Winapoolooza Privacy Policy

Last Updated: July 27, 2026 Effective Date: July 27, 2026 Version: 1.2

1. Introduction

Winapoolooza LLC ("Winapoolooza," "we," "us," "our") operates the Winapoolooza websites (winapoolooza.com and winapoolooza.app), mobile applications, and related services (collectively, the "Service").

This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It applies to all users of the Service. The Service is intended for users aged 16 and older (see Section 13). For privacy questions and requests, contact us at privacy@winapoolooza.com.

We do not sell your personal information. If we introduce advertising that involves sharing personal information for cross-context behavioral (targeted) advertising, we will update this Policy first and provide the opt-out rights described in Section 11 before doing so.

2. Scope and Roles

This Policy covers personal information we process as the operator of the Service.

Commissioners. Pool Commissioners can see certain information about their pool's participants (such as display names, picks, and standings) in order to run their pools. A Commissioner's own use of participant information outside the Service is the Commissioner's responsibility, as described in our Terms of Service.

3. Information We Collect

3.1 Information you provide

Category	Examples
Account information	Email address, name, and authentication identifiers, collected through our identity provider when you register or sign in.
Profile information	Display name, profile picture, banner image, bio, favorite teams, friend code, and cosmetic selections.
Pool activity	Pools you create or join, your picks and predictions, standings, achievements, Flex Score, and virtual item balances.
Communications and content	Messages you post in pool chat, commissioner announcements, pool names and descriptions, invitations you send, and messages you send to our support team.
Payment information	If you subscribe or make a purchase, our payment processor (or the app store) collects your payment details. We do not receive or store your full payment card number. We receive limited information such as subscription status, transaction identifiers, and the card's brand and last four digits.
Contact preferences	Your email address and notification preferences.

3.2 Information collected automatically

Usage data: pages and features accessed, actions taken, and timestamps.
Device and log data: IP address, browser type, operating system, device identifiers, and error/diagnostic logs.
Cookies and similar technologies: see Section 9.

3.3 Information from third parties

Identity provider: authentication and basic account details when you sign in.
Payment processor / app stores: subscription and transaction status.
Sports data providers: schedules, scores, rankings, and point spreads. This is not personal information about you, and we do not send your personal information to sports data providers.

3.4 Information we do not intentionally collect

We do not intentionally collect government identifiers, financial account numbers, precise geolocation, biometric data, health information, or other special categories of sensitive personal information. Please do not post sensitive personal information in profiles, pool names, or chat.

3.5 Categories under U.S. state privacy laws

For purposes of U.S. state privacy laws, the information above falls into these categories, which we collect from you directly, from your devices automatically, and from the service providers listed in Section 5.2, and which we disclose only as described in Section 5:

Legal category	What it includes here	Disclosed to
Identifiers	Email address, name, display name, IP address, account and device identifiers	Service providers (Section 5.2)
Commercial information	Subscription tier, purchases, transaction history	Payment processor / app stores; service providers
Internet or network activity	Usage, device, and log data; cookies	Service providers
Audio/visual information	Profile pictures and banners you upload	Service providers; other users (by design, Section 5.1)
Inferences	Standings, achievements, Flex Score derived from your pool activity	Other users (by design, Section 5.1); service providers

We collect and disclose these categories for the business purposes described in Section 4. We do not sell them, and we retain them as described in Section 8.

4. How We Use Information

We use personal information to:

Provide the Service: create and authenticate your account; create, join, run, and score pools; display standings, achievements, and profiles; enable invitations and in-pool messaging.
Process payments: manage Commissioner subscriptions, purchases, billing, and entitlements.
Communicate with you: send transactional and Service messages (for example, pool invitations, pick deadlines and reminders, results and standings updates, account and security notices, and billing notices) by in-app notification and email.
Provide support: respond to your questions and requests.
Protect safety, security, and integrity: authenticate users, enforce our Terms, detect and prevent fraud, abuse, cheating, spam, and unauthorized access, and moderate content (including filtering objectionable content and acting on user reports).
Improve the Service: understand usage, diagnose problems, and develop features.
Comply with law: meet legal obligations and establish, exercise, or defend legal claims.

5. How We Share Information

We share personal information only as described in this Section. We do not sell it.

5.1 With other users (by design)

The Service is social. The following is visible to other users:

Your display name, profile picture, banner, bio, favorite teams, achievements, Flex Score, and cosmetic items, visible on your profile and in pools you join.
Your picks, standings, and results: visible to members of a pool you join. (Picks may be hidden until they lock, depending on the pool format.)
Messages you post in pool chat and announcements, visible to members of that pool.
Your friend code, if you choose to share it.

