Privacy Policy

Account data: your email address, an optional display name, and a hash of your password if you set one. We never store your password itself.

If you sign up or sign in with Google, Google tells us your Google account ID, your email address, that Google has verified it, and your name. We use them only to create and sign in to your account. We never receive your Google password and get no access to your Google account, its contacts, files or mail.

Product data: the predictions you record, the analyses you open, your token balances, your trial and subscription state, and — if you arrived through one of our ads or links — where you arrived and the parameters of that link (see Traffic data), saved with the account when it is created.

Product activity: while you are signed in, we record which pages of the product you open, which matches you open and which tabs of a match you view, and when you are shown the plans or run out of tokens — with the time and the page. We keep these entries for 180 days. When you open a match analysis or run Pick Builder, we also keep what we showed you (the match, the teams, the chance and the pick) and, after the match, whether it came true. Only our operators see this; we use it to find where the product or our predictions let people down. It is deleted with your account.

Technical data: IP address and browser user-agent at sign-in and at sensitive actions, kept as an audit trail against account takeover and payment disputes.

Guest use: when you follow one of our links or visit without an account, we set a first-party cookie with a random identifier (it lasts up to 400 days). It links your visits into one visitor record (see below) and lets the free-trial check recognise a browser that has already used a trial. Only when we can tell that you are outside the EEA, the UK and Switzerland, your browser may also compute a coarse device signature from screen size, pixel density, time zone, languages, processor and memory size, touch support and platform (no canvas, WebGL or audio fingerprinting); it is used for the same purposes and is stored only as a one-way hash. Until 12 October 2026 guests could open a few free AI analyses a day, counted per browser, device signature and network address with daily one-way hashed counters; that allowance has been discontinued, those counters expired at the end of each UTC day, and the list of analyses a guest had unlocked is deleted 30 days after it was last used or moved into the account the guest created.

Free-trial checks: when an account is created, we keep a one-way hash of the guest cookie (up to 400 days), of the device signature together with the network address (60 days) and a per-address count of new trials (2 days), so that each person gets one free trial. These hashes cannot be turned back into an address or a device.

Traffic data: when you follow one of our ads or links, we keep where you arrived (the sport, game or section), when you clicked and the link parameters (campaign, ad set, ad, placement and click identifiers such as fbclid or gclid) in a first-party cookie for 30 days, so that a later sign-up can be credited to that ad. Some apps, such as Facebook and Instagram, hand the page over to your phone’s browser, which does not have that cookie; so that the visit is not lost, the same information is also kept on our server for up to two hours under a random identifier added to the page address. We also count visits, page views and sign-up clicks per ad in aggregate; those counters themselves carry no IP address and no identifier (the visitor record below does). Until 2 October 2026 we also kept a log of the IP address, user-agent and buttons pressed by visitors from our ads; it is no longer written, and its last entries delete themselves within 14 days of that date.

Visitor records: from 7 October 2026, so that we can see how many people our ads and links bring and how many of them try the product, sign up and subscribe, we keep one record per browser that visits without being signed in, keyed by the random identifier in the guest cookie. It holds when you first and last visited; your IP address and the country derived from it; your browser user-agent and what we read from it (device type, operating system, browser or the app whose in-app browser you used, device model); your preferred language; the external site that referred you; where you arrived and the parameters of the ad link you followed (as under Traffic data); and a list of steps with their time, page and IP address — following an ad link, viewing the free preview of matches and the match you opened on it, pressing the free-trial button, opening the sign-up form and creating an account (until 12 October 2026 also entering the product, viewing the dashboard, free unlocks and reaching the daily limit). Where advertising cookies need your consent (the EEA, the UK, Switzerland, or when we cannot tell your country) and you have not accepted them, or anywhere after you refuse them, we keep only the network part of your IP address (the first three blocks of an IPv4 address, the first three groups of an IPv6 address) and none of the screen, time-zone or device-signature details. Elsewhere the record also holds your screen size, time zone and the device signature described under Guest use. When an app hands the page over to your phone’s browser, the two browsers’ records are linked as one visitor. If you create an account from that browser, the record is linked to the account, so that we can see which visit led to a sign-up and a subscription. Only our operators can see these records; we use them to measure our advertising and to keep the free trial fair. A record is deleted 90 days after your last visit, or when you delete your account.

