Privacy Policy
The short version: we collect only what we need to run accounts and the free-tier limits. There are no ads, no advertising or analytics trackers, no session recording, and we do not sell your data.
1. Who we are
matchupedge.com (“matchupedge”, “we”) is operated by the operator of this site. For anything in this policy, contact matchupedge3@gmail.com.
2. What we collect
- Account details — your name and email address, your plan (free or paid), and counters for the free-tier allowance (how many analyses you have used and when the current allowance window started). Your password is handled by our authentication provider, which stores only a hash of it; we never see or store the plain-text password.
- Sign-up record — that you confirmed you are 18 or older, which version of the Terms and this policy you accepted and when, and whether you chose to receive product updates.
- Anonymous visitors — to enforce up to three free analyses per day we store a salted, one-way hash of your IP address, and a salted, one-way hash of the random token in your browser cookie (see Cookies below), each together with the date of each use. A free analysis is refused only when both have already used their three. We do not store your IP address in that record, and those records are deleted after about a week.
- The analyses you run — the player, opponent, prop and line you enter are used to produce your result. We do not keep a history of them against your identity.
- Hosting logs — our hosting provider automatically records standard request information (such as IP address, browser type and the page requested) for security and operations. We do not use it to profile visitors.
3. Cookies and tracking
We set at most two cookies, both strictly necessary for the site to work, so we do not show a cookie banner. A sign-in cookie keeps you logged in; it is signed and HttpOnly and is set only when you sign in. If you use the tool without an account, a second HttpOnly cookie holds a random token (no name, email or IP address) for up to 30 days; we store only a one-way hash of it, together with the date, so that people sharing one network (an office or a mobile carrier) each get their own free daily allowance. We do not use advertising cookies, analytics trackers, fingerprinting, or session-recording tools. If that changes we will update this policy first and use a privacy-respecting option.
We host our fonts, team logos and player images ourselves, so your browser does not contact Google or ESPN when you load a page.
4. Who else handles your data
- Supabase — account authentication and our database.
- Brevo — delivery of account emails (confirmation and password reset).
- Our hosting provider — runs the site and keeps the logs described above.
The “League wire” headlines are fetched by our server from public news feeds and link out to the publishers. If you click one, that publisher’s own privacy policy applies. We do not sell your personal information and we do not share it for advertising.
5. Why we use it (legal bases)
To provide the service you asked for (your account and analyses); for our legitimate interests in security, preventing abuse and enforcing usage limits; with your consent where you gave it (for example product updates); and where the law requires.
6. How long we keep it
Account data is kept until you delete your account. The hashed anonymous-usage records are deleted after about a week. Hosting logs follow our provider’s retention schedule.
7. Your rights
You can ask to access, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw any consent you gave. California residents have the right to know, delete and correct personal information and to opt out of its sale or sharing — we do neither. Email matchupedge3@gmail.com from the address on your account and we will respond within the time the law requires. You may also complain to your local data-protection authority.
8. Email
We send account emails (confirmation and password reset) because you asked for them. We send product updates or announcements only if you opted in at sign-up or otherwise asked us to. Every such email has an unsubscribe link and our postal address, and unsubscribing does not affect account emails. If we contact someone directly about matchupedge (for example a journalist or creator), we say who we are and honour any request to stop.
9. Children
matchupedge is not for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
10. Security and transfers
The site is served over HTTPS, passwords are stored only as hashes by our authentication provider, and access to our systems is limited. No system is perfectly secure, and we will notify you of a breach where the law requires. Our providers may process data in the United States and other countries; where the law requires, they rely on safeguards such as standard contractual clauses.
11. Changes
We will post changes here with a new version number, and tell account holders about material changes.