Privacy Policy

Last updated 2026-10-03

What we collect

• Your email address, because an account needs an identity and a way to recover access.
• A hash of your password. The password itself is never stored and cannot be recovered from the hash — that is why a reset replaces it rather than reminding you of it.
• Account timestamps: when the account was created, when it last signed in, and whether the email has been verified.
• Research you save, so it is there when you come back.
• Short-lived sign-in codes, stored hashed and single-use, for email verification and password resets.
• An alert token, only if you turn on alerts in the iPhone app. Apple issues it so we can tell that phone when a prop you saved moves. It identifies nothing else about you or the phone, and it is deleted when you delete the app or Apple reports it expired.

We do not ask for, and have no use for, your name, address, date of birth or any gambling account.

Payments

If you subscribe to Pro, the payment is taken by Stripe on its own pages, under its own privacy policy. Your card number never reaches us. We keep only what we need to know you have paid: your plan, the processor’s subscription reference, and when the current period ends.

Cookies

One cookie, sp_account. It holds a signed session token, is marked HttpOnly so page scripts cannot read it, SameSite=Lax so it is not sent from other sites, and Secure in production. It is strictly necessary to keep you signed in; there are no advertising or analytics cookies to consent to. Signing out clears it.

Where the sports data comes from

Lines, odds and game logs are fetched by our servers from publicly available sources, including sportsbooks, daily fantasy operators and league statistics providers. Your browser never contacts them, and we never send them anything about you — the request comes from us, and it contains no information identifying any user.

How we use what we hold

Only to run the service: to sign you in, keep your saved research, keep your subscription in step with your payments, protect accounts from abuse, and reply when you contact us. We do not sell personal data, we do not share it with advertisers, and we do not build a profile of you for marketing.

How long we keep it

Your account details stay for as long as the account exists. Ask us to delete your account and we remove the account record and its saved research. Sign-in codes expire in minutes and are discarded once used.

Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. If you are in the UK, EU, or a US state with a privacy statute such as California, those rights are yours by law and we honour them regardless of where you are. Email [email protected] and we will act on it.

Security

Passwords are stored only as hashes. Sessions are signed and expire. Sign-in attempts are rate-limited and repeated failures lock an account temporarily. Traffic is served over HTTPS only. No system is perfect, so use a password you do not reuse elsewhere.

Children

The service is not for anyone under 18, and we do not knowingly collect anything from them. If you believe a minor has created an account, tell us and we will remove it.

Changes

If this policy changes, the date at the top changes with it. A change that materially affects what we collect or why will be announced to account holders.

Contact

ObligeProps — [email protected].