Privacy Policy

What The Sport Stack collects when you read it, what it does with that, and the choices you have.

November 9, 2026 · Applies to The Sport Stack

Introduction and Scope

This Privacy Policy explains how The Sport Stack ("we", "us", "our") handles personal information when you visit the website (the "Service"). The Service is a data-driven sports analytics site covering MLB, NFL, college football, tennis and MMA: model projections, line boards, and a public record of the operator's own previously staked plays. It is informational and entertainment content only.

The Service has no forms and no newsletters, so it collects very little. Reading it collects traffic measurement, described below and itemised in the Cookie Policy (/cookies), which you can switch off. Paying for it collects a little more: where the Service offers paid access, the payment is taken by Stripe, and what we receive back is set out under "Payments and Subscriptions" below. This Policy should be read with our Terms of Service (/terms), Cookie Policy (/cookies) and Disclaimer (/disclaimer). If any further tracking is ever introduced, this Policy will be updated before it launches.

Who We Are (Data Controller)

For the purposes of the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the data controller is:

Operator: The Sport Stack, operated by George Boyle, an individual based in Texas, United States
Privacy contact: hello@thesportstack.io

If you have questions about this Policy or how we handle your information, write to hello@thesportstack.io.

What We Collect

We collect only what running a website unavoidably produces, plus whatever you choose to send us:

Hosting logs. Our hosting provider, Vercel, receives the technical data every web request carries — your IP address, the address requested, your browser's user-agent string and the time — and keeps it for a limited period for security, abuse prevention and troubleshooting. We do not build profiles from it.
Traffic measurement. Google Analytics 4 records, per page view, the page address and title, the referring site, any search or campaign that brought you, approximate location (country, region, city), device type, operating system, browser and screen size, plus, outside the European Economic Area and the United Kingdom, a randomly generated identifier stored in the _ga cookie so that repeat visits can be recognised. For EEA and UK readers no identifier is stored or read, so each visit is counted on its own. Google processes this for us as our service provider, and states that it does not log or store visitor IP addresses for Google Analytics 4 properties — the address is used to derive the approximate location and is then discarded. We have not enabled Google Signals and do not use the analytics for advertising. Google Analytics also receives ten counts that carry no personal detail: the sign-up screen being shown in place of a members page (with which sport), a sign-in being started (with which method), a new account being created (with whether by Google, email or password), the plans being shown (with what led you to them, and whether you were signed in), a link to a blog post being pressed (with which post, and where the link was), a blog post being read for at least 30 seconds, a blog post being read to its end (each with which post), a plan or the first-week offer being pressed or picked (with which plan, where on the site the button was, what led you to it, and whether you were signed in), a question on the plans or the Track Record link beside them being opened (with which one), and leaving for the payment page (with which plan, what led you to it, and whether it followed straight on from signing up). Our own measurement, outside the European Economic Area and the United Kingdom only, records per page view the time, the page address (without its query string, apart from campaign tags), the referring site and any campaign tag or ad click id that brought you, approximate country and region, device type, browser and operating system, together with two random identifiers held in the _sa_v and _sa_s cookies; it also records those same ten counts, and three page-speed readings for a page load (how long the main content took to appear, how long the page took to respond to a tap or click, and how much the layout shifted), kept with the page address, device type, approximate country and the visit they belong to. It stores no IP address. If you start a checkout, the _sa_v identifier is attached to the Stripe checkout so a purchase can be credited to the site or link that brought you; that is the one point where a visit record meets a billing record, and it is used only to see which sources lead to purchases. The Cookie Policy (/cookies) lists every data point and how to switch all of this off.
Preferences in your browser. Your theme choice, NFL filter selections and the analytics opt-out flag are kept in your browser's local storage. They stay on your device and are never sent to us.
Account details, if you create an account. Accounts are free. You give us an email address and sign in with a one-time link or code we email you, or with a password if you choose to set one. A password is never stored or seen by us in readable form: our authentication provider keeps only a one-way hash of it, and we cannot tell you what it is — if you forget it, you sign in with an emailed code and set a new one. We store your email address, the date you confirmed you meet the age requirements, a founding-member number if yours is one of the first accounts (see the Terms of Service, /terms), the technical session identifiers that keep you signed in, and a visit log: for each day you open the Service while signed in, which pages you opened that day, and for each whether it showed you its content or the plans that open it. The visit log records the day, not the time of each visit or how long you spent, and is used only to see how often members come back, what they read and where they reach a page their plan does not open; it is never shared or used for advertising. If you choose to sign in with Google instead of by email, Google confirms your identity to us and shares the basic profile on that account — the email address, your name and a link to your profile picture — and those are stored with the rest; your name is shown on your account page, and the picture is never loaded or shown. That is the whole record, apart from the trial record described under Data Retention. Supabase, our database and authentication provider, processes it for us. We do not read anything else in your Google account, and we never post anything to it. You can delete the account yourself at any time from your account page, which deletes the record rather than deactivating it.
Payment and subscription details. If you buy paid access, Stripe collects your card details on its own pages and hands us back your email address, whether the payment succeeded, and limited billing metadata — see "Payments and Subscriptions" below for the full list and for what we deliberately never receive.
What you send us. If you email us, we receive your address and your message and keep them for as long as we need to deal with them.

