Privacy Policy

We collect the minimum needed to run the product. Specifically:

• Account info — your email address and any name you provide. Authentication is handled by Clerk; we receive a stable user ID and your verified email.
• Billing info — we never see your card number. Stripe handles payments and tells us the customer ID, subscription state, and whether a charge succeeded. PCI compliance lives entirely on their side.
• Usage data — which picks you unlocked, marked as taken, monitored, and any notes you added. We use this to render your tracker page and improve the product.
• Session metadata — IP address and basic browser info, kept only long enough to detect account sharing and block obvious abuse.

We do not collect or store: payment card details, your physical location, biometrics, or browsing data outside our own site.

We rely on a small set of vendors. Each has their own privacy policy:

• Clerk — authentication and user accounts. Clerk privacy.
• Stripe — payments and subscription billing. Stripe privacy.
• Resend — transactional emails (pick alerts, billing receipts). Resend privacy.
• Railway and Vercel — infrastructure hosting (US data centers).
• TheOddsAPI — sports betting market data (we send no personal info to them).

Your email and account ID power: signing you in, sending pick emails you've opted into, billing receipts, and transactional account messages (e.g., trial-ending reminders). We do not send marketing email without your consent.

Usage data powers your tracker dashboard and your line-move monitor alerts. We may use aggregated, anonymized usage stats to improve the model, never tied to identifiable users.

• We don't sell your data to anyone.
• We don't share your email with advertisers.
• We don't use third-party tracking pixels or session replay.
• We don't fingerprint your device across sites.

You can request a copy of all data we hold about you, request that we delete it, or close your account entirely by emailing support@tiltdatalabs.com. We respond within 14 days.

If you're in California, the EU, or another jurisdiction with specific privacy rights (CCPA, GDPR, etc.), the same email kicks off the formal request process.

Active accounts: indefinitely while the account exists. After you delete your account: 30 days for backups to age out, then full deletion. Billing records are retained for 7 years to satisfy tax and accounting law.

All data is transmitted over TLS. Database connections are private to Railway's internal network. Secrets are stored as environment variables, never in source code. We do not store payment card data — Stripe does.

Material changes will be emailed to active accounts at least 14 days in advance.