Privacy Policy

Last updated 13 August 2026

1. What we collect

• Your email address, when you join the waitlist or subscribe. It is how we identify your account and how we reach you.
• Session data. When you sign in we store a one-way hash of your session identifier, the expiry, and the browser's user-agent string. We do not store the identifier itself, so a copy of our database cannot be used to sign in as you.
• Subscription status — which plan you are on and when it started and ends.
• Preferences you set, such as your sportsbook and your state. Your sportsbook and state are stored on your device and are sent to us only if you are signed in and we need them to build a bet-slip link.
• Chat messages, if you use the assistant, so the conversation has memory and so we can enforce usage limits.

2. What we do not collect

• Card numbers. Payments go through Stripe. Your card details go to Stripe, never to us — we receive only a customer reference and whether the payment succeeded.
• Your bets. Certy is not a sportsbook. We do not know what you wagered, how much, or whether it won. Tapping a bet-slip link hands you to the book; what happens there is between you and them.
• Advertising or cross-site trackers. There are none in the app. We do not build an advertising profile of you and we do not sell or rent your data to anybody.
• Precise location. We never ask for it. If you tell us your state, it is because you chose it from a list.

3. Why we collect it

To sign you in, to know whether you are entitled to the paid board, to take payment, to send you the emails you asked for, and to stop abuse. That is the whole list. We do not use your data to train anything or to profile you.

4. Who else sees it

Only the services that make Certy work:

• Stripe — payments and subscription state.
• Supabase — our database, where accounts and the public record live.
• Cloudflare — hosting and delivery.
• Anthropic — if you use the chat assistant, your message is sent to the model to answer it.

Each holds data only to provide their service to us. We will disclose data if the law actually requires it, and we will tell you unless we are forbidden to.

5. Cookies

One cookie, certy_sess, which keeps you signed in. It is HttpOnly, Secure and SameSite=Lax — script cannot read it and it does not ride along on other sites' requests. There are no analytics or advertising cookies. Signing out clears it.

6. How long we keep it

• Sessions expire after 60 days, or immediately when you sign out.
• Sign-in codes expire within hours and are single-use.
• Account and subscription records are kept while your account exists, and afterwards only as long as tax and accounting rules require.
• The public record of our own picks is permanent by design — but it is about our calls, and contains nothing about you.

7. Your choices

• See it, correct it, or delete it. Email us and we will.
• Delete your account and we remove your email, sessions, preferences and chat history. Payment records we are legally required to keep, we keep.
• Stop the emails — reply to any of them, or ask us.
• If you are in California, the EU or the UK, you have additional rights over access, portability, correction and erasure. Ask and we will honour them; we do not sell personal information, so there is nothing to opt out of.

8. Security

Secrets live server-side and are never shipped to the browser. Sign-in tokens and session identifiers are stored only as one-way hashes. Database access is deny-by-default: the public key can read the published record and add a waitlist signup, and nothing else. No system is perfect, and if we ever have a breach affecting you we will tell you promptly and plainly.

9. Children

Certy is 21+. We do not knowingly collect data from anyone under 21, and we delete it if we discover we have.

10. Changes

If we change how we use your data in a way that matters, we will tell you before it takes effect rather than quietly updating this page.

11. Contact

Sacred Studios LLC — [email protected]