We do not knowingly collect special categories of data (such as health, biometric or precise geolocation data), and we ask that you not send us any.

Payments and Subscriptions

Where the Service offers paid access, payments are taken by Stripe, Inc., which acts as our payment processor. You buy informational analytics content and nothing else: the Service is not a sportsbook, it accepts no wagers, and it never holds, moves or escrows money you intend to bet. See our Terms of Service (/terms) for what paid access includes.

Your card details are entered on Stripe's own payment pages, not ours. We never see or store your full card number, and no full card number ever reaches our servers or our database. Stripe is the party that handles that data, as a payment processor under its own agreements and card-network obligations.

What Stripe passes back to us, and what we keep, is:

The email address you used to buy, so we can identify your subscription and contact you about it. That includes one welcome email when you join, addressed by the first name on your account or the card you used, if there is one, and pointing to the sport you were looking at when you bought, which we pass to Stripe with your order. It also includes one reminder email the day before a starter week ends, with the date and the amount of the next charge.
Whether a payment succeeded, failed or was refunded, and when.
What you bought, what it cost, in what currency, and whether the subscription is active, cancelled or lapsed.
Limited billing metadata Stripe returns for fraud prevention, tax and receipting — typically the card brand, the last four digits, the expiry month and year, and the billing country or postal code.
Stripe's own identifiers for the customer, the subscription and the payment, which are how we look your record up without holding anything sensitive.

We use this to give you the access you paid for, to handle renewals, cancellations and refunds, to answer billing questions, to meet tax and accounting obligations, and to detect abuse. Our legal basis under the GDPR and UK GDPR is performance of a contract with you for the purchase itself, and legal obligation for the tax and accounting records that follow it.

The starter week is offered once per person. To hold to that, when you start a checkout we read the tss-device cookie (a random number for this browser, described in the Cookie Policy) and a one-way hash of the IP address the request came from, and when a starter week is paid we keep, apart from your account: a one-way hash of your email address, that browser number, that IP hash, and Stripe's fingerprint of the card — an identifier Stripe derives from the card so the same card can be recognised, not the card number. These are used only to decide whether a later checkout, on any account, opens with a starter week, and are kept after an account is deleted, because deleting and re-creating an account is the case they exist for. Our legal basis is our legitimate interest in preventing abuse of the offer.

Stripe processes payment data both on our behalf and as its own controller for fraud prevention, regulatory compliance and its financial-services obligations. What Stripe does with it is governed by the Stripe Privacy Policy at https://stripe.com/privacy, which is worth reading before you buy. Stripe may set cookies and run fraud-detection scripts on its own checkout pages; the Cookie Policy (/cookies) explains where our side ends and Stripe's begins.

How We Use It

To operate, secure and troubleshoot the Service.
To provide, renew, cancel and refund paid access, and to keep the billing and tax records that go with it.
To understand which pages are read and how the site performs, in aggregate, so we can improve it.
To answer messages you send us.
To comply with the law, respond to lawful requests and enforce our Terms of Service (/terms).

We do not use any information about you to place, broker or facilitate a wager. The Service does not accept bets and does not hold or move money.

