Privacy Policy

Last updated 2026-09-25

This policy explains what personal data StatLocus collects and how it is used. Ruwindhu Hettige Don is the data controller.

What we collect

• Account data: your email address, and your Google account ID if you sign in with Google.
• Your follows: the teams and drivers you follow, which we use to build your feed.
• Billing data (Pro only): your Stripe customer and subscription IDs, plan, renewal date and payment status. Stripe collects your card details, billing address and any tax details directly; we never see or store your full card number.
• Sign-in and activity records: one-time sign-in link records, the time you last signed in, and the time you last used the site (at most hourly), which we use to count weekly active members.
• Pick'em: your picks, how they were scored, and the display name you choose. Your display name and record appear on public leaderboards and on result images you choose to share.
• Referrals: who referred you (if you signed up through a referral link), who you referred, and the rewards given.
• Weekly digest: whether you get it, when a free member opted in, and for each digest whether it was opened (a small image in the email) and whether a link in it was clicked (links pass briefly through our site). We use this only to measure and improve the digest.
• Partner link clicks: when you follow an affiliate link we record which partner, which page type and sport, and a country guess from your browser's language. We don't record who clicked.
• Technical data: IP address and request logs, kept briefly for security and rate limiting.
• Usage statistics: aggregate page-view counts from a privacy-friendly analytics tool that does not use cookies or build profiles of individuals.

We don't sell your data. We don't share your account details, follows or email with advertisers.

Why we use it (legal bases)

• To provide your account and personalized feed (performance of our contract with you).
• To keep the Service secure and prevent abuse (our legitimate interests).
• To send you sign-in emails you request, and the weekly digest if you're a Pro member (performance of contract; you can switch the digest off at any time).
• To send the free weekly digest, which may include a clearly labelled sponsor message (your consent, given by ticking the opt-in box; you can withdraw it with the unsubscribe link or on your Account page). Sponsors never receive your email address or any other personal data.
• To run pick'em leaderboards, referral rewards and open/click counts for the digest (our legitimate interests in running and improving the Service).
• To take payment for Pro and keep tax and accounting records (performance of contract and legal obligation).

Cookies and advertising

We set strictly necessary cookies only: a session cookie that keeps you signed in and a security token that protects forms.

On the free plan, pages can show ads from Google AdSense, which uses cookies and similar technologies to deliver, measure and (with your permission) personalize ads. In the UK, the EEA and Switzerland we use Google's certified consent tool to ask for your choice first. No ad is requested until you've made that choice, and you can change it at any time with the "Privacy choices" link at the bottom of every page. If you don't consent, Google may still show non-personalized ads that don't use cookies for advertising. Pro members see no ads, and no ad or consent code is loaded for them. See how Google uses data from sites that use its services.

Who processes data for us

• Render (hosting, database and cache)
• Cloudflare (storing and serving share images, which contain no personal data beyond a display name you chose to share)
• Stripe (payments, tax calculation and invoices for Pro)
• Resend (sending sign-in emails and the weekly digest)
• Google (only if you choose Google sign-in; and, on the free plan, AdSense ads and the consent tool, as described above)
• Anthropic (generates previews and recaps from match data; no personal data is sent)
• Sentry (error reports, configured not to send personal data)
• Our analytics provider (aggregate, cookieless statistics)

Some of these providers are based in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses.

How long we keep it

Account data is kept until you delete your account. Deleting your account removes your email, follows and sign-in records immediately, and cancels any Pro subscription. Payment and invoice records are kept by Stripe, and by us where needed, for as long as tax and accounting law requires. Server logs are kept for up to 30 days.

Your rights

Depending on where you live (including under the UK and EU GDPR), you can ask to access, correct, export or delete your data, object to processing, or complain to your data protection authority. You can delete your account yourself from the Account page, or email us for anything else.

Questions? Email support@enterhlytics.ca.