Your email address is never displayed to other users.

5.2 With service providers

We use third-party providers to operate the Service. They may process personal information only on our instructions and for the purposes we specify. Our current providers are:

Provider	Role
Clerk	Account creation, sign-in, and identity management
Supabase	Database, backend, and file storage for account, pool, pick, and content data
Stripe	Subscription billing and payment processing (web)
SendGrid	Transactional and notification email delivery
Railway	Application hosting
Cloudflare	Content delivery, performance, and abuse protection

In-app purchases are processed by the Apple App Store or Google Play, as applicable. We may update this list as our providers change; the then-current list will be reflected in this Policy.

5.3 Advertising

Playing in pools is free, and the free experience may be supported by advertising in the future. As of the Effective Date, we do not share personal information with advertisers or ad networks for cross-context behavioral (targeted) advertising. If that changes, we will update this Policy first, describe the categories shared and the partners involved, and provide the opt-out mechanisms described in Section 11 (including honoring opt-out preference signals) before any such sharing begins.

5.4 Legal and safety

We may disclose information if we believe in good faith it is necessary to: comply with law, legal process, or a governmental request; enforce our Terms; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Winapoolooza, our users, or the public.

5.5 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your personal information.

5.6 With your direction

We share information when you ask us to, such as when you invite someone to a pool.

6. Invitations

When you invite someone to a pool, the Service generates an invitation link that you share yourself using your own email or messaging app; we do not send invitations to your contacts on your behalf, and we do not collect your invitees' contact information. You are responsible for who you invite. Only invite people who consent to being contacted and who meet the eligibility requirements in our Terms, including the 16+ age requirement.

7. Communications

Transactional and Service messages (pool invitations, pick deadlines, results, account, security, and billing notices) are part of the Service. You can adjust many notification preferences in your account settings.
Marketing email, if we send it, will be clearly identified and will include an unsubscribe link, which we will honor promptly. Unsubscribing from marketing does not stop transactional messages.
We do not send SMS/text messages.

8. Data Retention and Account Deletion

8.1 Retention. We retain personal information for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with legal obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. The criteria we use to determine retention periods include the nature of the information, the purpose for which it was collected, and any legal requirement to retain it.

8.2 How to delete your account and data. You can delete your account and associated data in either of two ways:

In the app or on the web: from your account settings within the Service (this is the fastest path); and
Without using the app: by submitting a request at https://winapoolooza.com/delete-account, or by emailing privacy@winapoolooza.com from the address associated with your account. We will verify your request and process it.

8.3 What deletion does. When you delete your account:

We remove or de-identify the personal information on your profile, including your email address, display name, profile picture, banner, bio, and contact details, and your account is disabled so it can no longer be used to sign in.
We delete your personal social data, such as your friend connections and notifications.
Your historical pool participation (such as picks, standings, and results) is retained in de-identified form, attributed to "Deleted User." This is necessary because pools are shared with other participants; deleting this data would corrupt other users' standings, scoring, and pool history. It is no longer associated with your identity, and we do not attempt to re-identify it.
Your subscription will not renew, and virtual items are forfeited.
Deletion is permanent and cannot be undone.

8.4 Data we may retain after deletion. We may retain a limited amount of information after an account is deleted where necessary for legitimate purposes such as security, fraud prevention, tax, accounting, or other legal or regulatory compliance, or to establish, exercise, or defend legal claims. Any such information is retained only as long as reasonably necessary for those purposes.

8.5 Deletion timing. We de-identify your personal data from active systems immediately upon account deletion. Residual copies in encrypted backups are purged within 7 days, after which they are overwritten, except for the limited records described in Section 8.4 (which we retain only as long as legally necessary).

9. Cookies and Similar Technologies

We use cookies and similar technologies (including browser local storage) for the following purposes:

Strictly necessary: keeping you signed in, maintaining your session, and securing the Service. The Service cannot function without these.
Functionality: remembering your preferences (for example, display settings).
Security: protecting against fraud and abuse.
Analytics/performance: understanding how the Service is used so we can improve it.

We do not currently use targeting or advertising cookies. If that changes, we will update this Policy and Section 5.3 first.

Do Not Track. There is no common standard for interpreting browser "Do Not Track" signals, so the Service does not currently respond to them.

