Privacy Policy

1. Who we are

Dilldrup LLC, doing business as Roundball AI ("Roundball AI", "we", "us"), operates https://www.roundball.ai. This policy explains what personal information we collect, why, and what rights you have over it. It applies to the website and any related applications (the "Service").

You can reach us about anything in this policy at [email protected]. We operate entirely online, so email is the way to reach us.

2. What we collect

Information you give us:

• Your email address, when you register or contact us.
• Your password, which we store only as a salted cryptographic hash. We never store it in a form we can read, and we cannot recover it for you.
• Preferences you set in the product, such as players you follow and strategies you subscribe to.

Information we create about your account:

• Whether your email address has been verified, and the time-limited tokens used to verify it.
• Which version of our Terms of Service and this Privacy Policy you accepted, the time you accepted them, and the IP address and browser user agent recorded at that moment. We keep this to evidence the agreement between us.
• Account status and role, and the times your account was created and changed.

Information collected automatically:

• Your IP address and browser user agent, recorded in server logs and used to rate-limit sign-in attempts and detect abuse.
• The pages and endpoints you request, and the time of each request.

We do not collect payment card details. We do not ask for, and you should not send us, any information about your betting accounts, wagers, or financial position.

We do not knowingly collect special categories of personal information, such as health, biometric, or precise geolocation data.

3. Why we use it

We use personal information only for these purposes:

• To create and operate your account, authenticate you, and provide the Service.
• To send you transactional email: address verification, and service or security notices. We do not send marketing email.
• To keep the Service secure and available, including rate limiting, abuse detection, and diagnosing faults.
• To evidence your acceptance of our Terms of Service and this policy.
• To comply with law, and to establish, exercise, or defend legal claims.

Where the law requires a legal basis, ours is the performance of our contract with you, our legitimate interest in running and securing the Service, your consent where you have given it, and compliance with legal obligations.

4. What we do not do

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.
• We do not run third-party analytics, advertising pixels, or tracking scripts on the Service.
• We do not profile you for advertising, and we make no automated decision about you that produces a legal or similarly significant effect.
• We do not share your information with sportsbooks, and we have no way to know whether you place a bet.

5. Cookies

The Service sets one cookie, a session cookie named rb_session. It identifies your signed-in session and nothing else. It is signed, marked HttpOnly so scripts cannot read it, restricted to same-site requests, sent only over HTTPS in production, and expires after thirty days or when you sign out.

It is strictly necessary to provide the Service, so it is not subject to a consent banner. Blocking it will prevent you from signing in. We set no advertising, analytics, or third-party cookies.

6. Who we share it with

We share personal information only with service providers who process it on our behalf, under contract, and only as needed to run the Service:

• Amazon Web Services, for hosting, application infrastructure, and our database, in the United States.
• Amazon Simple Email Service, to deliver account verification email. Your email address and the message are processed to send it.
• Cloudflare, for DNS, content delivery, and network protection. It processes your IP address and request metadata in transit.

We may also disclose information where we are required to by law, court order, or a valid request from a public authority, or where we need to in order to establish, exercise, or defend legal claims, or to protect the rights and safety of our users or the public.

If the business is ever sold or merged, personal information may transfer as part of that transaction. We would tell you before your information became subject to a materially different policy.

Sports and odds data we display comes from third-party providers. We send them no information about you.

7. How long we keep it

• Account information is kept while your account is open, and deleted within 30 days of you closing it, except where we must keep something longer.
• Records of which legal version you accepted are kept for as long as either of us could bring a claim under that agreement, because their purpose is to evidence it.
• Server logs containing IP addresses are kept for up to 90 days and then deleted.
• Verification tokens expire within 24 hours and are cleared once used.

8. How we protect it

Traffic to the Service is encrypted in transit with TLS. Passwords are stored only as salted hashes. Access to production systems is restricted and authenticated, and the database is not reachable from the public internet.

No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your personal information and the law requires us to notify you, we will.

9. Your rights

Wherever you live, you may ask us to:

• Tell you what personal information we hold about you and give you a copy of it.
• Correct information that is inaccurate or incomplete.
• Delete your account and the personal information associated with it.
• Export your information in a portable, machine-readable format.
• Restrict or object to a particular use, or withdraw consent you previously gave.

Email [email protected] to make a request. We will verify that the request comes from you, usually by confirming control of the registered email address, and respond within 45 days. We will not discriminate against you for exercising any of these rights.

If you live in California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, those laws give you the rights listed above, including the right to know, to delete, to correct, and to opt out of sale or targeted advertising. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of, but you may still exercise the other rights. You may authorise an agent to act for you, and you may appeal a decision we make by replying to our response.

If you are in the United Kingdom or the European Economic Area, you may also lodge a complaint with your local supervisory authority.

10. Children

The Service is not directed to children, and you must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact [email protected] and we will delete it.

11. Where your information is held

We operate in the United States and store personal information there. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where privacy law may differ from that of your own country.

12. Changes to this policy

We may update this policy. Each version carries a version identifier and an effective date, and we record which version you accepted. If a change is material, we will ask you to accept the new version the next time you sign in.

13. Contact

Questions, requests, and complaints about privacy can be sent to [email protected]. We aim to answer every message within a few business days.