Privacy Policy

1. What we collect

• Account and identity. Your email address and name as held by our sign-in provider (Clerk), the invitation you accepted, your member role, when you joined and when you were last seen. Sign-in passwords and verification codes are handled by Clerk, not stored by Rift.
• Preferences. The sports, bet types, price range, favorite teams, saved filters and alert rules you choose. These are kept in a cookie on your device (rift.prefs, rift.filters) and, when you are signed in, in our database (member_preferences) so they follow you between devices. Your Appearance choice (Dark, Light or System) is kept in your browser's local storage (rift.appearance) and, when you are signed in, on your account (member_appearance).
• Feedback and support requests. What you send through Give feedback, Contact us or Report data issue: the category, your message, a reference (FB-…), and the page or market details shown with it (the page, sport, game, market, player, line, price, book and when it was quoted, the app version, your device type and time zone). If you are signed in, which account sent it and its plan; if you are signed out and ask for a reply, the email address you give. One-way, keyed hashes of your account (or, signed out, of this browser's device id and network address) and of the message, used only to limit how often feedback can be sent and to spot duplicates - never the address itself.
• Chat (Rift Pro). If you use Chat: the messages and replies you post, your reactions, the Rift Picks, games and props you share, and any reports, mutes and blocks you make. Other members see your Rift name, its initial as your avatar, and what you post - never your plan, email address or any other account detail.
• Your journal. Positions and picks you track (the pick, price, book, model and market probabilities as they stood, your units and notes, and how they settled), and your bankroll unit settings. Rift records units, never amounts of money.
• Notifications. If you turn on push notifications, your browser's push subscription endpoint and your notification settings.
• Product events. Named events such as "viewed the board" or "started checkout", stored in product_events with a random identifier generated in your browser (the rift_anon cookie) and how you arrived: the campaign names on the link you first arrived from (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the kind of site that referred you (a search engine, a named social network, or other - never the site's address or the page), or that you came directly; and the same for the most recent visit that came from a campaign link or another site (the rift_lt cookie). When you are signed in, events also carry a keyed one-way hash of your member id - never the id itself. They contain no email, name, IP address or payment detail.
• Where you came from (first-party). When you arrive from an ad or a link, Rift records the campaign details in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the path of the page you landed on (never its query string), and any ad click id the platform added (fbclid, ttclid or twclid), in Rift's own rift.click and rift.land cookies. When you sign up, these are linked to your account so Rift can tell which campaign brought you. Click ids are not kept when your browser sends Global Privacy Control.
• Advertising measurement (Meta Platforms, Inc.). To learn which of our ads on Facebook and Instagram bring people to Rift, the Meta Pixel runs in your browser and tells Meta Platforms, Inc. which Rift pages you view (the page address, which can include the campaign details and ad click id of the link you arrived on) and when you open checkout and start a trial, with the plan's price; it reads and sets _fbp and _fbc cookies. Renewals and cancellations are never reported. Nothing about your picks, bets, journal or the odds you viewed is shared, and never your name, phone number or address. Meta Platforms, Inc. uses this under its own terms and privacy policy. If your browser sends Global Privacy Control, the pixel is not loaded, its cookies are not set and nothing is reported to Meta Platforms, Inc.
• Advertising measurement (X Corp.). To learn which of our ads on X bring people to Rift, the X Pixel runs in your browser and tells X Corp. which Rift pages you view (their address without any query string, together with the X click id your landing carried, if any) and when you create your account, open checkout and start a trial, with the plan's price; it reads and sets _twclid and _twpid and _twsid cookies. When you create an account, start a trial or make your first subscription payment, Rift's server also reports it to X Corp.'s Conversion API with a one-way SHA-256 hash of your email address, the ad click id and browser identifiers above, your IP address and your browser's user-agent string, and - for a payment - the amount paid (a trial is reported as $0). To do that, the same identifiers are kept with your subscription at Stripe. Rift switches off the X Pixel's automatic form scanning, so it never reads your email address, password, payment card details or anything you type into Rift. Renewals and cancellations are never reported. Nothing about your picks, bets, journal or the odds you viewed is shared, and never your name, phone number or address. X Corp. uses this under its own terms and privacy policy. If your browser sends Global Privacy Control, the pixel is not loaded, its cookies are not set and nothing is reported to X Corp.
• Security records. An audit trail of sign-in refusals and administrative actions, which may include a one-way hash of an IP address and your browser's user-agent string; and rate-limit counters.
• Billing. If you subscribe: your payment provider customer and subscription identifiers, plan, billing period, trial and renewal dates, subscription state, amounts and dates of invoices, refunds and disputes, a one-way hash of your payment method's provider fingerprint (used only to enforce one free trial per card), promo codes you redeemed, your cancellation reason and feedback if you chose to give them, the confirmation shown to you at signup, and the billing emails queued to you. Your card number, expiry and security code go directly to Stripe; Rift never receives or stores them.
• Age and terms confirmations. That you confirmed the minimum age and accepted the billing terms, when, and under which policy version. We do not collect your date of birth.
• Referrals. Your referral code; for people who joined through your link, that a referral exists, its status, and a masked form of their email address (its first letter and domain, e.g. d•••@gmail.com) so you can tell your referrals apart; service credits you earned. A referral cookie (rift.ref) remembers a referral link you opened for up to 30 days.
• Rift name and sign-in. The Rift name (username) you choose, if you choose one. If you add a password it is held by Clerk, never by Rift. To keep an account to one signed-in device at a time, Rift stores a one-way hash of your current session's identifier and, when a newer sign-in signs an older one out, when that happened and the browser and device name Clerk reports for the session signed out.
• Screenshot import (Rift Pro). A bet-slip screenshot you upload is sent, for that one request, to our image-reading provider (Anthropic) only to read the bet. Rift does not save the screenshot, or the text read from it, to your account or its logs; only the bets you confirm are saved, like any bet you enter. Under that provider's standard terms it may keep what it receives for up to 30 days. Rift records only that a read happened (its time, file type and size, and how many bets were found), to enforce a daily limit.
• Rifty, the product assistant. Messages you send to Rifty are processed to produce an answer by our language-model provider (Anthropic). Rift does not store conversation transcripts. Do not include sensitive personal information in messages to Rifty.
• AI usage records. For each Rifty answer or screenshot read, which feature was used, by which member, the model, the number of tokens, the estimated cost and whether it succeeded - to enforce daily limits and a monthly spending cap. Never the question, the answer or the image.

