Privacy Policy

1. What we collect

We collect only what we need to run the Service.

Account data

• Email address
• Password (stored as a salted bcrypt hash — we never see your password)
• Optional display name
• Plan (Free, Pro, Pro+) and any trial start/end dates
• Account creation timestamp and last-login timestamp
• Marketing-email preference (see §12)
• Referral code (if you signed up via a referral link) and referral credits earned

Usage data

• Which teams and leagues you've favorited (required to display them on your TV)
• Per-TV display preferences (e.g., schedule for when the TV starts/stops, alert settings)
• Analytics events about which features you use — opt-out: you can disable analytics from Settings → Privacy & Data at any time and we will stop collecting new events

Device data

• TV platform (Google TV, Android TV, LG webOS, or the browser type for web)
• A random device_id generated on each TV (used solely to pair your phone to a specific TV; not derived from any hardware identifier)
• Screen resolution and WebView user-agent string
• IP address (used for security, rate limiting, and abuse prevention; not used to build an advertising profile)

TV-link pairing

• A temporary 8-character pairing code (the claim window is 10 minutes; the code row is purged from our database within 24 hours)
• The timestamp at which the pairing code was claimed and the device_id it bound to

Billing (Pro and Pro+)

• Stripe customer ID and subscription status (we do not store card numbers — Stripe handles all card data directly)
• Google Play purchase tokens (for subscriptions purchased through Google Play Billing on Android TV / Google TV)
• Invoice metadata (amount, currency, date, plan) for accounting and tax purposes

Email delivery metadata

• Whether a transactional or marketing email was sent
• Whether it bounced or was reported as spam
• We do not currently run open-tracking pixels or click-tracking links

2. What we don't collect

• No payment cards. Stripe handles all card data; it never touches our servers.
• No viewing content. SkorTrack is a scoreboard, not a streaming service. We don't see what you're watching on any other app or input on your TV.
• No precise location. We use whatever time-zone your browser or TV voluntarily provides, and that's it. We don't request GPS, geolocation, or any location permission.
• No biometrics, no facial recognition, no microphone or voice data.
• No third-party analytics. No Google Analytics, no Meta pixel, no Mixpanel, no Amplitude. Our analytics events go to our own server only, and only if you've left analytics enabled.
• No advertising trackers. No ads on SkorTrack, and we don't share data with ad networks.
• No children's data (see §18).

3. How we use your data

• Run the Service and show you the teams, games, and scores you've configured
• Authenticate you and keep your account secure
• Pair your phone or web surface with a specific TV (via device_id + short-lived code)
• Deliver transactional emails: receipts, security alerts, account confirmations, password resets, billing notices, renewal reminders (see §12)
• Send marketing emails — only if you opt in — and honor every unsubscribe within 10 business days as required by CAN-SPAM
• Process subscription billing through Stripe (web) or Google Play Billing (Android TV / Google TV)
• Detect and prevent abuse, fraud, and rate-limit violations
• Debug crashes and fix bugs using server logs
• Comply with legal obligations and respond to lawful requests

4. Third-party services

We rely on a small number of third-party services. Here's exactly who, what they get, and what they do with it:

We do not currently use any third-party analytics, advertising, or behavioral-tracking service.

5. Legal basis for processing (GDPR)

If you are in the EU, UK, or another jurisdiction with a GDPR-style framework, we process your personal data on the following lawful bases:

• Contract (Art. 6(1)(b)) — we process account data, billing, and the features you've configured because we need to in order to provide the Service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — we process server logs, IP addresses, and crash data to keep the Service secure, debug bugs, and prevent abuse. We've assessed that this does not override your rights.
• Consent (Art. 6(1)(a)) — we send marketing emails only with your explicit opt-in, and we process analytics events only while you have analytics enabled. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — we retain billing records for as long as tax and accounting law requires.

6. Sharing & disclosures

We do not sell your personal information. We share data only:

• With the service providers listed in §4, each acting on our behalf and bound by confidentiality and use-limitation obligations.
• With legal authorities when required by valid legal process or to protect the rights, property, or safety of SkorTrack, our users, or the public.
• In connection with a merger, acquisition, or sale of assets, in which case this Privacy Policy will continue to apply or you will be notified of any material change and your options.

7. How long we keep your data

Aggregated, anonymized data (data with no link to any individual) may be retained indefinitely.

8. Security

We use industry-standard measures to protect your data:

• TLS (HTTPS) for all traffic between you and our servers
• Salted bcrypt for password hashing — we cannot see your password
• Scoped session tokens with reasonable expiry
• Least-privilege access controls on production systems
• OS-level firewalls on our infrastructure

No system is perfectly secure. If you suspect unauthorized access to your account, email skortrack@salzventure.com immediately.

