Privacy Policy

Last updated 30 September 2026

1. What we collect

• Your email address, when you join the waitlist or subscribe. It is how we identify your account and how we reach you.
• Session data. When you sign in we store a one-way hash of your session identifier, the expiry, and the browser's user-agent string. We do not store the identifier itself, so a copy of our database cannot be used to sign in as you.
• Subscription status — which plan you are on and when it started and ends.
• Preferences you set, such as your sportsbook and your state. Your sportsbook and state are stored on your device and are sent to us only if you are signed in and we need them to build a bet-slip link.
• Chat messages, if you use the assistant, so the conversation has memory and so we can enforce usage limits.
• Free chat questions, if you use the chat without Pro: how many of the 5 free questions this device has used, counted against a random device id (the certy_dev cookie, section 5), and a weekly count per network address plus a daily count per network operator, stored as scrambled codes we cannot turn back into your IP address and deleted after 14 days. If you ask the chat to stop, or an account that asked us to stop is used on this device, the device id is marked so the free questions stay off. Free questions are not saved to an account.
• Which link brought you here, if the link carried a tag: the campaign tags on an ad or post link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), X’s click id (twclid) or a creator’s referral code (ref), plus the page you landed on and when. It is kept in the certy_src cookie (section 5). If you start a subscription it is stored with that subscription, so we can count which links lead to sign-ups.

2. What we do not collect

• Card numbers. Payments go through Stripe. Your card details go to Stripe, never to us — we receive only a customer reference and whether the payment succeeded.
• Your bets. Certy is not a sportsbook. We do not know what you wagered, how much, or whether it won. Tapping a bet-slip link hands you to the book; what happens there is between you and them.
• Advertising or cross-site trackers. There are none in the app. We do not build an advertising profile of you and we do not sell or rent your data to anybody.
• Precise location. We never ask for it. If you tell us your state, it is because you chose it from a list.

3. Why we collect it

To sign you in, to know whether you are entitled to the paid board, to take payment, to send you the emails you asked for, to count which of our own links lead to sign-ups (the certy_src cookie, section 5), and to stop abuse. That is the whole list. We do not use your data to train anything or to profile you.

4. Who else sees it

Only the services that make Certy work:

• Stripe — payments and subscription state.
• Supabase — our database, where accounts and the public record live.
• Cloudflare — hosting and delivery.
• Anthropic — if you use the chat assistant, your message is sent to the model to answer it.

Each holds data only to provide their service to us. We will disclose data if the law actually requires it, and we will tell you unless we are forbidden to.

5. Cookies

Three cookies, all first-party — set by certy.bet, for certy.bet only:

• certy_sess keeps you signed in. It is HttpOnly, Secure and SameSite=Lax — script cannot read it and it does not ride along on other sites' requests. Signing out clears it.
• certy_src remembers which link brought you here, and is set only when that link carried a tag (section 1). It holds those tags, the page you landed on and the time — never your name, email or anything about your bets. It is Secure and SameSite=Lax and lasts 30 days; a later tagged link replaces it. If you start a subscription, its contents go with your checkout to Stripe, our payment processor, and into our own records, so we can tell which links lead to sign-ups. We do not share it with advertisers, X or anyone else, and we do not use it to follow you across other sites. Deleting your cookies deletes it.
• certy_dev counts the 5 free chat questions on this device. It holds a random id and our signature on it — nothing about you, your account or your bets. It is HttpOnly, Secure and SameSite=Lax, is sent only to the chat, and lasts a year. It is set the first time you ask the chat something.

There are no advertising cookies and no third-party analytics cookies.

6. How long we keep it

• Sessions expire after 60 days, or immediately when you sign out.
• Sign-in codes expire within hours and are single-use.
• Account and subscription records are kept while your account exists, and afterwards only as long as tax and accounting rules require.
• The public record of our own picks is permanent by design — but it is about our calls, and contains nothing about you.

7. Your choices

• See it, correct it, or delete it. Email us and we will.
• Delete your account and we remove your email, sessions, preferences and chat history. Payment records we are legally required to keep, we keep.
• Stop the emails — reply to any of them, or ask us.
• If you are in California, the EU or the UK, you have additional rights over access, portability, correction and erasure. Ask and we will honour them; we do not sell personal information, so there is nothing to opt out of.

8. Security

Secrets live server-side and are never shipped to the browser. Sign-in tokens and session identifiers are stored only as one-way hashes. Database access is deny-by-default: the public key can read the published record and add a waitlist signup, and nothing else. No system is perfect, and if we ever have a breach affecting you we will tell you promptly and plainly.

9. Children

Certy is 21+. We do not knowingly collect data from anyone under 21, and we delete it if we discover we have.

10. Changes

If we change how we use your data in a way that matters, we will tell you before it takes effect rather than quietly updating this page.

11. Contact

Sacred Studios LLC — [email protected]