2. Cookies and local storage

• Sign-in session cookies set by Clerk, needed to keep you signed in.
• rift.device: a random id for this browser, so its tabs and visits count as one of the two devices an account may be signed in on. It says nothing about you or the device (400 days).
• rift.prefs and rift.filters: your view preferences.
• rift.appearance (local storage): your Appearance choice - Dark, Light or System.
• rift.ref: a referral link you opened (attribution only).
• rift_anon: a random analytics id and how this browser first arrived - its campaign names, the kind of referring site, or that it came directly (one year).
• rift_lt: the most recent campaign names or kind of referring site this browser arrived from, and when; a direct visit does not change it (one year).
• rift_sid: an analytics session id that ends after 30 minutes idle.
• Local storage: rift.first_seen, rift.firsts and rift.seen (which first-time events have fired); older browsers may still hold rift.visitor, which moves into rift_anon.
• rift.trialNudge.shownAt (local storage): when the trial suggestion was last shown, so it appears at most once a week.
• rift.session_notice: that this device has been told another session was signed out (two days).
• rift.click: the ad click id (fbclid, ttclid or twclid) your landing carried, for matching a sign-up or purchase to the ad (30 days). Not set when your browser sends Global Privacy Control.
• rift.land: the path of your first landing and of your latest arrival from a campaign or another site (one year).
• _fbp and _fbc: set by the Meta Pixel to measure Rift's ads. Not set when your browser sends Global Privacy Control.
• _twclid and _twpid and _twsid: set by the X Pixel to measure Rift's ads. Not set when your browser sends Global Privacy Control.

The ad platforms' cookies listed above are the only advertising cookies.

3. Why we use it

• To provide the service you asked for: your account, your preferences, your journal, your plan.
• To bill you, prevent trial, promo and referral abuse, and handle refunds and disputes.
• To keep Rift secure and to understand, in aggregate, which parts of the product are used.
• To measure which of Rift's campaigns and ads lead to visits, sign-ups, trials and subscriptions.
• To send the service messages you need (trial reminders, cancellation confirmations) and, unless you opt out, at most one message after you cancel.
• To meet legal, tax and accounting obligations.

4. Who processes it for us

• Vercel - hosting and request logs.
• Supabase - database (United States).
• Clerk - sign-in, identity and sign-in verification emails.
• Stripe - payments, when you subscribe; Stripe acts under its own privacy policy for card data.
• Anthropic - generates Rifty's answers from the messages you send to Rifty, and reads bet-slip screenshots you upload, for that request only.
• Resend - delivers Rift's account, trial, billing, referral and invitation emails.
• Cloudflare - forwards email you send to Rift's @riftodds.com addresses to our inbox.
• Meta Platforms, Inc. - receives the ad-measurement events described in section 1, unless your browser sends Global Privacy Control.
• X Corp. - receives the ad-measurement events described in section 1, unless your browser sends Global Privacy Control.
• Sports data providers (odds, schedules, rosters and weather) supply the data Rift analyses; they receive no personal information about you.

We do not sell or rent personal information. Some state privacy laws treat the ad-measurement data sent to Meta Platforms, Inc. and X Corp. as "sharing" for cross-context behavioral advertising; you can opt out of it with Global Privacy Control, which Rift honors, or by emailing privacy@riftodds.com.

5. How long we keep it

• Screenshots you upload for import: not stored.
• Account, preferences, journal (positions) and referral records: while your account exists. Downgrading or canceling never deletes them; we delete them when you make a verified deletion request, except records we must keep for legal, accounting or security reasons.
• Billing, invoice, refund and dispute records: as long as tax and accounting law requires (we use 7 years), even after account deletion.
• Product events, security logs, AI usage records and support emails: only as long as they are needed for their purpose.

6. Your choices and rights

• Access, correct, or export your data; delete your account and personal data (billing records we are legally required to keep are retained, restricted to that purpose).
• Turn off push notifications, clear the preference cookies, or opt out of the post-cancellation message from your account page.
• Turn on Global Privacy Control in your browser (or an extension that sends it): Rift then loads no advertising pixel, keeps no ad click id and reports nothing about you to any ad platform.
• Depending on where you live (for example California or the EU/UK), you may have further rights, including to object or to complain to a regulator.

To make a request, email privacy@riftodds.com or support@riftodds.com. We will verify the request comes from the account holder.

7. Children

Rift is not for anyone under the minimum age and we do not knowingly collect their information.

8. Security

Data is encrypted in transit; database tables are closed to public access and read only by Rift's server. No method is perfectly secure; we will notify you of a breach affecting you as the law requires.

9. Contact

nuvuro LLC, 3844 Blaisdell Ave, Minneapolis, MN 55409, United States. Privacy contact: privacy@riftodds.com.