Privacy Policy

What we collect

We collect the minimum needed to run an account and a subscription.

• Your email address, and a password stored only as a salted hash — we cannot read your password.
• Your subscription status and the Stripe identifiers needed to reconcile it.
• Ordinary server logs, including IP address and request details, kept for security and debugging.

What we do not collect

We do not sell personal data. We share limited data with the advertising platforms named under “Advertising measurement”, as described there.

• Card numbers. Payment details are entered with Stripe; they do not reach this application and we cannot see them.
• Special-category personal data. Please do not send it to us.

Cookies

We use a session cookie to keep you logged in and a token to protect forms against cross-site request forgery. The session cookie is HttpOnly and SameSite=Lax, is sent only over HTTPS in production, and expires after twelve hours.

Google Analytics sets two first-party cookies: _ga, which distinguishes one browser from another, and _ga_<ID>, which keeps the current visit's state. Both last up to two years unless you clear them.

The advertising platforms named under “Advertising measurement” may set their own cookies.

Product events stay in your browser

The site records a small set of interaction events — which product you opened, which sport you chose — to understand how the product is used. That script dispatches an event inside your own browser and sends nothing itself: no network request, no cookie, no local storage. Page views are counted separately by Google Analytics, below. Signing up, starting a checkout and completing a purchase are also passed to Google Tag Manager, below. PostHog, below, separately records how pages are used.

Google Analytics

We use Google Analytics 4 to count visits and to see which pages and which links bring people to the site. On each page load your browser sends Google a page-view event containing the page address (including any ?ref= or utm_ tags on the link you followed), the referring page, your browser and device type, screen size, language and an approximate location that Google derives from your IP address. Google does not log or store your IP address in Google Analytics 4.

Google signals and ad personalization are turned off: we do not use Analytics for advertising, remarketing or cross-device tracking, and we do not send Google your name, email address or account details.

Analytics data is kept in our Google Analytics account for the retention period set there and then deleted. Google processes it on our behalf as a service provider under its Google Analytics terms.

Opting out of analytics

You can block Google Analytics on any site with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout), by blocking cookies from this site, or with a content blocker. The site works the same without it.

Google Tag Manager

Public pages, and the pages you see after signing up or paying, also load Google Tag Manager, a Google service that delivers measurement tags to the page. Loading it sends Google your IP address and browser details. It never loads on the sign-in, sign-up, password or email-verification pages.

Advertising measurement

We measure our advertising with tags from Meta (Facebook and Instagram), TikTok, X (Twitter) and Reddit, which our marketing agency runs through Google Tag Manager. These platforms receive the address of the page you are viewing, your browser and device details and your IP address, and they may set their own cookies.

They are also told when you create an account, start a checkout or complete a purchase, with the plan and price for a checkout or purchase. For a new account or a purchase, they also receive a SHA-256 hash of your email address, never the address itself, and our internal account number once your account exists, so they can match the event to an account you hold with them. Each platform uses this under its own privacy policy, including to measure and target advertising.

You can limit this in each platform's ad settings, by blocking third-party cookies, or with a content blocker. The site works the same without these tags.

Product analytics and session recordings

We use PostHog to see how the site is used: which pages people view, what they click, and recordings of how a page is used, such as scrolling, mouse movement and clicks. Anything typed into a form is masked in recordings. It is also told when a visit leads to a sign-up, a checkout or a purchase, with the plan and price, and about errors a page runs into. PostHog does not load on the sign-in, sign-up, password or email-verification pages, and does not record your account pages.

PostHog keeps a random identifier in a first-party cookie and in your browser's local storage to recognise repeat visits. We do not send it your name, email address or account details. PostHog processes this data on our behalf in the United States, and you can block it with a content blocker; the site works the same without it.

Email we send

Account email: the messages your account needs, such as verifying your address and resetting your password. We send these with Resend. They are part of running your account, so they continue while it is open.

Product updates and offers: only if you opt in. We send these with Customer.io, which receives your email address and the details needed to send and measure them, such as whether a message was delivered, opened or clicked. Every one has an unsubscribe link; unsubscribing stops them and does not affect your account, your subscription or your account email. You can also write to support@karmaedge.ai.

Who we share data with

We use a small number of processors to operate and market the service, and only for those purposes.

• Stripe — subscription payments and billing.
• Resend — account email such as address verification and password resets.
• Customer.io — product updates and offers, only for people who opt in.
• Railway — application hosting and the database.
• Google — website analytics (Google Analytics 4) and Google Tag Manager, as described above.
• Meta (Facebook and Instagram), TikTok, X (Twitter) and Reddit — advertising measurement, as described above.
• PostHog — product analytics and session recordings, as described above.
• Licensed sports data providers — these receive our requests for sports data and never receive your personal information.

How long we keep it

Account data is kept while your account is open and for a reasonable period afterwards to handle billing, disputes and legal obligations. Server logs are kept for a short operational period. Ask us and we will tell you what we hold about you.

Your choices

Write to support@karmaedge.ai to see, correct, export or delete your personal data, or to close your account. Depending on where you live you may have additional rights, including the right to object to processing or to complain to a regulator. We will not treat you differently for exercising them.

Children

This service is not for anyone under 18. We do not knowingly collect data from children, and will delete it if we learn we have.

Changes

If we change how we handle personal data we will update this page and change the date shown above. Questions: support@karmaedge.ai.