Privacy Policy

1. Overview

Calico Sports Picks (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your personal data.

2. Information We Collect

Information You Provide

• Account information: First name, last name, email address, password (stored as a secure hash — never in plain text)
• Phone number: Optional, provided only if you opt into SMS pick alerts
• Payment information: Handled entirely by Stripe and/or PayPal. We do not receive or store your full card number, CVV, or bank account details. We receive only a customer identifier and the last four digits of your card for display purposes.
• Communication preferences: Your chosen delivery methods (dashboard, email, SMS)
• Messages you send us: Any communications via our contact form or email

Information Collected Automatically

• Log data: IP address, browser type, pages visited, timestamps — standard web server logs
• Device information: Device type and operating system (for technical support purposes only)
• Cookies: See Section 10

3. How We Use Your Information

We use your information solely to:

• Provide and operate the Calico Sports Picks service
• Deliver picks via your chosen method (dashboard, email, SMS)
• Process payments and manage your subscription
• Issue refunds under the Guarantee Plan
• Send service-related communications (pick alerts, result notifications, billing receipts)
• Respond to your support requests
• Detect and prevent fraud or unauthorized access
• Comply with legal obligations

We do not use your information for advertising profiling, behavioral tracking, or any purpose beyond operating this service.

4. Information Sharing

We do not sell, rent, or trade your personal information to any third party.

We share your information only with the following service providers, strictly as necessary to operate our service:

• Stripe / PayPal — Payment processing. Subject to their own privacy policies.
• SendGrid — Email delivery service. Receives your email address to send pick notifications and receipts.
• Twilio — SMS delivery service. Receives your phone number (if SMS delivery is enabled) to send text alerts.
• Supabase — Database hosting. Your account data is stored on their infrastructure.

All service providers are contractually prohibited from using your data for any purpose other than providing services to us.

We may disclose your information if required to do so by law, court order, or government authority.

5. Payment Information

All payment processing is handled by Stripe and/or PayPal. These are industry-standard PCI-DSS compliant payment processors. Your full card number, expiry, and CVV are transmitted directly to Stripe/PayPal and never pass through or touch our servers.

We store only: your Stripe customer ID, the last four digits of your card (for display in your account), and your subscription status. This is the minimum needed to manage your account and issue refunds.

6. Communications

Service Communications

We send the following service communications which you cannot opt out of while your account is active: billing receipts, pick delivery (via your chosen method), and important account/policy notices.

Pick Alerts & Notifications

Pick alerts are the core service. You can manage your delivery preferences (email, SMS, dashboard) at any time through your account settings.

Unsubscribing

You can unsubscribe from email communications at any time using the unsubscribe link in any email we send. You can disable SMS alerts at any time through your account settings or by replying STOP to any text message.

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your subscription and request account deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes (such as transaction records, which we retain for 7 years as required by tax law).

8. Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Passwords stored as secure bcrypt hashes — never in plain text
• Database access restricted to the application server only
• Admin panel protected by separate credentials and session management
• Failed login attempt monitoring and lockout

No system is perfectly secure. In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of it.

9. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data through your account settings or by contacting us
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a machine-readable format
• Opt-out: Opt out of non-essential communications at any time

To exercise any of these rights, contact us at the address in Section 13.

10. Cookies

We use only essential cookies and session storage required to operate the service:

• Session authentication: A session token stored in your browser’s sessionStorage to keep you logged in during your visit. This is cleared automatically when you close your browser.
• Preferences: Minimal local storage to remember your display preferences.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not serve ads.

11. Children

Our service is intended for adults aged 21 and over. We do not knowingly collect personal information from anyone under the age of 21. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active subscribers of material changes by email at least 7 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact

For privacy-related questions, data requests, or to exercise your rights:

We will respond to all privacy requests within 30 days.