Privacy Policy

1.Who we are and what this covers

This Privacy Policy explains how SportzPRED, Inc., a Maryland corporation (“SportzPRED”, “we”, “us”) handles information in connection with the SportzPRED website and tools (the “Service”). SportzPRED, Inc. is the controller of that information, and can be reached at the postal address in clause 14.

It does not cover any third-party site you reach from here — including any sportsbook, league site or support organisation we link to. Those services have their own policies, and we recommend reading them.

2.The short version

What this comes down to

We hold your account (email, a password we never see in plain text, an optional display name, your preferences, and a record of the terms you accepted), your credit balance and a running history of the predictions you have made, and the server logs and performance measurements needed to keep the Service running. We set sign-in cookies because sign-in cannot work without them. If you try a prediction before you sign up, a temporary guest login with no email or name holds it, and is deleted after 30 days. Our sign-up, sign-in and free-try pages run Cloudflare's check that you are a person, and you can choose to sign in with Google instead of a password. We measure how our website is used — which pages people visit, where they come from and where they run into trouble — with our own first-party analytics, which keeps your IP address for 30 days, and with Google Analytics, which sets its own cookies and sends Google the pages you view. We also run the Meta Pixel, which tells Meta (Facebook and Instagram) which of our pages you view and when you sign up or buy credits — with a scrambled form of your email address once you are signed in — so we can measure our ads and show them to people who have visited. We never record what you type. If your browser sends Do-Not-Track or Global Privacy Control, the Meta Pixel does not load at all and our own analytics only counts your visit; Google Analytics does not read those signals (clause 4 explains how to block it). We hold no card details of any kind — card payments are handled on Stripe's own checkout page and never reach us. The email we send is what sign-in needs — your confirmation link and password resets. No other marketing.

Five things worth knowing that aren't obvious: our authentication and database are provided by Supabase, so your account data is processed on Supabase's infrastructure (clause 7); our pages load their typefaces from Google's font servers, which means your IP address reaches Google when a page loads (clause 4); our pages also run Google Analytics, which records your visit for Google's reports to us (clause 4); they run the Meta Pixel, which tells Meta about your visit, your sign-up and your purchases so we can advertise on Facebook and Instagram (clause 4); and our own staff can see your account and act on it, which clause 9 describes rather than leaves to be assumed.

3.Information we collect

Information you provide

Account information. Your email address and password when you create an account. The password is handled by our authentication provider (Supabase) and stored only as a cryptographic hash — neither we nor Supabase can read it. Optionally, a display name, and the account preferences you set (timezone, favourite team, default league, notification choices).
If you sign in with Google. Google confirms your email address and tells us your name and the address of your profile picture. We ask Google for nothing else and never see your Google password. You still accept our terms on our own page before an account exists; until you do, only the Google sign-in itself is held.
The free try, without an account. When you run the free prediction on our /try page, our authentication provider (Supabase) creates a temporary guest login in your browser: a random identifier with no email, name or password, holding one free prediction and the record of that run. Supabase notes the IP address and browser type of that login, as it does for every sign-in. Before the run you confirm you are 18 or older and that predictions are not betting advice; that choice is stored only in your browser. If you then create an account on the same device, the run moves into your account's history and the guest login is deleted.
Your consent record. When you create an account you must accept the Terms, this policy and the responsible-use notice. We record which version of those documents you accepted and when — that record is what makes your acceptance, and our reliance on it, verifiable.
Prediction inputs. The scenario you type to run a prediction: player and team names, minutes, lineups, lines and prices, and the other settings on each model page. They describe basketball scenarios, not you — but if you type personal information into a free-text field it will be transmitted with everything else, so please don't.
Refund requests. If you ask for a refund from your billing history, we record which purchase it was about, the amount our records say is refundable, anything you chose to write in the optional reason box, and the decision and the reason we gave for it.
Early-Bird and Launch List sign-ups (closed). Until 6 October 2026 a pre-launch page asked for your email address and, optionally, a phone number with its country. The offer has ended and the page is gone, so we no longer collect any of this. Sign-ups already made are kept as described in clause 9: the email and phone, the result of confirming the email (the place in line and the pass number), a keyed hash of the IP address the request came from, and the browser's identifying string (its "user agent").
Correspondence. Anything you send us directly, such as a support email and the address it came from.

