
Analytics data is retained in accordance with our analytics provider's settings and our internal measurement needs, often in aggregated or de-identified form.
Once accounts exist: account information is retained for the life of your account and for a reasonable period afterward, subject to legal and operational requirements.
Once paid tiers exist: billing and transaction records are retained as needed to fulfill the subscription and to meet tax, accounting, and legal obligations.

When personal information is no longer needed, we delete, anonymize, or securely store it beyond the reach of further routine processing.

Security

We take reasonable technical and organizational measures designed to protect personal information against loss, misuse, and unauthorized access, alteration, or disclosure. These measures include, as appropriate, encryption in transit, access controls, hashed storage of passwords, and use of reputable service providers.

No method of transmission over the internet or method of electronic storage is completely secure. While we work to protect your personal information, we cannot guarantee absolute security. You are responsible for keeping any future account credentials confidential.

Your Privacy Rights (GDPR / UK GDPR)

If you are located in the EEA or the UK, you have the following rights in respect of your personal information, subject to applicable conditions and exemptions:

Access — to obtain confirmation of whether we process your personal information and a copy of it.
Rectification — to have inaccurate or incomplete personal information corrected.
Erasure — to request deletion of your personal information in certain circumstances.
Restriction — to request that we limit our processing in certain circumstances.
Portability — to receive certain personal information in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
Objection — to object to processing based on our legitimate interests.
Withdraw consent — to withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.
Complaint — to lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, contact us at [privacy@thesportstack.example]. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law.

Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know — to request the categories and specific pieces of personal information we have collected, the sources, the purposes for collecting it, and the categories of third parties with whom we disclose it.
Right to delete — to request deletion of personal information we have collected from you, subject to legal exceptions.
Right to correct — to request correction of inaccurate personal information we maintain about you.
Right to opt out of sale or sharing — we do not sell or share your personal information, so there is nothing to opt out of; if this ever changes, we will provide a compliant opt-out mechanism.
Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that would trigger this right; if this changes, we will honor requests to limit such use.
Right to non-discrimination — you will not receive discriminatory treatment for exercising any of your privacy rights.

To exercise these rights, contact us at [privacy@thesportstack.example]. You may use an authorized agent to submit a request on your behalf, and we may take reasonable steps to verify your identity and the agent's authority before responding.

Children's Privacy

The Service is directed only to individuals who are of legal age to view sports-betting-related content in their jurisdiction — at least 18 years old, and 21 or older where local law requires. The Service is not directed to, and we do not knowingly collect personal information from, anyone under those ages.

If you believe that a minor has provided us with personal information, please contact us at [privacy@thesportstack.example] and we will take reasonable steps to delete it. See our Responsible Gambling (/responsible-gambling) resources and Terms of Service (/terms) for related age and eligibility requirements.

Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no common industry standard for how to interpret DNT signals, we do not currently respond to them.

Where required by applicable law, we treat a recognized Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of personal information. As noted above, we do not sell or share personal information, but we honor such signals to the extent the law requires.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or the features of the Service, including the launch of accounts or paid subscription tiers. When we make material changes, we will update the effective date shown on this page and, where appropriate, provide additional notice.

We encourage you to review this Policy periodically. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy, to the extent permitted by law.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

Privacy contact: [privacy@thesportstack.example]
General/legal contact: [contact@thesportstack.example]
Operator: [The Sport Stack]
Legal operating entity: [legal operating entity — to be confirmed]

For questions about governing law and venue, please refer to our Terms of Service (/terms) [Governing law & jurisdiction — to be set with counsel].