Privacy Policy

Introduction and Scope

This Privacy Policy explains how The Sport Stack ("we", "us", "our") handles personal information when you visit the website (the "Service"). The Service is a data-driven sports analytics site covering MLB, NFL, college football, tennis and MMA: model projections, line boards, and a public record of the operator's own previously staked plays. It is informational and entertainment content only.

The Service has no forms and no newsletters, so it collects very little. Reading it collects traffic measurement, described below and itemised in the Cookie Policy (/cookies), which you can switch off. Paying for it collects a little more: where the Service offers paid access, the payment is taken by Stripe, and what we receive back is set out under "Payments and Subscriptions" below. This Policy should be read with our Terms of Service (/terms), Cookie Policy (/cookies) and Disclaimer (/disclaimer). If any further tracking is ever introduced, this Policy will be updated before it launches.

Who We Are (Data Controller)

For the purposes of the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the data controller is:

• Operator: The Sport Stack, operated by George Boyle, an individual based in Texas, United States
• Privacy contact: hello@thesportstack.io

If you have questions about this Policy or how we handle your information, write to hello@thesportstack.io.

What We Collect

We collect only what running a website unavoidably produces, plus whatever you choose to send us:

• Hosting logs. Our hosting provider, Vercel, receives the technical data every web request carries — your IP address, the address requested, your browser's user-agent string and the time — and keeps it for a limited period for security, abuse prevention and troubleshooting. We do not build profiles from it.
• Traffic measurement. Google Analytics 4 records, per page view, the page address and title, the referring site, any search or campaign that brought you, approximate location (country, region, city), device type, operating system, browser and screen size, plus, outside the European Economic Area and the United Kingdom, a randomly generated identifier stored in the _ga cookie so that repeat visits can be recognised. For EEA and UK readers no identifier is stored or read, so each visit is counted on its own. Google processes this for us as our service provider, and states that it does not log or store visitor IP addresses for Google Analytics 4 properties — the address is used to derive the approximate location and is then discarded. We have not enabled Google Signals and do not use the analytics for advertising. Vercel Web Analytics records, per page view, the time, page and route, the referring site, filtered query parameters, approximate location, operating system, browser and device type; it sets no cookie and stores no IP address, telling visits apart with a hash of the request that is discarded after 24 hours. Vercel Speed Insights records page-load timings with the page, browser, device type, network speed and country, not tied to any individual. The Cookie Policy (/cookies) lists every data point and how to switch all of this off.
• Preferences in your browser. Your theme choice, NFL filter selections and the analytics opt-out flag are kept in your browser's local storage. They stay on your device and are never sent to us.
• Account details, if you create an account. Accounts are free and have no password: you give us an email address, we send a one-time sign-in link, and following it signs you in. We store your email address, the date you confirmed you meet the age requirements, a founding-member number if yours is one of the first accounts (see the Terms of Service, /terms), and the technical session identifiers that keep you signed in. If you choose to sign in with Google instead of by email link, Google confirms your identity to us and shares the basic profile on that account — the email address, your name and a link to your profile picture — and those are stored with the rest; your name is shown on your account page, and the picture is never loaded or shown. That is the whole record. Supabase, our database and authentication provider, processes it for us. We do not read anything else in your Google account, and we never post anything to it. You can delete the account yourself at any time from your account page, which deletes the record rather than deactivating it.
• Payment and subscription details. If you buy paid access, Stripe collects your card details on its own pages and hands us back your email address, whether the payment succeeded, and limited billing metadata — see "Payments and Subscriptions" below for the full list and for what we deliberately never receive.
• What you send us. If you email us, we receive your address and your message and keep them for as long as we need to deal with them.

We do not knowingly collect special categories of data (such as health, biometric or precise geolocation data), and we ask that you not send us any.

Payments and Subscriptions

Where the Service offers paid access, payments are taken by Stripe, Inc., which acts as our payment processor. You buy informational analytics content and nothing else: the Service is not a sportsbook, it accepts no wagers, and it never holds, moves or escrows money you intend to bet. See our Terms of Service (/terms) for what paid access includes.

Your card details are entered on Stripe's own payment pages, not ours. We never see or store your full card number, and no full card number ever reaches our servers or our database. Stripe is the party that handles that data, as a payment processor under its own agreements and card-network obligations.