Breach notification. If we become aware of a security incident affecting your personal data, we will notify affected users and the relevant supervisory authorities as required by applicable law (including without undue delay and, where required, within 72 hours under the GDPR).

9. Your rights (everyone)

Wherever you live, you can:

• Access your data. Email skortrack@salzventure.com or use the in-app data-export request (see §11). We will send you a JSON export of everything we have on you, typically within 24–72 hours and in all cases within 30 days.
• Delete your account. See §10.
• Correct inaccurate data. Update your profile in Settings → Account, or email us if a field isn't editable.
• Opt out of marketing email. Click the unsubscribe link in any marketing email (one click, no login), or toggle the setting in your account.
• Opt out of analytics events. Settings → Privacy & Data → Analytics.

10. How to delete your account

You can delete your SkorTrack account at any time:

1. From the phone / web dashboard: sign in at skortrack.com/account, then go to Settings → Account → Delete account and confirm.
2. By email: send a message to skortrack@salzventure.com from the email address on your account with the subject “Delete account.” We'll confirm and complete the deletion within 5 business days.

What happens when you delete. We delete your account row, which cascades to your favorites, leagues, subscription metadata, paired devices, and authentication tokens. Encrypted backups may retain a copy for up to 30 additional days before they roll over and the copy is purged. Billing records (invoices, transaction IDs) are retained for 7 years as required by U.S. tax and accounting law; we retain only what those laws require and link it to your email solely for those legal-compliance purposes.

Subscription cancellation is separate. Deleting your account does not automatically cancel a subscription purchased through Google Play. Cancel Google Play subscriptions in the Play Store app or at play.google.com/store/account/subscriptions. Web (Stripe) subscriptions are cancelled automatically when you delete the account.

11. How to export your data

To get a JSON export of everything we have on you, either click Settings → Privacy & Data → Request data export in the web dashboard, or email skortrack@salzventure.com with the subject “Data export.” The export will be emailed to the address on your account within 5 business days (and in all cases within 30 days, as required by GDPR Art. 15 and CCPA §1798.130).

12. Email & marketing (CAN-SPAM)

Transactional email — receipts, billing notices, password resets, security alerts, renewal reminders, and account-deletion confirmations — is sent to all users regardless of marketing preference. These messages are not marketing and are operationally required.

Marketing email — product news, feature announcements, occasional promotions — is sent only to users who have opted in. You can opt out at any time by:

• Clicking the Unsubscribe link at the bottom of any marketing email (one click, no login required), or
• Toggling marketing email off in Settings → Account → Email preferences.

Opt-outs take effect immediately and, in any case, within 10 business days as required by CAN-SPAM. Every marketing email includes our sender identity, the postal address for Salzventure Technologies LLC, and a working unsubscribe link.

13. California residents (CCPA / CPRA)

If you live in California, you have these rights under the California Consumer Privacy Act:

• Right to know what personal information we collect, the categories of sources, the purposes for use, the categories of third parties we share it with, and (for the prior 12 months) the specific pieces of personal information we have collected. The full answer is in §1, §3, §4, and §6.
• Right to access a portable copy of your personal information (we provide JSON export; see §11).
• Right to delete your personal information. See §10.
• Right to correct inaccurate personal information.
• Right to opt out of “sale” or “sharing” — we do not sell or share your personal information for cross-context behavioral advertising or for any other purpose. There is nothing for you to opt out of.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information beyond what is strictly necessary to operate the Service.
• Right of non-discrimination — we will not retaliate against you for exercising any of these rights.

Categories of personal information we collected in the prior 12 months (per Cal. Civ. Code §1798.130): identifiers (email, account ID, IP address, device_id), commercial information (subscription plan and billing transactions), Internet activity information (server access logs, app analytics events if enabled), inferences for product preferences (your favorited teams), and referral-program metadata (referral codes and attribution events, if you used a referral link).

How to exercise. Email skortrack@salzventure.com with the subject “California Privacy Request,” or use the in-app controls. We verify identity (usually by confirming you can receive email at the address on file) and respond within 45 days, with a one-time 45-day extension where reasonably necessary.

Authorized agents. You may designate an authorized agent to submit a request on your behalf; we will require written, signed authorization and may verify your identity directly.

