Privacy Policy

Account data: Email address, display name, username, and authentication tokens when you sign up.

Usage & device data: Pages visited, features used, scan frequency, and bet-logging activity, along with your IP address, browser and device type, and approximate location (city/state, derived from your IP) — used to operate and improve the Service, personalize state-specific content, and detect fraud. Loading third-party images (team logos, player photos, country flags) also causes your browser to contact those providers, which may receive your IP address and referrer.

Payment data: Processed securely by Stripe. We do not store credit card numbers on our servers.

Analytics & session replay: We use PostHog and Vercel Analytics for usage metrics. In production, and only with your consent (and unless your browser sends a Do Not Track or Global Privacy Control signal), PostHog also records a playback of your interactions — clicks, navigation, and mouse movement — to help us debug and improve the product. Form inputs are masked by default and are not captured, and you can opt out from the cookie consent banner at any time. No personal data is shared with advertisers.

• Provide and operate the Service
• Process payments and manage subscriptions
• Send transactional emails (payment confirmations, alerts)
• If you opt in to the daily free pick or other optional emails, we use your email address (and the state you select) to send them — every one has an unsubscribe link
• Improve performance, features, and user experience
• Detect and prevent fraud or abuse

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share data only with service providers — under contracts that limit their use to providing the Service — that are necessary to operate Whet:

• Supabase — Database and authentication
• Stripe — Payment processing
• Resend — Transactional emails
• Sentry — Error tracking
• PostHog — Product analytics and consent-gated session replay
• Vercel — Hosting and analytics
• Railway — Backend hosting (our scanning and API infrastructure)

We use essential cookies for authentication and session management. We use analytics cookies (PostHog, Vercel) to understand usage patterns. When you first visit, a cookie consent banner lets you accept or decline non-essential cookies; you can also disable them in your browser settings at any time.

• Account data is retained while your account is active
• Deleted accounts enter a 7-day grace period, then are permanently removed
• Scan results are retained for 30 days
• Odds snapshots are retained for 7 days
• Usage metrics are retained for 6 months
• Bet history and analytics are retained while your account is active

We implement industry-standard security measures including encrypted connections (TLS), row-level security policies, JWT authentication, rate limiting, and regular security audits. However, no system is 100% secure and we cannot guarantee absolute security.

You have the right to:

• Access your personal data via the Settings page
• Export your data at any time from Settings
• Delete your account and all associated data from Settings
• Update your information at any time

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request its deletion, and to opt out of the sale or sharing of your personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising these rights. We honor Global Privacy Control (GPC) browser signals where required by law.

EEA/UK residents (GDPR): you also have the right to rectification, to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority. Our legal basis for processing is your consent and the performance of our contract with you.

To exercise any of these rights, use the Settings page or email privacy@whet.gg.

We do not knowingly collect personal information from anyone under 13, consistent with the Children's Online Privacy Protection Act (COPPA); if we learn we have, we will delete it promptly. Separately, Whet is intended only for adults 21 and over (or 18 where sports betting is legal at 18 in your jurisdiction), and people under that age should not use the Service.

We may update this policy as needed. We will notify you of material changes via email. Continued use after changes constitutes acceptance.

Privacy questions? Contact us at privacy@whet.gg.