Privacy Policy

We collect information you provide directly to us when you create an account, subscribe to a plan, or contact us. This may include:

• —Email address (for account creation and authentication)
• —Subscription status and billing records
• —Payment information (processed securely via Stripe — we do not store card details)
• —Favorite teams, athletes, and account preferences
• —Usage data and feature interactions
• —A record of your agreement to these terms — the date you accepted, the version of this policy shown to you, and whether you signed up with an email address or with Google
• —The country your sign-up request came from, where we can determine it, so we can enforce our United States–only availability

When you use the Platform, we may automatically collect certain technical information, including:

• —Log data (IP address, browser type, pages visited, time and date). IP addresses are not written to our application logs in full — where we record a failed sign-in attempt we store only the surrounding network range and a one-way fingerprint, which lets us spot repeated attempts without retaining the address itself.
• —Device information (operating system, screen resolution)
• —Session activity data — mouse movement, keyboard activity, and click events are monitored locally in your browser solely to manage session expiration after 24 hours of inactivity. This data is stored in browser localStorage and is never transmitted to our servers.
• —A last-seen timestamp on your account, updated at most once every 15 minutes while you are signed in. This is recorded on our servers (unlike the browser-local session activity described above) and is used to understand account activity.
• —Performance and error data

We use the information we collect to:

• —Account management and authentication
• —Service delivery (publishing predictions, managing favorites and preferences)
• —Process subscriptions and payments
• —Product improvement and analytics
• —Send transactional emails (account confirmations, billing notices)
• —Send optional product emails such as the daily matchup briefing — you can opt out at any time from your Account page
• —Respond to support inquiries
• —Comply with legal obligations

We do not sell your personal information to third parties, and we do not share your personal data with advertisers or data brokers.

We rely on trusted third-party service providers to operate the Platform:

• —Supabase — authentication and database infrastructure
• —Stripe — payment processing and subscription billing
• —Inngest — event scheduling and workflow automation (receives user IDs and email addresses as part of billing and email event payloads)
• —Resend — transactional and marketing email delivery (receives user email addresses and email content)
• —Anthropic — AI prediction generation (receives structured sports data prompts; no user PII is included in prompts)
• —Vercel — frontend hosting and edge delivery
• —Railway — backend API hosting

These providers are contractually bound to handle your data securely and only for the purposes specified. All of them process your data in the United States.

We do not use any third-party analytics, advertising, or session-recording service. No behavioural tracking or session-replay technology runs on the platform.

HuddleSpy predictions are AI-generated for entertainment and informational purposes only. HuddleSpy is not a gambling or sports betting service, predictions should not be used as the basis for financial or betting decisions, prediction accuracy is not guaranteed, and historical performance does not guarantee future results.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS) enforced on every connection, encryption at rest at our database provider, secure authentication, and access controls.

We never store your password. Authentication is handled by Supabase Auth, which holds credentials in hashed form; HuddleSpy's own systems never receive your password. We likewise never store card details — those go directly to Stripe.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal data for as long as your account is active or as needed to provide services. The following specific retention periods apply:

• —Account data (email, preferences, favorites, consent record) — deleted immediately when you delete your account from the app or this website; in all other cases within 30 days of account closure
• —Billing records — retained for 7 years as required by financial recordkeeping obligations
• —Email delivery logs — retained for 90 days, then removed automatically by a scheduled job. They are also deleted immediately when you delete your account.
• —Application logs (hosting provider) — retained for up to 30 days. These contain no email addresses and no full IP addresses.
• —Authentication records (Supabase) — deleted immediately as part of account deletion

If you close your account, we will delete or anonymize your personal data within 30 days, except where retention is required by applicable law.

Depending on your jurisdiction, you may have the right to:

• —Access the personal data we hold about you
• —Receive a copy of your data in a portable, machine-readable format
• —Request correction of inaccurate data
• —Request deletion of your personal data
• —Object to or restrict processing of your data
• —Withdraw your consent to optional processing (such as product emails) at any time, without affecting processing carried out before you withdrew it

Two of these you can exercise yourself, immediately, without contacting us:

• —Access and portability — Account → Settings → “Download my data” returns everything we hold about your account as a JSON file.
• —Deletion — Account → Settings → “Delete account” permanently deletes your account, cancels any active subscription, and removes your authentication record and billing profile.

You can turn product emails off at any time from your Account page, or with the unsubscribe link in the footer of any such email.

For anything else — correction, objection, restriction, or a question about a request — email us at contact@huddlespy.com from the address associated with your account. We respond to requests within one month.

HuddleSpy is not intended for, and is not offered to, users in the European Union, European Economic Area, or United Kingdom. Traffic from outside the United States is redirected away from the platform, and we refuse to create an account when a sign-up request comes from one of those regions.

We recognise that geographic detection is not perfect. If you are in the EU, EEA or UK and an account was nonetheless created, the following applies to you, and we would encourage you to delete the account using the self-service control described above.

Legal bases for processing

• —Performance of a contract (Art. 6(1)(b)) — creating and maintaining your account, delivering the predictions and features you signed up for, and processing your subscription.
• —Legitimate interests (Art. 6(1)(f)) — keeping the platform secure and available, preventing abuse, and enforcing our United States–only availability. We balance these against your rights and use the least identifying data that works, which is why our logs hold no full IP addresses.
• —Consent (Art. 6(1)(a)) — optional product emails such as the daily matchup briefing. You can withdraw this at any time; accounts we identify as being in these regions have product emails switched off by default.
• —Legal obligation (Art. 6(1)(c)) — retaining billing records for the period financial recordkeeping law requires.

International transfers

HuddleSpy operates entirely in the United States, and every service provider listed above processes data there. If you are in the EU, EEA or UK, using the platform necessarily involves transferring your data to the United States, which has not received an adequacy decision of general application. We rely on Standard Contractual Clauses with our service providers where they are available. Because the service is not offered in these regions, we do not maintain a transfer-impact assessment programme, and you should not assume the safeguards you would expect from a service that does target them.

Your additional rights

Alongside the rights listed above, you may lodge a complaint with your national data protection supervisory authority. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — HuddleSpy makes no such decisions. Our predictions are AI-generated sports commentary; they are not decisions about you and are not based on your personal data.

We have not appointed an Article 27 representative in the EU or UK, because the service is not directed at those markets. Direct any GDPR request to contact@huddlespy.com and we will action it.

HuddleSpy uses essential cookies and browser local storage to maintain authentication sessions and to remember preferences you set yourself, such as theme (light/dark mode). We do not use tracking cookies, advertising cookies, or any analytics or session-recording technology. Every key we store is itemised in our Cookie Policy.

HuddleSpy is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly.

This Privacy Policy for HuddleSpy LLC of Mesa, Arizona is governed by and construed in accordance with the laws of the State of Arizona, USA, without regard to its conflict of law principles.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on the Platform with an updated date. Your continued use of the Platform after such changes constitutes your acceptance of the revised policy.

For privacy-related inquiries, please contact us at contact@huddlespy.com or visit huddlespy.com.