Information collected automatically

Server logs. Like any web service, our hosting and infrastructure providers record standard request data — IP address, user agent, requested URL, referrer, timestamp and response status — for security, abuse prevention and debugging.
How you use our website (first-party analytics). To learn which pages work and where people give up, our own pages record, and send only to our own servers: the pages you view and in what order, roughly how long each was in use and how far down you scrolled, which links and buttons you click (by their label), which form fields you move through (by the field's name — never what you type), error messages you are shown, pages that load slowly, and whether you left by closing the page, going to another site, or stopping. With each visit we record where it came from (the referring website's name and any campaign tag in the link), your device type, browser, operating system, screen size, language and time zone, an approximate location (country, region and city) worked out from your IP address by our hosting provider, and your IP address itself. If you are signed in, the visit is linked to your account. Web addresses are stored without their query string, so a sign-in link's code is never recorded.
Performance telemetry. We record technical measurements for each request and prediction job: which endpoint was called, how long it took, how much memory and CPU it used, how many database and upstream data calls it made, response size, and whether it errored. For signed-in requests this is linked to your account id, so we can attribute usage and investigate problems you report.
Rate-limiting counters. To stop one client overwhelming the Service and to make password and token guessing pointless, we keep a short-lived count of recent requests against your IP address, and against your account id once you are signed in, together with a count of failed sign-in attempts from an address. These are counters in a temporary store, not a browsing history: they hold timestamps, not what you asked for. The longest of these windows is fifteen minutes, after which the entries are gone.
Your prediction while it runs. A prediction is queued and computed in the background while your browser polls for the result, so the scenario you submitted and the result it produced are held on our side until we have delivered them to you. That record lives in server memory or, where we run a shared job store, in a temporary key-value store; either way it is short-lived and clause 8 says how short. It is operational storage so that a prediction can be handed over reliably, and it is not mined, profiled or kept.
Your checkout, for our advertising report. When you start a checkout we note your IP address, your browser's identification string, Meta's cookie ids and whether your browser asked not to be tracked, against that checkout, in the same temporary key-value store. It exists only so the purchase can be reported to Meta from our server (clause 4), and it expires after 7 days.

Cookies and browser storage

We set authentication cookies — the session tokens that keep you signed in, managed by our authentication provider. They are strictly necessary for sign-in and are not used for advertising or cross-site tracking. Your browser's storage also holds interface preferences, such as layout density, and tworandom identifiers for our own analytics: one that lets us recognise your browser when it comes back (kept in local storage), and one for the current visit, which your browser discards when you close the tab and which we replace after 30 idle minutes. Neither is derived from anything about you, and neither is shared with anyone. Clearing your browser's site data removes both. After you sign up, local storage also keeps a note of which accounts on this browser have already had their sign-up reported to Meta (clause 4), so it is not reported twice.

Google Analytics cookies. Our pages also load Google Tag Manager, which runs Google Analytics. Google Analytics sets its own cookies on our domain (named _ga and _ga_ followed by an identifier) holding a random id that recognises your browser on later visits; they last up to two years unless you clear them. Clause 4 describes what Google Analytics sends to Google.

Meta Pixel cookies. The Meta Pixel sets a cookie on our domain named _fbp, holding a random id that lets Meta recognise your browser on later visits, and — if you arrived by clicking one of our ads — one named _fbc, holding the id of that click. Both last up to 90 days after your last visit unless you clear them. If you are signed in to Facebook or Instagram in the same browser, Meta's own cookies also travel with the pixel's requests, which is how Meta can connect a visit to your account there. Clause 4 describes what the pixel sends.

Apart from the Meta Pixel we load no advertising script, session recorder or social media SDK. We do not build advertising profiles ourselves; Meta may use what the pixel sends to show you our ads on Facebook and Instagram, as clause 4 explains.

Do-Not-Track and Global Privacy Control. If your browser sends either signal, the Meta Pixel does not load at all, so Meta receives nothing from our pages. Our own analytics still counts that a page was viewed — so our totals stay honest — but records nothing that could follow you: no identifier, no IP address, no city, no account, and none of your clicks, scrolling or form progress. Google Analytics does not read these signals; clause 4 explains how to block it.