Legal Bases for Processing (GDPR / UK GDPR)

If you are in the EEA or the UK, we process personal information only on a lawful basis:

Legitimate interests — keeping the Service secure and working (hosting logs), and understanding its use through aggregate traffic measurement. We balance these interests against your rights, and you can object at any time as described under "Your Privacy Rights" below, or simply switch analytics off on the Cookie Policy page (/cookies) — which stops the measurement before it starts rather than after.
Performance of a contract — where you buy paid access, to take the payment, give you what you bought, and handle renewals, cancellations and refunds.
Consent — only where we ask for it, for example if we ever offer optional communications. Nothing on the Service today relies on consent.
Legal obligation — where the law requires us to keep records or respond to authorities, including the tax and accounting records that follow a purchase.

Cookies and Similar Technologies

Outside Europe and the UK, the Service sets four cookies to count visits, all first-party: _ga and _ga_3ZBZJQ47RB for Google Analytics, and _sa_v and _sa_s for our own measurement. For readers in the European Economic Area and the United Kingdom it sets none of them: Google Analytics is started in a mode that writes nothing to the device and reads nothing from it, and our own measurement does not run, so there is nothing to consent to. Nothing else on our pages sets a cookie for a reader who is not signed in: there is no advertising and no social-media pixel. Paying is the one journey that leaves our pages — checkout runs on Stripe's domain, where Stripe sets its own cookies under its own policies, as the Cookie Policy (/cookies) explains. The Service also keeps a few preferences — theme, filters, the analytics opt-out flag — in your browser's local storage, and those stay on your device. The Cookie Policy (/cookies) lists every item, what it is for, how long it lasts and how to opt out, including an on-page switch. Switching analytics off prevents the cookies being set at all.

How We Share Information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. Information reaches third parties only as follows:

Service providers — Vercel hosts the site and serves it through its content-delivery network; Google provides Google Analytics; Stripe processes payments for paid access and is the only provider that touches card data; our email providers handle messages sent to our address and deliver the sign-in and billing emails we send you, which means they receive your email address and the message. Supabase holds the sports and betting data the site is built on, and — since accounts launched — runs the sign-in system and stores the account record described above, and — in a separate database — stores our own traffic measurement described above; beyond that measurement it receives nothing about a reader who does not create an account. Providers process information only to provide their service to us, under their data-protection terms — except Stripe, which is also its own controller for the fraud-prevention and regulatory purposes described above.
Legal and safety disclosures — where we reasonably believe disclosure is required by law, regulation or legal process, or to protect the rights, property or safety of The Sport Stack, its readers or others.
Business transfers — if the Service is ever transferred to a new operator, information may transfer with it, subject to this Policy or a successor policy.

International Data Transfers

The Service is operated from the United States and its providers process data there. If you visit from the EEA or the UK, the hosting logs and the Google Analytics measurement described above are processed in the United States: the logs by Vercel under its data-processing terms, which include the European Commission's Standard Contractual Clauses and the UK addendum, and the measurement by Google under the Google Ads Data Processing Terms, relying on its certification under the EU-US Data Privacy Framework and its UK extension together with the Standard Contractual Clauses. Nothing is stored on or read from an EEA or UK reader's device by us, apart from the sign-in and checkout cookies the Cookie Policy describes, which exist only because you signed in or started a checkout. If you buy paid access from the EEA or the UK, Stripe processes that payment in the United States and elsewhere under its own transfer safeguards, described in the Stripe Privacy Policy (https://stripe.com/privacy). If you would rather the measurement did not happen at all, switching analytics off on the Cookie Policy page (/cookies) stops the Google transfer entirely, because the script is never loaded. Contact hello@thesportstack.io for more about these safeguards.