14. EU / UK residents (GDPR & UK GDPR)

If you live in the European Economic Area, the United Kingdom, or another GDPR-aligned jurisdiction, you have these rights:

• Right of access (Art. 15) — request a copy of your personal data
• Right to rectification (Art. 16) — ask us to correct inaccurate data
• Right to erasure (Art. 17, “right to be forgotten”) — delete your account from Settings, or email us
• Right to restrict processing (Art. 18)
• Right to data portability (Art. 20) — we will send you a JSON export of your data on request
• Right to object (Art. 21) to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) for marketing email or analytics at any time, without affecting the lawfulness of processing before withdrawal
• Right to lodge a complaint (Art. 77) with a supervisory authority in your country of residence

To exercise any of these rights, email skortrack@salzventure.com with the subject “GDPR Request.” We will respond without undue delay and in any event within one month, with a possible two-month extension for complex requests.

International transfers. SkorTrack is operated from the United States. If you use the Service from the EU or UK, your personal data is transferred to and processed in the U.S. The only third parties we transfer EU/UK personal data to beyond ourselves are Stripe (U.S., Standard Contractual Clauses in place) and Resend (U.S., Standard Contractual Clauses in place). We rely on the EU Commission's Standard Contractual Clauses (and the UK addendum where applicable) as the transfer mechanism.

EU representative (Art. 27). We are a small U.S. company and have not yet appointed an Article 27 EU representative. We are committed to honoring your GDPR rights regardless. If you are in the EU and would like to escalate a privacy concern, please contact skortrack@salzventure.com; you also have the right to lodge a complaint with your local data-protection supervisory authority.

15. Other U.S. state privacy laws

Residents of the following states have privacy rights substantially similar to those described in §13 (California). We honor all of these rights without distinction based on state of residence:

• Colorado (Colorado Privacy Act)
• Connecticut (Connecticut Data Privacy Act)
• Utah (Utah Consumer Privacy Act)
• Virginia (Virginia Consumer Data Protection Act)
• Texas (Texas Data Privacy and Security Act)
• Oregon (Oregon Consumer Privacy Act)
• Montana (Montana Consumer Data Privacy Act)
• Iowa (Iowa Consumer Data Protection Act)
• Tennessee (Tennessee Information Protection Act)
• Delaware (Delaware Personal Data Privacy Act)
• New Hampshire (New Hampshire Privacy Act)
• New Jersey (New Jersey Data Privacy Act)
• Maryland (Maryland Online Data Privacy Act)
• Other states with comprehensive privacy legislation as they take effect

To exercise any of these rights, email skortrack@salzventure.com with the subject “Privacy Request” and your state of residence. We will respond within the timeframe required by your state’s law (typically 45–60 days).

16. Do Not Track & Global Privacy Control

Some browsers send a “Do Not Track” (DNT) signal or a Global Privacy Control (GPC) signal. We honor DNT and GPC for analytics — though as noted in §2, we don't run third-party analytics in the first place. Where the GPC signal is recognized as a valid opt-out of “sale” or “sharing” under California or Colorado law, we treat it as such; because we do not sell or share personal information, the practical effect on our processing is none.

17. International transfers

SkorTrack is operated from the United States (Amazon Lightsail, U.S. region). If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S., which may have data-protection laws that differ from those in your jurisdiction. For EU/UK users, see §14 for the specific safeguards in place.

18. Children's privacy

The Service is intended for users 13 and older. We do not knowingly collect personal information from children under 13 (as defined by the Children’s Online Privacy Protection Act, COPPA). We have not pursued COPPA safe-harbor certification because the Service is not directed at children.

Age self-certification. We rely on self-certification: users must confirm they are 13 or older by accepting our Terms of Service during signup. We do not independently verify age. If we learn that a user is under 13, we will delete the account and all associated personal data promptly.

If you believe we have inadvertently collected information from a child under 13, please email skortrack@salzventure.com and we will delete it promptly.

19. App-store data safety summary

This summary mirrors what we declare in the Google Play Data Safety section. It is provided here for transparency and as the authoritative privacy disclosure required by the Google Play Developer Program Policies.

Data is encrypted in transit via TLS. You can request that data be deleted by following §10.

20. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be surfaced in-app or by email to active accounts at least 14 days before they take effect. We will keep prior versions on request.

21. Contact

Salzventure Technologies LLC
Operator of SkorTrack
Denver, Colorado, USA
Email: skortrack@salzventure.com
Web: skortrack.com

A current physical address is available on request from skortrack@salzventure.com and corresponds to the registered-agent address on file with the Colorado Secretary of State.

DMCA designated agent. Scott Salzberg — skortrack@salzventure.com, subject line “DMCA Notice.”

EU/UK complaints. Email skortrack@salzventure.com. You also have the right to lodge a complaint with your local data-protection supervisory authority. We have not yet appointed an Article 27 EU representative.