Opt-out preference signals. Where required by applicable law, we honor recognized opt-out preference signals, such as the Global Privacy Control (GPC), as a request to opt out of the sale or sharing of personal information for the browser or device sending the signal. Because we do not sell or share personal information for targeted advertising today, such signals currently require no change to our processing. For more information, visit globalprivacycontrol.org.

You can also control cookies through your browser settings, but disabling strictly necessary cookies will prevent the Service from functioning.

10. Security

We use technical and organizational measures designed to protect personal information, including:

encryption in transit (HTTPS/TLS);
database-level access controls: row-level security is enforced so users can access only data for pools they belong to;
server-side authoritative logic: scoring and sensitive operations run on trusted servers, not in the browser;
least-privilege access controls and separation of client and server credentials; and
secure authentication through a specialized identity provider.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you create an account, choose strong credentials and do not share your password. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

11. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

Right	What it means
Access / Know	Confirm whether we process your personal information and request a copy of it, including in a portable, machine-readable format.
Correct	Request correction of inaccurate personal information. You can edit most profile information directly in the Service.
Delete	Request deletion of your personal information (see Section 8; in-app account deletion is the fastest path).
Opt out of sale or sharing / targeted advertising	We do not sell personal information or share it for targeted advertising. If that ever changes, this right will be exercisable in the Service and via opt-out preference signals (Section 9) before such processing begins.
Limit use of sensitive personal information	We do not collect sensitive personal information for purposes that trigger this right.
Opt out of profiling	We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.
Withdraw consent	Where we rely on your consent, you may withdraw it at any time.
Non-discrimination	We will not discriminate against you for exercising your rights. We will not deny you the Service, charge different prices, or provide a different level of quality because you exercised them.
Appeal	If we decline a request, you may appeal by replying to our decision, and we will respond as required by applicable law. If your appeal is unsuccessful, you may contact your state attorney general or data protection authority.

How to exercise your rights. Use the in-app account and profile settings, or contact us at privacy@winapoolooza.com. We will verify your identity before acting on a request, typically by confirming your control of the email address on your account. Authorized agents may submit requests on your behalf where permitted by law, with proof of your written authorization.

Response times. We will confirm receipt and respond within the timeframes required by applicable law, generally 45 days under California law (extendable once by 45 days) and 30–45 days under other state laws, with any permitted extensions communicated to you.

12. Additional State-Specific Disclosures

California. The categories of personal information we collect, the sources, the business purposes, and the categories of recipients are described in Sections 3–5. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. We do not collect or use sensitive personal information for purposes requiring a "Right to Limit" notice. Because the Service is restricted to users 16 and older, we do not knowingly sell or share the personal information of consumers under 16. Under California's "Shine the Light" law (Civil Code § 1798.83), California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes; we do not make such disclosures.

Nevada. We do not sell covered information as defined under Nevada law (N.R.S. 603A). If that changes, we will update this Policy and offer Nevada residents the right to opt out.

Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws. The rights in Section 11 apply to the extent these laws cover us, using the mechanisms and timelines described there.

Florida. We are a Florida company. To the extent the Florida Digital Bill of Rights applies, the rights and mechanisms in Section 11 apply.

13. Children's Privacy: 16 and Older

The Service is intended for users aged 16 and older. You must be at least 16 years old to use the Service (see our Terms of Service). The Service is not directed to, and we do not knowingly collect personal information from, anyone under 16.

If we learn that we have collected personal information from any person under 16, and, in any event, from any child under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA), we will delete it promptly and terminate the associated account. If you believe someone under 16 has provided us personal information, contact us at privacy@winapoolooza.com and we will take appropriate action.

14. International Users and Data Transfers

The Service is operated from the United States, is directed to users in the United States, and personal information is processed and stored in the United States and other countries where our providers operate.

If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

15. Third-Party Links

The Service may link to third-party websites and services (including app stores). This Policy does not apply to them, and we are not responsible for their practices. Review their privacy policies before providing them information.

16. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you, for example by posting a notice in the Service, emailing you, or requiring re-acknowledgment, and we will update the "Last Updated" date above. Changes take effect on the date stated in the notice.

Change history. This log records material changes to this Policy.

Version 1.2 (July 27, 2026): Lowered the minimum age from eighteen (18) to sixteen (16) throughout, including the Children's Privacy section. Versions prior to 1.2 predate this change log.

17. Contact Us

Winapoolooza LLC 149 Muirfield Drive, Ponte Vedra Beach, FL 32082 Privacy contact: privacy@winapoolooza.com General support: support@winapoolooza.com