Privacy Policy

This policy explains how PropsIQ ("PropsIQ", "we", "us") handles information on the website at propsiq.app (the "Site"). The PropsIQ iOS app is covered separately — see §11.

Who is responsible for your data

PropsIQ is operated by Lucas Azzopardi, an individual sole proprietor in Ontario, Canada — the data controller for everything described below, reachable at azzopalj@gmail.com. Canadian federal privacy law (PIPEDA) applies to this Site.

1. Your account

When you create an account we store:

• The version of the Terms you agreed to, and when — the tick on the sign-up form. We keep it for as long as the account exists because it is the record of what you agreed to, and a record you can delete is not one.
• Your email address, and a cryptographic hash of your password. We never store the password itself and cannot recover it — a reset link is the only route back in.
• An Apple identifier, if you use Sign in with Apple. If you choose Hide My Email, we receive Apple's relay address rather than your real one.
• A billing email, if you subscribe on the web. This is kept separately from your sign-in email because an Apple relay address stops forwarding the moment you revoke it, and a receipt or a failed-payment notice then has nowhere to go.

Authentication is provided by Supabase, which hosts our database and processes this data on our behalf.

2. Subscriptions and payment

We never receive your card number. Web payments go to Stripe, which returns only a customer reference, the plan, the status and the renewal date. App Store purchases are handled by Apple and we receive only the resulting entitlement.

We store that reference and status so the Site knows whether your subscription is active. Stripe and Apple each process your payment details under their own policies.

3. Sign-in records

For each active session we record the IP address and browser user-agent it was created from, plus when it started and when it was last used. This is what populates the "Where you're signed in" list on your account page, so you can recognise a session you do not recognise and end it.

It is security information, not analytics: we do not profile you with it, and it is not shared. Signing out of a device removes its entry, and Sign out everywhere removes all of them.

4. What you create

The bets you track and the models you build start in your browser's local storage. When you are signed in they are also synced to our database so they follow you across devices and to the iOS app.

These are yours. We do not publish them, sell them, or use them to train anything. We do not know whether a bet you recorded is real — nothing here is connected to a sportsbook.

5. Cookies

The Site sets four cookies, all strictly necessary and none used for advertising:

• psq-access and psq-refresh — your session. Both are httpOnly, so page scripts cannot read them.
• psq-expires — when the session needs renewing, so a page can refresh it before it lapses.
• psq-uid — which account this browser belongs to, so that locally stored bets from one account are never shown to another on a shared computer.

There are no advertising or tracking cookies, and our page-view counter sets none either, which is why the Site shows no cookie banner.

5.1 Page-view measurement

We count page views with Vercel Web Analytics, which runs on the same infrastructure that serves the Site. It records the page you viewed, the referrer, and coarse device and country information. It sets no cookie, stores nothing on your device, and assigns you no identifier that persists past the day or follows you to any other site. We use it to see which pages are used, not to build a profile of you, and it is never joined to your account.

6. Sports data

Schedules, rosters, statistics, odds and weather are fetched by our servers from third-party sports-data sources and from MLB's public statistics API. Those requests are made by us, not by your browser, and carry nothing about you.

7. What we do not do

• We do not sell or rent personal information.
• We do not run advertising SDKs, we do not use analytics that identify you across sites or sessions, and we do not build advertising profiles.
• We do not share your bets, models or account with anyone.

8. Retention and deletion

We keep your account data while your account exists. Deleting your account from your account page removes your profile, subscription records, sign-in history, synced bets and synced models, and cancels any web subscription in the same step.

Two things survive, and both for reasons outside our control: Stripe retains payment records it is legally required to keep, and data already synced to the iOS app remains on that device until you delete the app.

9. Your rights

Depending on where you live you may have the right to access, correct, export or erase your personal data, and to object to its processing. Deleting your account does most of this immediately; for anything else, email azzopalj@gmail.com and we will respond within 30 days.

Our servers and database are hosted in the United States. If you use the Site from elsewhere, your data is processed there.

10. Security

All traffic is encrypted with HTTPS. Session cookies are httpOnly, Secure and same-site, and every access token is signature-verified on every request rather than trusted because it arrived. Database access is enforced by row-level security, so one account cannot read another's rows even if the application had a bug.

No system is perfectly secure. If you believe your account has been accessed without your permission, change your password, use Sign out everywhere, and tell us.

11. The iOS app

The PropsIQ iOS app can be used without an account, and in that mode it stores your favourites, bets and settings only on your device. Its own privacy policy, linked from its App Store listing, covers that use. If you sign in to an account inside the app, the account sections of this policy apply to that data too.

12. Children

PropsIQ is for adults and is not directed to children. We do not knowingly collect information from anyone under 18.

13. Changes

We may update this policy. Material changes will be reflected in the "Last updated" date above, and where a change affects how we handle data you have already given us, we will tell you.

14. Contact

Questions about this policy? Email azzopalj@gmail.com. See also our Terms of Service.