Your credit ledger and prediction history

Your account has a credit balance, and every movement of it is recorded against your account: the free credits granted when you signed up, and one entry for each prediction you run. A prediction entry stores which model ran, a short description of what you asked for, and a one-line summary of the result.

We are flagging this specifically rather than burying it in a list, because it is the one record here that describes you rather than your device: taken together it is a history of what you chose to model and when. We use it to show you your own history, to compute your balance, and to investigate problems you report. It is not sold and not used to profile you for anyone else. Your predictions are never shared for advertising; your purchases are, in the summary clause 4 describes (the pack, the amount, and where it sits in your purchase history), unless your browser sends Global Privacy Control or Do-Not-Track. Closing your account does not delete it — clause 8 explains why, and how to ask for erasure.

Payment details

We hold no card details. Payments are processed by Stripe. When you buy credits we send you to Stripe's own checkout page, hosted on Stripe's domain, and your card number, expiry and CVC are entered there. They do not pass through our servers, are not stored by us, and do not appear in our logs. There is no card field anywhere in SportzPRED.

What we do keep is the record of the purchase: the amount, the date, a reference number, and the card brand and last four digits Stripe reports back — the same details printed on a receipt, and what lets you identify a payment when you ask about a refund. We keep that history even if you close your account, because tax and accounting law requires us to.

Stripe is a payment processor in its own right and handles your card details under its own privacy policy, not ours. If you are in the EU or UK, note that Stripe may process your payment outside your country under its own transfer safeguards.

We collect no location data beyond what an IP address inherently implies: the approximate country, region and city our hosting provider derives from it, never GPS or precise location. If any of this changes we will update this page before the feature ships and revise the date above.

4.Third-party requests: web fonts, Google Analytics, the Meta Pixel and the bot check

Web fonts

Our pages load the Barlow and Barlow Condensed typefaces from Google's font servers (fonts.googleapis.com and fonts.gstatic.com). Your browser makes that request directly, which necessarily discloses your IP address, user agent and the referring page to Google. Google's handling of that request is governed by Google's Privacy Policy, not this one.

Google states that the Google Fonts API does not set cookies and does not use these requests to build advertising profiles. Even so, this is a transfer of your IP address to a third party that you did not separately agree to, and in some jurisdictions — Germany in particular — that has been held to require consent. We disclose it here so the choice to proceed is an informed one. Self-hosting these fonts would remove the transfer entirely and is a change we may make.

Google Tag Manager and Google Analytics

Every page loads Google Tag Manager (googletagmanager.com), a Google service that in turn runs Google Analytics, provided by Google LLC. We use it for aggregated reports on how the website is used: how many people visit, how they found us, and which pages they view. When a page loads, your browser sends Google the address of the page and the page you came from, your browser, device and screen details, your language, the random id in the Google Analytics cookie (clause 3), and the fact that you viewed the page or took an action on it. Google receives your IP address with each request and uses it to estimate your general location; Google states that Google Analytics does not log or store IP addresses. We do not send Google your name, your email address or your account details.

Google keeps this data for up to 14 months under our Google Analytics settings. Google handles it under its own terms — see how Google uses information from sites that use its services and Google's Privacy Policy.

To stop Google Analytics, install Google's opt-out browser add-on, use a content blocker, or block or clear this site's cookies. Blocking it does not affect how the Service works.

Meta Pixel (advertising)

Our pages run the Meta Pixel, a script from Meta Platforms, Inc. (connect.facebook.net), the company behind Facebook and Instagram. We use it to advertise SportzPRED on those services: to see how many people our ads bring to the site, to show our ads again to people who have visited, and to let Meta find people with similar interests. Each time you open a page, your browser sends Meta the address of the page and the page you came from, your browser, device and screen details, the random id in the _fbp cookie (clause 3), and the fact that you viewed the page. Meta receives your IP address with each request, and if you are signed in to Facebook or Instagram in the same browser, Meta can link the visit to that account.