What Stripe passes back to us, and what we keep, is:

• The email address you used to buy, so we can identify your subscription and contact you about it.
• Whether a payment succeeded, failed or was refunded, and when.
• What you bought, what it cost, in what currency, and whether the subscription is active, cancelled or lapsed.
• Limited billing metadata Stripe returns for fraud prevention, tax and receipting — typically the card brand, the last four digits, the expiry month and year, and the billing country or postal code.
• Stripe's own identifiers for the customer, the subscription and the payment, which are how we look your record up without holding anything sensitive.

We use this to give you the access you paid for, to handle renewals, cancellations and refunds, to answer billing questions, to meet tax and accounting obligations, and to detect abuse. Our legal basis under the GDPR and UK GDPR is performance of a contract with you for the purchase itself, and legal obligation for the tax and accounting records that follow it.

Stripe processes payment data both on our behalf and as its own controller for fraud prevention, regulatory compliance and its financial-services obligations. What Stripe does with it is governed by the Stripe Privacy Policy at https://stripe.com/privacy, which is worth reading before you buy. Stripe may set cookies and run fraud-detection scripts on its own checkout pages; the Cookie Policy (/cookies) explains where our side ends and Stripe's begins.

How We Use It

• To operate, secure and troubleshoot the Service.
• To provide, renew, cancel and refund paid access, and to keep the billing and tax records that go with it.
• To understand which pages are read and how the site performs, in aggregate, so we can improve it.
• To answer messages you send us.
• To comply with the law, respond to lawful requests and enforce our Terms of Service (/terms).

We do not use any information about you to place, broker or facilitate a wager. The Service does not accept bets and does not hold or move money.

Legal Bases for Processing (GDPR / UK GDPR)

If you are in the EEA or the UK, we process personal information only on a lawful basis:

• Legitimate interests — keeping the Service secure and working (hosting logs), and understanding its use through aggregate traffic measurement. We balance these interests against your rights, and you can object at any time as described under "Your Privacy Rights" below, or simply switch analytics off on the Cookie Policy page (/cookies) — which stops the measurement before it starts rather than after.
• Performance of a contract — where you buy paid access, to take the payment, give you what you bought, and handle renewals, cancellations and refunds.
• Consent — only where we ask for it, for example if we ever offer optional communications. Nothing on the Service today relies on consent.
• Legal obligation — where the law requires us to keep records or respond to authorities, including the tax and accounting records that follow a purchase.

Cookies and Similar Technologies

Outside Europe and the UK, the Service sets two cookies, _ga and _ga_3ZBZJQ47RB, both first-party and both used only to count visits through Google Analytics. For readers in the European Economic Area and the United Kingdom it sets neither: Google Analytics is started in a mode that writes nothing to the device and reads nothing from it, so there is nothing to consent to. Nothing else on our pages sets a cookie: there is no advertising and no social-media pixel. Paying is the one journey that leaves our pages — checkout runs on Stripe's domain, where Stripe sets its own cookies under its own policies, as the Cookie Policy (/cookies) explains. The Service also keeps a few preferences — theme, filters, the analytics opt-out flag — in your browser's local storage, and those stay on your device. The Cookie Policy (/cookies) lists every item, what it is for, how long it lasts and how to opt out, including an on-page switch. Switching analytics off prevents the cookies being set at all.

How We Share Information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. Information reaches third parties only as follows:

• Service providers — Vercel hosts the site, serves it through its content-delivery network and runs the cookieless half of the traffic measurement described above; Google provides Google Analytics; Stripe processes payments for paid access and is the only provider that touches card data; our email provider handles messages sent to our address. Supabase holds the sports and betting data the site is built on, and — since accounts launched — runs the sign-in system and stores the account record described above; it receives nothing about a reader who does not create an account. Providers process information only to provide their service to us, under their data-protection terms — except Stripe, which is also its own controller for the fraud-prevention and regulatory purposes described above.
• Legal and safety disclosures — where we reasonably believe disclosure is required by law, regulation or legal process, or to protect the rights, property or safety of The Sport Stack, its readers or others.
• Business transfers — if the Service is ever transferred to a new operator, information may transfer with it, subject to this Policy or a successor policy.

International Data Transfers

The Service is operated from the United States and its providers process data there. If you visit from the EEA or the UK, the hosting logs and aggregate measurement described above are processed in the United States: by Vercel under its data-processing terms, which include the European Commission's Standard Contractual Clauses and the UK addendum, and by Google under the Google Ads Data Processing Terms, relying on its certification under the EU-US Data Privacy Framework and its UK extension together with the Standard Contractual Clauses. Nothing is stored on or read from an EEA or UK reader's device by us at any point. If you buy paid access from the EEA or the UK, Stripe processes that payment in the United States and elsewhere under its own transfer safeguards, described in the Stripe Privacy Policy (https://stripe.com/privacy). If you would rather the measurement did not happen at all, switching analytics off on the Cookie Policy page (/cookies) stops the Google transfer entirely, because the script is never loaded. Contact hello@thesportstack.io for more about these safeguards.

