Privacy notice

Accounts and saved analysis

We use your email address, account identifier and sign-in session to create and secure your account. When you save a board entry, we store its title, notes, matchup, projection edition, scenario settings, selection, line comparison and save time. A saved parlay includes its selected legs and analysis.

We use these records to restore your board, reopen your analysis, generate requested exports and respond to support requests. Saved entries belong to your signed-in account; server and database checks restrict access by account. Please avoid putting sensitive personal information in board notes.

Joining Discord is separate. Following our Discord links opens Discord’s service under its own account and policies. MAP LABS website accounts do not automatically link to Discord identities or assign Discord roles.

Payments and support

Stripe receives the email and order/account references needed to connect your purchase to access. You enter payment details on Stripe’s hosted checkout page. Our application payment records do not contain your full card number or security code.

We keep order and Stripe reference identifiers, amount, currency, pass expiry, payment/access state and payment-event references. New live purchases also record the policy version and acknowledgment presented at checkout, plus when the app first confirms that Stripe reported acceptance. That observation is not an exact timestamp of your click. These records support fulfillment, refunds, dispute handling and accounting. Stripe also maintains its own payment and compliance records.

If you contact support, we receive the information you send and may retain correspondence and a case record to resolve and document your request. Do not email passwords, sign-in codes, full card numbers or security codes.

Cookies, browser storage and security

The hosted app uses secure session cookies. An unfinished parlay draft is stored in your browser separately from your saved online board. The app verifies the account before restoring that draft and clears hosted unfinished drafts in that browser after a successful app sign-out. Copies you download or share are under your control.

Cloudflare Turnstile helps check sign-in requests. The browser communicates with Cloudflare, and the app sends the resulting challenge token to Supabase for verification. Providers may process network addresses, device/browser information and operational request records to deliver and protect their services.

Our sign-in limiter uses keyed identifiers derived from the email and network-address bucket, plus attempt times and allowance state. Those limiter records do not store raw email addresses, raw network addresses or challenge tokens. The identifiers can still relate to a person and are not anonymous data.

The app and homepage do not use advertising or audience-analytics scripts. We do not sell account or board data or use it for targeted advertising. Essential sign-in, security and operational processing still occurs; browser tracking preferences do not disable those functions.

Services that help us operate

Providers receive the information needed for their services and may maintain their own security, legal and operational records. Processing is not limited to a single location. Authorized MAP LABS operators may use restricted local support and recovery copies on the owner’s computer.

• Render hosts the app and private model refresh worker.
• Supabase provides authentication, account/board/payment storage, sign-in limiting and private published-projection storage.
• Resend delivers sign-in and owner operational email.
• Stripe processes payments and payment/refund notifications.
• Cloudflare hosts the public homepage, manages domain/DNS services and provides the sign-in security check.
• Google provides the support email and business phone services. An independent Healthchecks monitor receives empty worker heartbeat requests and network metadata, not account or board data.
• Our mailbox provider handles postal mail sent to the business mailing address.

How long information is kept

Accounts and saved boards are not automatically deleted when a season pass ends. We keep them to provide account access, preserve saved analysis and handle requests. You can remove entries while you have board access or contact support to request a copy, correction or removal without purchasing another pass.

We review information for removal when it is no longer needed for these purposes or when you make a verified request. Limited payment, security and support records may need to remain for refunds, disputes, fraud prevention, accounting or applicable legal obligations. We assess those needs and explain relevant retention when handling a request; we do not promise that every category is erased immediately.

Limiter cleanup occurs as later requests arrive, so older records can remain when the service is idle. Provider logs have their own retention. Deleted or changed data may also remain in restricted recovery copies until those copies are replaced or removed. Local recovery copies currently require operator review and are not automatically expired.

Your requests and choices

Email maplabsanalytics@gmail.com to ask what data we hold, request a copy or correction, ask for removal or account closure, or raise a privacy concern. You do not need a paid pass or a new account to submit a request. Tell us the account email and what you want us to do; do not send sign-in codes or identity documents unless a specific lawful verification process is arranged.

We verify that a request concerns your account before releasing or changing personal data. If you cannot use its email address, tell us so we can review safe verification options. We will explain what can be completed and any information that must be retained. Account closure does not itself request a payment refund.

If you disagree with our response, reply to the support email with “Privacy appeal” and your case reference so we can review it. Applicable law may provide additional rights and response requirements. Contact us if you believe we have information from a child that should not be held.