We also tell Meta about four actions, so we can see which ads lead to them:

Opening a prediction tool — which one (for example, “Player Points”) and its category. Not the players, teams or settings you choose, and not the result.
Creating an account — that you signed up with an email address, and the free credits the account came with.
Starting a checkout — the credit pack you chose, its price and credits.
Buying credits — the pack, the amount charged and its currency, the credits it added, the payment's reference number, and where it sits in your purchase history: whether it is your first purchase or a repeat, how many you have made, the pack you bought last time and its price, how many days ago that was, and the total you have spent with us.

When you are signed in, our pages also give Meta a scrambled form of your email address and of your account ID, so Meta can recognise you as one of its users and connect your sign-up or purchase to the ad that led to it (Meta calls this “advanced matching”). The scrambling — a one-way SHA-256 hash — happens before anything leaves your browser or our servers, so your email address itself is never sent; Meta compares the hash against hashes of its own users' addresses.

From our servers as well. When you start a checkout or buy credits, our server also reports it to Meta directly (Meta's “Conversions API”), so a purchase still counts if your browser blocked the pixel or you closed the tab before Stripe sent you back. That report carries the same checkout or purchase details listed above, the scrambled email address and account ID, your IP address, your browser's identification string, and the Meta cookie ids (_fbp, _fbc) your browser held. Meta counts the browser's report and the server's report of the same purchase once. To send the purchase report, our server keeps those browser details, and whether your browser asked not to be tracked, for up to 7 days after you start a checkout (clause 8). If your browser sends Global Privacy Control or Do-Not-Track, our server sends Meta nothing either.

We do not send Meta your name, your password, anything you type into a form, your card details, or the predictions you run and their results. The pixel never runs on our sign-in pages, whose addresses carry one-time sign-in links. Meta handles this data under its own terms and may also use it for its own purposes, such as improving its advertising systems — see Meta's Privacy Policy.

To stop the Meta Pixel, turn on Global Privacy Control or Do-Not-Track in your browser: our pages then do not load it at all. You can also block it with a content blocker, clear this site's cookies to reset its id, or limit how Meta uses activity from other websites in your Facebook ad preferences. Blocking it does not affect how the Service works.

The bot check (Cloudflare Turnstile)

Our sign-up, sign-in, password-reset and free-try pages load Cloudflare Turnstile from challenges.cloudflare.com, a check that tells people apart from automated abuse. Almost always it runs without you noticing; occasionally it shows a single checkbox. It sends Cloudflare technical signals about your browser and device — not anything you type — and gives our authentication provider a one-time pass that the form sends along with your request. Cloudflare's handling of that request is governed by Cloudflare's Privacy Policy.

Signing in with Google

The Continue with Google button takes you to Google's own sign-in page and back. Google then knows you signed in to SportzPRED; nothing about it loads until you press the button.

Apart from web fonts, Google Tag Manager and Google Analytics, the Meta Pixel, the bot check, Google's sign-in page when you choose it, and our own infrastructure (including our authentication and database provider, clause 7), the Service makes no third-party browser requests: no other scripts from outside our own site, no embedded video from external hosts, no remote images.

5.How we use information

To create and administer your account, sign you in, and keep your session valid.
To run the prediction you asked for and return the result.
To email you — which today means authentication only. The messages we send are the ones sign-in requires: your signup confirmation link and password resets, sent through Supabase (clause 7). We send no other marketing.
To honour your notification preferences when those emails exist. Your account holds three switches — receipts, product updates and low-balance alerts. Receipts and product updates are not being sent yet; the switches record your choice in advance. When we do start sending them, product updates and low-balance alerts will go only to accounts that switched them on, every such email will carry an unsubscribe link, and we will revise this page and the date above before the first one goes out. Service messages — a security notice, a billing notice, or a material change to our terms — are not optional while you hold an account, because they are how we reach you about the account itself.
To take payment, keep your balance right, and assess and settle a refund you ask for.
To operate, maintain, debug and secure the Service, including applying rate limits and blocking repeated failed sign-in attempts, and otherwise preventing abuse.
To understand aggregate load and compute cost so we can size infrastructure and keep the Service responsive.
To understand how people use our website — how they find it, which pages they read, where they get stuck or leave, and which errors they run into — so we can improve it. Our own staff read this in our admin tools and in Google Analytics' reports (clause 4); we do not sell it.
To advertise the Service. The Meta Pixel (clause 4) tells Meta which of our pages a browser viewed and when someone signs up, starts a checkout or buys credits, so we can measure our ads on Facebook and Instagram, see which ones lead to sign-ups and purchases, and show them to people who have visited. Global Privacy Control or Do-Not-Track switches it off.
To improve model coverage and correctness — for example, spotting that a player name consistently fails to resolve.
To respond to you if you contact us.
To comply with law and to enforce our Terms of Service.

