Privacy Policy

We collect information you provide directly to us when you create an account or contact us. HuddleSpy is free and we do not collect payment information. This may include:

• —Email address (for account creation and authentication). If you use Sign in with Apple and choose to hide your email, we receive an Apple relay address instead
• —If you sign in with Google: the name, profile picture link, and Google account identifier Google shares with us. Our authentication provider stores these with your sign-in record; HuddleSpy does not display, use, or share them
• —If you sign in with Apple: your email (or relay address) and an Apple account identifier. We do not ask Apple for your name
• —The teams and MMA fighters you add to your favorites
• —Messages you send us, for example to contact@huddlespy.com — your email address, the content of your message, and anything you choose to attach. We use these only to respond to you and to handle any follow-up
• —A record of your agreement to these terms — the date you accepted, the version of this policy shown to you, and whether you signed up on the website or the mobile app, and with an email address, Google, or Apple
• —The country your sign-up request came from, where we can determine it, so we can enforce our United States and Canada availability

When you use the Platform, we may automatically collect certain technical information, including:

• —Log data (IP address, browser type, pages visited, time and date). IP addresses are not written to our application logs in full — where we record a failed sign-in attempt we store only the surrounding network range and a one-way fingerprint, which lets us spot repeated attempts without retaining the address itself.
• —Browser and device type, from the standard user-agent information your browser or our app sends with each request
• —On the website, session activity data — mouse movement, keyboard activity, and click events are monitored locally in your browser solely to manage session expiration after 24 hours of inactivity. This data is stored in browser localStorage and is never transmitted to our servers.
• —A last-seen timestamp on your account, updated at most once every 15 minutes while you are signed in. This is recorded on our servers (unlike the browser-local session activity described above) and is used to understand account activity.
• —Server error logs, which contain no email addresses and no full IP addresses
• —Authentication logs kept by Supabase when you sign up, sign in, or reset your password, which include your IP address
• —In the HuddleSpy mobile app, your sign-in session is stored in your device's secure storage (iOS Keychain or Android Keystore). The app requests no device permissions — no location, contacts, camera, photos, or notifications — and contains no analytics, advertising, or crash-reporting software

We use the information we collect to:

• —Account management and authentication
• —Service delivery (publishing predictions and managing favorites)
• —Product improvement
• —Send transactional emails (account notices and legal or policy updates). We do not send marketing or matchup-analysis emails
• —Respond to support inquiries
• —Comply with legal obligations

We do not sell your personal information to third parties, and we do not share your personal data with advertisers or data brokers.

We rely on trusted third-party service providers to operate the Platform:

• —Supabase — authentication and database infrastructure
• —Inngest — event scheduling and workflow automation (runs our scheduled jobs; event data does not include your email address)
• —Resend — transactional email delivery (receives your email address and the content of the account and legal notices we send you)
• —Anthropic — AI prediction generation (receives structured sports data prompts; no user PII is included in prompts)
• —Vercel — frontend hosting and edge delivery
• —Railway — backend API hosting
• —IP geolocation provider (ipwho.is by default; ipinfo.io or ipapi.co if configured) — receives the IP address of a new sign-up's first request, only when its country cannot be determined otherwise, to enforce our United States and Canada availability. We store the resulting country code, not the IP address

These providers are contractually bound to handle your data securely and only for the purposes specified. All of them process your data in the United States.

If you choose to sign in with Google or Apple, that company verifies your identity and shares the details listed under “Information We Collect” with us. Google and Apple handle your data under their own privacy policies, not as our service providers.

We post matchup reports to the HuddleSpy Discord server. No information about you is sent to Discord by us. If you join the server, Discord's own privacy policy applies to your activity there.

We do not use any third-party analytics, advertising, or session-recording service. No behavioural tracking or session-replay technology runs on the platform.

We may disclose information about you when we believe in good faith that doing so is necessary to:

• —Comply with a law, regulation, subpoena, court order, or other legal process
• —Respond to a lawful request from a government or law-enforcement authority
• —Enforce our Terms of Service or investigate a possible violation of them
• —Protect the rights, property, or safety of HuddleSpy, our users, or the public, including to detect and prevent fraud, abuse, or security incidents

If HuddleSpy LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its business or assets, your information may be transferred as part of that transaction. Whoever receives it must continue to handle it under this Privacy Policy, and any material change to how it is handled will follow the process described under “Changes to This Policy”, including asking for your agreement.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS) enforced on every connection, encryption at rest at our database provider, secure authentication, and access controls.

