Privacy Policy

This policy explains what personal information Spitfire Labs LLC ("we", "us") collects through advancedfootballstats.com, how we use it, and the choices you have. Questions or requests go to admin@advancedfootballstats.com.

What we collect

Information you give us

• Account: your email address and password, and, if you choose, your first and last name. We store the password only as a one-way bcrypt hash; we can't read it. We also record when your account was created and last changed, which versions of our Terms and Privacy Policy you accepted and when (with your browser's user-agent string), and when you confirmed you are 21 or older if you use betting-related features.
• Waitlist: your email address and which signup form you used. We also receive an email notification of each signup.
• Payments: when paid plans launch, Stripe will collect your card and billing details. We will receive your subscription status, plan, billing email and payment history, and never your full card number.
• Messages: whatever you include when you email us.

We don't collect sensitive personal information such as government ID numbers, financial account numbers, precise location, health information or biometric data.

Information collected automatically

• Our own cookies: auth-session keeps you signed in for up to 30 days; it is signed and can't be read by scripts on the page. reset-token lasts one hour during a password reset. afs-privacy-optout remembers an opt-out you make on Your Privacy Choices.
• Analytics: we use Google Analytics to understand how the Site is used: pages viewed, the device and browser you use, your approximate location (country or city level), how you arrived, which features you use and whether you are signed in. We don't send your name or email address to Google. Google sets its own cookies (_ga, _ga_*, up to 2 years) and keeps Analytics data for 14 months.
• Advertising: we show ads through Google AdSense to visitors who are not signed in. Google and other third-party vendors use cookies to serve ads based on your prior visits to this and other websites (see "Cookies and ad choices"). We don't load the ad code at all on the login, signup and password pages, or for signed-in members.
• IP address and server logs: we use your IP address briefly, in memory, to limit repeated login and signup attempts. We don't store it in our database or our request logs. Our hosting provider handles IP addresses to deliver traffic to the Site, and Google receives your IP address when its Analytics and ad scripts load.

Third parties, including Google, may collect information about your online activities over time and across different websites when you use this Site.

How we use it

• to run your account and the Site, and keep both secure;
• to send emails you need, such as password reset links and notices that your password changed;
• to contact you about the product you joined the waitlist for;
• to process payments and manage subscriptions, once paid plans launch;
• to understand and improve how the Site is used;
• to show ads that pay for the free parts of the Site;
• to meet legal obligations and enforce our Terms of Service.

We don't send marketing email unless you have asked for it, and you can unsubscribe at any time.

Who we share it with

We share personal information with services that help us run the Site, for that purpose:

• Fly.io hosts the Site (United States).
• Crunchy Data hosts our database (United States).
• Resend sends our emails.
• Google Workspace hosts our email inbox, which receives the emails you send us and waitlist signup notifications.
• Google provides Analytics and AdSense.
• Stripe will process payments when paid plans launch.

We may also disclose information if the law requires it, to protect the rights or safety of our users or others, or as part of a sale or transfer of the business, in which case this policy continues to apply.

Sale and sharing. We don't sell your personal information for money. However, when we show personalized ads to visitors who are not signed in, Google and other ad vendors receive identifiers (such as cookie IDs and your IP address) and information about your activity on the Site. Some U.S. state privacy laws treat this as a "sale" of personal information or "sharing" it for targeted advertising. You can opt out at any time on Your Privacy Choices, and we treat a Global Privacy Control signal as an opt-out. We don't knowingly sell or share the personal information of anyone under 18.

Cookies and ad choices

Advertising cookies. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this Site and/or other sites on the Internet. Other Google-certified ad networks may also place cookies to serve ads; you can see them on Google's list of ad technology providers. Google explains how it uses data from sites like ours here.

Your options. Opt out of the sale or sharing of your information for targeted ads on Your Privacy Choices. Opt out of personalized advertising across sites at Google Ad Settings or aboutads.info (and youronlinechoices.eu in Europe). Opt out of Google Analytics with Google's browser add-on. You can also block or delete cookies in your browser; the Site works without them, except that you need the sign-in cookie to stay logged in.

Do Not Track and Global Privacy Control

There is no common industry standard for "Do Not Track" browser signals, and the Site does not respond to them. We do honor Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising, and we tell Google to show only non-personalized ads to that browser.

How long we keep it

• Account information: while your account is open; deleted within 30 days after you ask us to close it.
• Waitlist emails: until we have contacted you about the product you signed up for, and no more than 24 months after signup, or sooner if you ask.
• Emails you send us and waitlist notifications in our inbox: up to 3 years, then deleted.
• Password reset links: they expire after one hour.
• Server request logs (which contain no IP addresses): kept by our hosting provider for a short rolling period.
• Database backups: kept by our database host for a limited rolling period, then overwritten.
• Google Analytics data: 14 months.
• Payment records: 7 years, for tax and accounting.
• Records of your agreement to our terms and, for paid plans, your checkout consent and any payment disputes: for as long as your account exists and at least 3 years after, even if you delete your account, so we can show what you agreed to.

Your choices and rights

You can ask us to (1) tell you what personal information we hold about you and give you a copy, (2) correct it, (3) delete it, including your account, and (4) opt out of the sale or sharing of your information and of targeted advertising (see Your Privacy Choices). Email admin@advancedfootballstats.com from the address on your account. We may ask you to confirm that you control that email address. We answer within 30 days, and we will tell you if we need up to 45 more days. You can use an authorized agent if you give them signed permission. We won't treat you differently for using these rights. If we decline your request, you can appeal by replying "Appeal" to our decision, and we will answer within 45 days. We honor these requests wherever you live.

What deletion covers. We delete your account record and waitlist entry from our database and the related notifications in our inbox. Copies in database backups are overwritten on our host's rolling schedule. Information Google collected through Analytics and AdSense is controlled by Google; you can delete or limit it through the links in "Cookies and ad choices".

Security

The Site is served only over HTTPS, passwords are stored as bcrypt hashes, and sessions can be revoked by changing your password. No system is perfectly secure, so we can't guarantee absolute security. If a security incident affects your personal information, we will notify you and any regulators as the law requires.

Children

The Site is for adults. Accounts are only for people 18 or older, the Site is not directed at children, and we don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact us and we will delete it.

Visitors in the EEA, UK and Switzerland

Spitfire Labs LLC is the controller of your personal data. We rely on your consent for analytics and advertising cookies; we ask for it before those cookies are set, and you can withdraw it at any time with "Change cookie consent" on Your Privacy Choices. We rely on performance of our contract with you to run your account and any paid plan, and on our legitimate interests to keep the Site secure, for example by limiting repeated login attempts. Your data is processed in the United States; our providers that receive it rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or on the European Commission's Standard Contractual Clauses. You have the rights to access, rectify, erase, restrict, object to processing of and port your data, and to complain to your local data protection authority.

Where your data is processed

Advanced Football Stats is run from the United States, and your information is processed there.

Changes

We will update the date at the top of this page when this policy changes, and email account holders about material changes before they take effect.