Apart from what the Meta Pixel sends Meta (clause 4), we do not use your information for advertising — never your predictions or their results — and we do not use it to make automated decisions that produce legal or similarly significant effects about you.

6.Legal bases for processing

Where the EU or UK GDPR applies to you, we rely on the following legal bases:

Performance of a contract — creating and operating your account and processing your scenario inputs in order to deliver the predictions you request.
Legitimate interests — keeping the Service secure and available, preventing abuse, debugging failures, attributing usage to accounts, understanding aggregate load, measuring how our own website is used so we can improve it, and measuring and showing our advertising through the Meta Pixel. We have considered your rights and consider this processing proportionate; the short retention periods in clause 8, and the Do-Not-Track and Global Privacy Control handling in clause 3 — which switches the Meta Pixel off entirely — are part of why.
Consent — the optional emails described in clause 5, if and when they begin. They are off until you switch them on, and you can withdraw that consent at any time in your account preferences or from the unsubscribe link, without affecting anything else and without stopping the service messages that come with holding an account.
Legal obligation — retaining or disclosing information where law requires it, including the record of your acceptance of our terms and the financial records tax law requires us to keep.

Where we rely on legitimate interests you have the right to object; where we rely on consent, withdrawing it is always available and never a condition of using the Service. See clause 10.

8.Data retention

We keep information only as long as we need it for the purposes above.

Your account and preferences, and the record of the terms you accepted: for as long as the account exists.
Your credit ledger — which is also your prediction history. Every entry, including the model you ran, the description of what you asked for and the one-line summary of the result, is kept for as long as the account exists. It has to be: your balance is calculated by adding the entries up, so deleting an entry would change your balance. This is a standing record of what you modelled and when, and clause 3 explains why we single it out.
Guest logins from the free try: deleted 30 days after they are made, or as soon as you create an account on the same device. The record that a prediction ran stays in our usage records without anything that identifies you. Supabase's own security logs of sign-ins are kept under Supabase's retention policy.
Server logs and performance telemetry: retained on a rolling short-term basis for security, debugging and capacity planning, then deleted or aggregated into non-identifying statistics.
Website analytics: your IP address is erased from a visit's record 30 days after the visit; the rest of the record — pages, clicks, the approximate location and a keyed hash of the address — is deleted after 90 days. Both happen automatically every night. Google Analytics data is kept by Google for up to 14 months (clause 4). What the Meta Pixel sends is kept by Meta under its own terms (clause 4).
Early-Bird and Launch List sign-ups: the offer closed on 6 October 2026. Sign-ups already made are kept while any credits awarded under them are still live, so the record of what was given stays with the account. You can ask us to remove yours at any time.
Rate-limiting counters: minutes. Each entry is dropped as soon as it falls outside its window, and the longest window we operate is fifteen minutes. Nothing accumulates and nothing is archived.
A prediction held while it runs: discarded within minutes of the result reaching you — within about thirty seconds of it where we run the shared job store — and in no case kept beyond an hour, which is also when a result nobody ever collects is thrown away. What survives is the one-line ledger entry described above, not the simulation.
Checkout details kept for the Meta report: 7 days from the start of the checkout, then deleted automatically. Meta keeps what it receives under its own terms (clause 4).
Refund requests: kept for as long as the account exists, and deleted with it. They are the record of what was asked and what was decided, which is what lets either of us revisit a decision.
Correspondence: as long as needed to handle the matter and to keep a record of it.

Closing your account does not erase your records. Your credit ledger — which holds every purchase, refund and prediction you ran — is retained, along with the identity attached to it. Tax and accounting law requires the record of a payment (what was bought, when, for how much, and by whom) to be kept for the statutory period after an account closes, and that record is not separable from the ledger it lives in: the same table is both your payment history and your prediction history.

