1. What we collect
When you create an account we store your name, email address, hashed password (or OAuth identifier), and account preferences. We never store payment card details — those go directly to Stripe and we only see the metadata Stripe returns (last 4 digits, brand, billing country).
When you use Pro features we log: in-play AI questions you ask, audit requests you queue, alert rules you create, bets you log in the bet tracker, and the credit-ledger entries that record every charge or grant. All of this is yours, browsable on your activity page.
We also collect minimal analytics about page views to keep the Service performant (e.g. response times). We do not run third-party trackers like Google Analytics or Facebook Pixel.
2. Why we collect it
- To deliver the Service (e.g. send you alerts, render your dashboard)
- To bill Pro subscriptions and refund credits when something fails
- To improve the AI prediction system using aggregated, anonymised performance data
- To respond to support requests and security incidents
3. Who we share it with
We share minimum-necessary data with the third parties that power the Service:
- Stripe — for payments and subscription management
- Resend — for transactional email (verification, alerts, digest)
- AI providers (Anthropic, OpenAI, xAI, Google, DeepSeek, Meta, Mistral) — your in-play questions go to the model you select; they do not receive your account email or payment data
- Sports data feeds (The Odds API, api-sports.io) — receive no personal data; we only consume their data
- Google (Socialite) — only if you sign in with Google; we receive your verified email + display name
We never sell your data to advertisers or data brokers.
4. How long we keep it
Account data is kept for as long as you have an account. Credit-ledger entries are retained for 7 years to satisfy financial recordkeeping. Anonymised AI prediction performance data is kept indefinitely as part of our public research record.
5. Your rights
You can:
- Access your data — visible on your activity page and account page
- Correct your account details from your account page
- Delete your account and data — email hello@modelfights.com with subject "delete account"; we'll act within 30 days subject to legal record-keeping obligations
- Port your data — same email, subject "export data"
- Withdraw consent for the morning digest from your account page at any time
6. Security
Passwords are hashed with bcrypt. Transport is HTTPS-only in production. We use signed routes for verification, follow rate limits on credential endpoints, and rotate API keys promptly when an exposure is suspected.
7. Cookies
We set a session cookie when you sign in and a small preference cookie for theme (light/dark) and sidebar state. We do not set advertising or tracking cookies.
8. International users
If you're in the EU/EEA, UK, California, or other jurisdictions with specific privacy laws, the rights granted to you under those laws (GDPR, CCPA, etc.) are fully respected via the data-rights mechanism in section 5.
9. Changes
If we make material changes to this policy we'll email registered users and post a notice on the Service. Continued use after a change constitutes acceptance.
10. Contact
Privacy questions, data requests, or notices: hello@modelfights.com.
See also: Terms of Service · Methodology · About.