Data Retention

• Hosting logs are kept by our provider for a limited period for security and troubleshooting, then deleted.
• Traffic measurement is held by the two providers that collect it, not by us. Vercel keeps its analytics as aggregate statistics for the period our plan allows. For our Google Analytics property, Google keeps event-level data for 14 months and user-level data for 14 months; after that it deletes the underlying records and only aggregate reporting remains. Google Signals is not enabled, so none of it is joined to a Google account. The _ga cookies on your device expire separately, on the schedule set out in the Cookie Policy (/cookies).
• Account records are kept for as long as the account exists. Delete the account and the record goes with it, immediately and for real — it is not deactivated, flagged or archived. If you simply stop using the account, it stays until you delete it or ask us to.
• Billing and subscription records — the email address, the status of each payment, what was bought and the limited billing metadata listed above — are kept for as long as your subscription is active and then for as long as tax and accounting law requires us to keep records of the sale, which in the United States is generally several years. Stripe keeps its own copy under its retention rules and its Privacy Policy (https://stripe.com/privacy). Cancelling stops future billing; it does not erase the record of payments already made, because we are required to keep those.
• Messages you send us are kept for as long as needed to deal with them, then deleted.

Security

The Service is served over HTTPS, its systems are protected by access controls, and it runs on reputable providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; the amount of information about you that exists to protect is, by design, very small.

Your Privacy Rights (GDPR / UK GDPR)

If you are in the EEA or the UK, you have the right, subject to applicable conditions, to:

• Access — confirm whether we process your personal information and obtain a copy.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — request deletion in certain circumstances.
• Restriction — request that we limit processing in certain circumstances.
• Portability — receive certain information in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — at any time, where we rely on consent.
• Complaint — lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, write to hello@thesportstack.io. We may need to verify your identity before responding, and we will respond within the timeframes the law requires. If you have an account, the quickest route to erasure is the delete button on your account page — it removes the record there and then, without waiting on us. If you have never created an account or bought anything, we hold almost nothing that identifies you: the hosting logs belong to our provider's security process, and the analytics is keyed to a random identifier in a cookie on your device rather than to a name, an account or an email address — so in practice the quickest way to exercise a deletion or objection right is to clear this site's data in your browser and switch analytics off on the Cookie Policy page (/cookies), which we will always honor. If you have bought paid access, the billing record described above is tied to your email address; we will give you a copy or correct it on request, and delete what we are not required by tax and accounting law to keep.

Your California Privacy Rights (CCPA / CPRA)

The Sport Stack is below the thresholds at which the California Consumer Privacy Act applies to a business, so these rights may not apply to us as a matter of law. We honor them anyway. If you are a California resident you may:

• Ask what personal information we have collected about you, from where, for what purpose, and with whom it was disclosed.
• Ask us to delete personal information we have collected from you, subject to legal exceptions.
• Ask us to correct inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of; if that ever changes, a compliant opt-out will be provided first.
• Not be discriminated against for exercising any of these rights.

To exercise these rights, write to hello@thesportstack.io. You may use an authorized agent, and we may take reasonable steps to verify your identity and the agent's authority.

Children's Privacy

The Service is directed only to people who are of legal age to view sports-betting-related content where they live — at least 18, and 21 or older where local law requires. We do not knowingly collect personal information from anyone under those ages.

If you believe a minor has sent us personal information, contact hello@thesportstack.io and we will delete it. See our Responsible Gambling page (/responsible-gambling) and Terms of Service (/terms) for the age and eligibility requirements.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control or Do Not Track signal, our analytics does not record your visit: the Google Analytics script is never loaded, so no cookie is set and no request reaches Google, and the Vercel tools drop every event before it is sent. We treat both signals exactly like the on-page switch. You can also switch analytics off for a browser on the Cookie Policy page (/cookies).

Changes to This Policy

We may update this Policy when our practices, our providers or the law change. Material changes are reflected in the date at the top of this page, and anything that would collect more about you — an account, a payment, a tracker — will be described here before it is introduced.

Contact

• Privacy contact: hello@thesportstack.io
• Operator: The Sport Stack, operated by George Boyle, an individual based in Texas, United States

Governing law and venue for any dispute are set out in our Terms of Service (/terms): the laws of the State of Texas, United States.