What closing does remove is access. Every session is ended, sign-in is permanently refused, and any remaining balance stops being usable. If you want the personal data in those records erased rather than retained, write to support@sportzpred.com — we will tell you what we are required to keep and for how long, and remove the rest.

9.Security

We take reasonable technical and organisational measures to protect information against unauthorised access, loss and misuse: encryption in transit everywhere, passwords stored only as cryptographic hashes by our authentication provider, row-level security on the database so account data is only readable by its owner, session cookies scoped against cross-site use, rate limits that block repeated failed sign-in attempts from an address, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Not collecting payment details is itself part of our current security posture.

Who at SportzPRED can see your account

Staff holding an administrator role can see your account and the data described in clause 3 — your profile and preferences, your credit ledger and prediction history, your purchases and refund requests, and when you last signed in — and can act on an account: correcting a balance, deciding a refund, or suspending access. This is what running a paid service requires; we would rather say so than let you assume otherwise.

The same staff can read the website analytics described in clause 3: live and recent visits, the pages and actions in each, and — for a single visit, and only until it is erased after 30 days — its IP address. Email addresses are partly hidden on those screens.

It is bounded in three ways. The administrator role is granted deliberately and to individuals, and access is refused outright if the role cannot be confirmed rather than being allowed through on a technicality. Every action that changes something — every credit granted or removed, every suspension, every refund decision — is written to an audit record naming who did it, when, to which account and for what stated reason, and that record cannot be edited from the panel that writes it. And administrative sign-in can be required to carry a second factor in addition to a password.

10.Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to our processing of your personal information, to portability, and to withdraw consent where we rely on it. These rights exist under the EU and UK GDPR, the California Consumer Privacy Act as amended, India's Digital Personal Data Protection Act 2023, and comparable laws elsewhere.

Because your data is held against your account, we can act on these requests: you can view and correct your profile and your email preferences yourself from the account pages, and you can see your full prediction and credit history there too.

To opt out of website analytics and advertising, turn on Global Privacy Control or Do-Not-Track in your browser: the Meta Pixel then does not load at all, and our own analytics only counts your visit (clause 3). You can also clear this site's data to reset the identifiers we and Meta use. Those signals do not stop Google Analytics; clause 4 explains how to block it. To have the analytics we already hold about you deleted, write to us as below; for what Meta holds, use Meta's own tools (clause 4).

You can close your account yourself, from the profile page. It asks you to type your email address first, because it is irreversible and takes effect immediately. Closing ends every session, permanently refuses sign-in, and stops any remaining balance being usable — it is not refunded, so ask us about unused credits first.

Closing is not erasure. Your purchase and prediction records are retained for the reasons set out in clause 8. If you want them erased rather than retained, or you want an export, write to support@sportzpred.com and we will tell you what we are obliged to keep and remove the rest.

To exercise a right, contact support@sportzpred.com from the email address on your account. We will respond within 30 days, or tell you if we need longer. We will not discriminate against you for exercising any of these rights. If you are in the EEA or UK and believe we have handled your information improperly, you may also complain to your local supervisory authority.

11.International transfers

We and our service providers may process information in countries other than your own, whose data protection laws may differ from those of your jurisdiction — our database, authentication and application servers are currently hosted in the United States (Virginia), and Google and Meta process the analytics and advertising data they receive in the United States and elsewhere. Where we transfer personal information out of the EEA or the UK, we rely on an appropriate safeguard — such as the European Commission's Standard Contractual Clauses — or another lawful transfer mechanism.

12.Children

The Service is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children, and creating an account requires confirming you meet the age requirement. If you believe a child has provided us with personal information, contact support@sportzpred.com and we will delete it.

13.Changes to this policy

We may update this Privacy Policy as the Service changes. When we do, we will revise the “Last updated” date above, and for material changes — particularly any change that introduces analytics, payments or new categories of collection — we will take reasonable steps to bring it to your attention within the Service before it takes effect.

14.Contact

Questions, or to exercise a data right:

Email: support@sportzpred.com
Postal: SportzPRED, Inc., 3105 Marnat Road, Pikesville, MD 21208, United States