Data Retention

Hosting logs are kept by our provider for a limited period for security and troubleshooting, then deleted.
Our own traffic measurement is kept for 14 months and then deleted, with one exception: the visit records of a reader who went on to buy are kept with the billing record they are credited to, for as long as that record is kept (see below). The _sa_ cookies on your device expire on the schedule set out in the Cookie Policy (/cookies).
The rest of the traffic measurement is held by the provider that collects it, not by us. For our Google Analytics property, Google keeps event-level data for 14 months and user-level data for 14 months; after that it deletes the underlying records and only aggregate reporting remains. Google Signals is not enabled, so none of it is joined to a Google account. The _ga cookies on your device expire separately, on the schedule set out in the Cookie Policy (/cookies).
Account records are kept for as long as the account exists. Delete the account and the record goes with it, immediately and for real — it is not deactivated, flagged or archived. If you simply stop using the account, it stays until you delete it or ask us to.
One exception, from the 7-day free trials offered until October 24, 2026: we keep a SHA-256 hash of the address (lower-cased) and the date the address was first confirmed here, so a trial an address has used is not started again. We cannot read the address back out of the hash, but anyone who already knows an address can check it against the hash, so we treat it as personal information. It outlives a deleted account, is used only to stop a second trial on the same address, and is never shared. Ask us to remove it and we will; the address could then start another trial.
Billing and subscription records — the email address, the status of each payment, what was bought and the limited billing metadata listed above — are kept for as long as your subscription is active and then for as long as tax and accounting law requires us to keep records of the sale, which in the United States is generally several years. Stripe keeps its own copy under its retention rules and its Privacy Policy (https://stripe.com/privacy). Cancelling stops future billing; it does not erase the record of payments already made, because we are required to keep those.
Messages you send us are kept for as long as needed to deal with them, then deleted.

Security

The Service is served over HTTPS, its systems are protected by access controls, and it runs on reputable providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; the amount of information about you that exists to protect is, by design, very small.

Your Privacy Rights (GDPR / UK GDPR)

If you are in the EEA or the UK, you have the right, subject to applicable conditions, to:

Access — confirm whether we process your personal information and obtain a copy.
Rectification — have inaccurate or incomplete information corrected.
Erasure — request deletion in certain circumstances.
Restriction — request that we limit processing in certain circumstances.
Portability — receive certain information in a structured, machine-readable format.
Objection — object to processing based on our legitimate interests.
Withdraw consent — at any time, where we rely on consent.
Complaint — lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, write to hello@thesportstack.io. We may need to verify your identity before responding, and we will respond within the timeframes the law requires. If you have an account, the quickest route to erasure is the delete button on your account page — it removes the record there and then, without waiting on us (apart from the trial record described under Data Retention, which we remove on request). If you have never created an account or bought anything, we hold almost nothing that identifies you: the hosting logs belong to our provider's security process, and the analytics is keyed to a random identifier in a cookie on your device rather than to a name, an account or an email address — so in practice the quickest way to exercise a deletion or objection right is to clear this site's data in your browser and switch analytics off on the Cookie Policy page (/cookies), which we will always honor. If you have bought paid access, the billing record described above is tied to your email address; we will give you a copy or correct it on request, and delete what we are not required by tax and accounting law to keep.

Your California Privacy Rights (CCPA / CPRA)

The Sport Stack is below the thresholds at which the California Consumer Privacy Act applies to a business, so these rights may not apply to us as a matter of law. We honor them anyway. If you are a California resident you may:

Ask what personal information we have collected about you, from where, for what purpose, and with whom it was disclosed.
Ask us to delete personal information we have collected from you, subject to legal exceptions.
Ask us to correct inaccurate personal information.
Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of; if that ever changes, a compliant opt-out will be provided first.
Not be discriminated against for exercising any of these rights.

To exercise these rights, write to hello@thesportstack.io. You may use an authorized agent, and we may take reasonable steps to verify your identity and the agent's authority.

Children's Privacy

The Service is directed only to people who are of legal age to view sports-betting-related content where they live — at least 18, and 21 or older where local law requires. We do not knowingly collect personal information from anyone under those ages.

If you believe a minor has sent us personal information, contact hello@thesportstack.io and we will delete it. See our Responsible Gambling page (/responsible-gambling) and Terms of Service (/terms) for the age and eligibility requirements.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control or Do Not Track signal, our analytics does not record your visit: the Google Analytics script is never loaded, so no cookie is set and no request reaches Google, and our own measurement is not started either. We treat both signals exactly like the on-page switch. You can also switch analytics off for a browser on the Cookie Policy page (/cookies).

Changes to This Policy

We may update this Policy when our practices, our providers or the law change. Material changes are reflected in the date at the top of this page, and anything that would collect more about you — an account, a payment, a tracker — will be described here before it is introduced.

Contact

Privacy contact: hello@thesportstack.io
Operator: The Sport Stack, operated by George Boyle, an individual based in Texas, United States

Governing law and venue for any dispute are set out in our Terms of Service (/terms): the laws of the State of Texas, United States.