Pre-account checkout (discontinued): until 2 October 2026 some ad journeys collected the card on the Stripe checkout page before the account existed. For those checkouts we keep the Stripe checkout reference, the e-mail address given to Stripe, the IP address and the browser user-agent, so that the subscription can be attached to the account created afterwards and a payment dispute can be traced.

Advertising cookies and your consent: if you visit from the EEA, the UK or Switzerland — or we cannot tell where you are — no advertising pixel loads and our server sends nothing to advertising partners until you choose "Accept" in the cookie banner. Elsewhere advertising cookies are on unless you choose "Reject". You can change your choice at any time through "Cookie settings" at the bottom of every page; we remember it in a first-party cookie for 180 days.

Advertising measurement: we work with two advertising partners, each with its own Meta Pixel (Meta Platforms Ireland Ltd.). The first loads on the free preview of matches (/picks), the sign-up page and the app install page (/app); it records page views and the fact that an account was created. The second loads on every page of the site, including the product after you sign in; it records page views, when you open a match or its analysis (the sport or game and the match identifier), when you create an account, when your free trial starts, when you start a checkout (the plan and its price) and your first subscription payment (the plan, the amount without tax and the currency). Automatic collection of button clicks is switched off for it. The pixels may set cookies so Meta can measure whether our ads led to a visit, a sign-up or a purchase and can show you our ads on its services. For account, trial, checkout and payment events our server also reports the same event to Meta directly (Conversions API) together with a SHA-256 hash of your e-mail address and of your account id, your IP address, your browser user-agent, the Meta cookies your browser sent and the click identifier from the ad link that brought you here (kept in our own traffic cookie), so Meta can match the event to the ad you clicked even when your browser blocks the pixel. Because Stripe confirms a payment to our server after you have left the page, we keep those browser details from the moment you start a checkout for up to 30 days, only if you have not refused advertising cookies. The hash is used only to match against records Meta already holds; we never send the address itself, your password or card details. Meta processes this data under its own privacy policy; you can limit it through Cookie settings, your Meta ad settings or by blocking third-party cookies.

We do not sell personal data.

Apart from the two Meta Pixels described above, we do not run advertising pixels or third-party analytics trackers.

We do not build profiles of you for advertisers, and the guest and free-trial checks above are used only to keep the free trial fair.

Stripe processes payments. Card details go directly to Stripe and never reach our servers.

Google LLC authenticates you when you choose "Continue with Google" and processes that sign-in under its own privacy policy.

Meta Platforms Ireland Ltd. receives the events described under Advertising measurement (for events our server reports: a hash of your e-mail and account id, IP address, user-agent, Meta cookies, the ad click identifier and, for checkout and payment, the plan, amount and currency) and processes them under its own privacy policy.

AI providers process the match context needed to generate an analysis. That context is match data, not your personal data.

Our own infrastructure (database, cache) runs on a server we operate.

Account and billing records are kept while your account exists and afterwards for as long as tax and dispute rules require.

The guest cookie lasts up to 400 days; the former guest counters expired at the end of each UTC day and the list of analyses unlocked as a guest is deleted after 30 days; the traffic cookie lasts 30 days and its server-side hand-off copy two hours; visitor records are deleted 90 days after the last visit; free-trial check hashes are kept for the periods named above; your cookie choice lasts 180 days; the checkout details kept for advertising measurement are deleted after 30 days.

Generated analyses are cached and purged automatically once they expire.

You can delete your account yourself at any time: Account → Danger zone → Delete account. Deletion signs you out everywhere, closes any active subscription at the end of the paid period, and removes your personal data.

You can also request a copy of your data, or ask us to delete the account for you, by writing to support@sportslyx.com.

You can remove the guest and traffic cookies at any time by clearing this site’s cookies in your browser, and give or withdraw consent to advertising cookies at any time through Cookie settings at the bottom of every page.

Anonymised aggregate statistics may remain after deletion; they cannot be linked back to you.