We never store your password. Authentication is handled by Supabase Auth, which holds credentials in hashed form; HuddleSpy's own systems never receive your password. HuddleSpy takes no payments, so we hold no card or bank details.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal data for as long as your account is active or as needed to provide services. The following specific retention periods apply:

• —Account data (email, favorites, consent record) — deleted immediately when you delete your account from the app or this website; in all other cases within 30 days of account closure
• —Billing records from our former paid Pro subscription, where any exist — retained for 7 years from the transaction as required by financial recordkeeping obligations, then deleted. We no longer collect billing data.
• —Support emails you send us — kept until your request is resolved and any follow-up is complete, then deleted, unless we need to keep them to meet a legal obligation or to establish or defend a legal claim
• —Email delivery logs — retained for 90 days, then removed automatically by a scheduled job. They are also deleted immediately when you delete your account.
• —Application logs (hosting provider) — retained for up to 30 days. These contain no email addresses and no full IP addresses.
• —Authentication records (Supabase), including any Google or Apple profile details — deleted immediately as part of account deletion
• —Supabase authentication logs — kept for a limited period under Supabase's log-retention limits, then deleted automatically. They are not deleted early when you delete your account.

If you close your account, we will delete or anonymize your personal data within 30 days, except where retention is required by applicable law.

Depending on your jurisdiction, you may have the right to:

• —Access the personal data we hold about you
• —Receive a copy of your data in a portable, machine-readable format
• —Request correction of inaccurate data
• —Request deletion of your personal data
• —Object to or restrict processing of your data
• —Withdraw any consent you have given at any time, without affecting processing carried out before you withdrew it

Two of these you can exercise yourself, immediately, without contacting us:

• —Access and portability — Account → Settings → “Download my data” returns everything we hold about your account as a JSON file.
• —Deletion — Account → Settings → “Delete account” permanently deletes your account and removes your authentication record.

For anything else — correction, objection, restriction, or a question about a request — email us at contact@huddlespy.com from the address associated with your account. We respond to requests within one month.

HuddleSpy is not intended for, and is not offered to, users in the European Union, European Economic Area, or United Kingdom. Traffic from outside the United States and Canada is redirected away from the platform, and we refuse to create an account when a sign-up request comes from one of those regions.

We recognise that geographic detection is not perfect. If you are in the EU, EEA or UK and an account was nonetheless created, the following applies to you, and we would encourage you to delete the account using the self-service control described above.

Legal bases for processing

• —Performance of a contract (Art. 6(1)(b)) — creating and maintaining your account and delivering the predictions and features you signed up for.
• —Legitimate interests (Art. 6(1)(f)) — keeping the platform secure and available, preventing abuse, and enforcing our United States and Canada availability. We balance these against your rights and use the least identifying data that works, which is why our logs hold no full IP addresses.
• —Legal obligation (Art. 6(1)(c)) — retaining any billing records from our former paid subscription for the period financial recordkeeping law requires.

International transfers

HuddleSpy operates entirely in the United States, and every service provider listed above processes data there. If you are in the EU, EEA or UK, using the platform necessarily involves transferring your data to the United States, which has not received an adequacy decision of general application. We rely on Standard Contractual Clauses with our service providers where they are available. Because the service is not offered in these regions, we do not maintain a transfer-impact assessment programme, and you should not assume the safeguards you would expect from a service that does target them.

Your additional rights

Alongside the rights listed above, you may lodge a complaint with your national data protection supervisory authority. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — HuddleSpy makes no such decisions. Our predictions are AI-generated sports commentary; they are not decisions about you and are not based on your personal data.

We have not appointed an Article 27 representative in the EU or UK, because the service is not directed at those markets. Direct any GDPR request to contact@huddlespy.com and we will action it.

HuddleSpy does not set cookies. It uses browser local storage to maintain authentication sessions and to remember preferences you set yourself, such as theme (light/dark mode). We do not use tracking cookies, advertising cookies, or any analytics or session-recording technology. Every key we store is itemised in our Cookie Policy.

HuddleSpy is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly.

This Privacy Policy for HuddleSpy LLC of Mesa, Arizona is governed by and construed in accordance with the laws of the State of Arizona, USA, without regard to its conflict of law principles.

We may update this Privacy Policy from time to time. How we handle an update depends on what it changes:

• —Material changes — collecting a new kind of information, using it for a new purpose, sharing it with a new kind of recipient, keeping it longer, or reducing your rights. We will email you before the change takes effect, and the next time you sign in we will ask you to review and agree to the updated policy before you continue. If you do not agree, you can sign out, download your data, or delete your account instead. We will not apply a material change to information we already hold about you without your agreement.
• —Minor changes — clarifications, corrections, and other updates that do not affect how your information is handled. We post the updated policy with a new date and list the change below.

Change history

• —October 25, 2026 (2026-10-25, minor) — Moved the prediction disclaimer out of this policy; it remains in our Terms of Service and Legal Disclaimers, where we also reworded it. No change to how your information is handled. The Privacy Policy update we announced by email on October 11, 2026 for this date was withdrawn and did not take effect.
• —October 10, 2026 (2026-10-10, material) — Described the details received from Google and Apple sign-in, the mobile app, authentication logs, and our Discord server, and support emails; added sections on legal requests and business transfers; removed items we do not collect; introduced agreement to material updates.
• —October 2026 (2026-10) — Availability extended to Canada.

For privacy-related inquiries, please contact us at contact@huddlespy.com or visit huddlespy.com.