Privacy Policy

InnateDuty LLC ("we," "us," or "our") operates EdgeGoat: the website at edgegoat.com, the web app at app.edgegoat.com, and the EdgeGoat iOS app (together, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights you have.

1. Information We Collect

Information you provide:

• Account information: Your email address, name (optional) and password. Passwords are stored only as a salted hash.
• Sign in with Apple: If you sign in with Apple, we receive a stable Apple user identifier and the email address Apple shares with us (which may be a private relay address), and your name if you choose to share it.
• Bets, parlays and tracking: Parlays and legs you build, save or track; stakes, odds and results; your bankroll/P&L entries; lines you star; and bet slips you import from a sportsbook (for example, a Hard Rock Bet slip shared to the iOS app), which we read to create the tracked legs.
• Preferences: Favorite leagues, preferred sportsbook, time zone, notification categories and quiet hours, and similar settings.
• Support chat: Messages you send us through in-app support chat, and any image or file you attach.
• Waitlist and email: Your email address if you join a waitlist or contact us by email.
• Payment information: Paid plans are bought through Stripe. Stripe collects your card and billing details; we receive only limited information such as your Stripe customer ID, plan and billing status. We never receive or store your card number.

Information collected automatically:

• Push and Live Activity tokens: If you allow notifications in the iOS app, we store the device push token Apple issues so we can send alerts. If you start a Live Activity for a parlay, we store its ActivityKit push token so we can update it on your Lock Screen and Dynamic Island. You can turn these off in iOS Settings or in the app.
• Usage analytics: Pages and screens viewed, features used and similar events, collected with Umami (see Section 5), which we host ourselves and which does not use cookies.
• Error and performance diagnostics: When the web app or iOS app hits an error, Sentry records technical details (error message and stack trace, browser or device type, operating system, app version, the page you were on, and a sample of performance timings). When an error occurs, Sentry may also capture a short session replay of the moments leading up to it: a reconstruction of the page layout and interactions, with on-screen text and form inputs masked and images and media blocked.
• Log data: Our servers log IP addresses, request times, the pages or API endpoints requested, and user agents, to operate and secure the Service.

2. How We Use Information

• Provide, operate and maintain the Service, including tracking your bets and pricing your parlays
• Send the push notifications and Live Activity updates you turn on
• Process subscription payments and manage your account
• Send service emails such as account verification, password resets, verification reminders and billing messages
• Answer support requests
• Measure and improve the Service, and diagnose and fix errors
• Improve our projection models using aggregated or de-identified usage and results
• Detect and prevent fraud, abuse, and violations of our Terms of Service

Some features, such as automatically generated parlay names, use a language model that we run on our own servers; your data is not sent to a third-party AI provider for this.

3. Service Providers

We share information only with providers that help us run the Service, and only as needed for that work:

• Stripe: Payment processing, subscriptions and the billing portal.
• Mailgun: Transactional email delivery.
• Sentry (Functional Software, Inc.): Error monitoring and error-triggered session replay for the web and iOS apps.
• Google Analytics 4 (Google LLC): Website analytics on edgegoat.com, only if you accept analytics cookies (see Section 5).
• Apple: Sign in with Apple, push notification and Live Activity delivery (Apple Push Notification service), and App Store distribution.

Our application servers, databases and file storage (including support-chat attachments) and our Umami analytics are hosted on infrastructure operated by us in the United States, not by a third-party cloud provider.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We do not share your data with advertisers or data brokers.

We may disclose information if required by law or valid legal process, to protect our rights, property or safety or that of others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

4. Data Retention

• Account data (profile, bets, parlays, preferences, support chat, tokens) is kept while your account is open. When you delete your account, it is deleted from our production database immediately; residual copies in backups and server logs are deleted as they expire on their normal rotation schedule.
• Push and Live Activity tokens are removed when you delete your account, and are replaced or discarded when Apple reports them invalid or a Live Activity ends.
• Billing records may be kept by us and by Stripe for as long as required for tax, accounting and legal purposes, even after account deletion.
• Error reports and session replays in Sentry are deleted automatically under Sentry's retention period for our plan (currently 90 days or less).
• Analytics data is kept in aggregate form; Google Analytics data is set to expire under Google's retention settings.
• Aggregated or de-identified data that can no longer be linked to you may be kept indefinitely to improve our models and the Service.

5. Cookies, Local Storage and Analytics

• Essential: A secure, httpOnly refresh-token cookie keeps you signed in to the web app. The apps also use your device's local storage for settings such as your selected league, dismissed tips and whether you have finished onboarding.
• Umami (web app, iOS app and edgegoat.com): Cookieless, privacy-focused analytics that we host ourselves. It records page views and feature events without cookies and without building cross-site profiles.
• Google Analytics 4 (edgegoat.com only): Our marketing site asks for your consent before Google Analytics may set cookies (Google Consent Mode). Until you accept, analytics and advertising storage stay denied. You can change your choice by clearing the site's data in your browser, which brings the consent banner back.

We do not use advertising cookies or sell data to ad networks. The web app and iOS app do not use Google Analytics.

6. Your Choices

• Access and export: download a copy of your data from Account → Export My Data.
• Delete: delete your account from Account → Delete Account in the web app or iOS app, or email us.
• Notifications: turn push notifications and Live Activities off in iOS Settings or in the app's Settings. We only send service emails related to your account; we do not send marketing email.
• Correct: email us to correct information in your account.

7. Security

• Data sent between your device and our servers is encrypted in transit with TLS
• Passwords are stored only as salted hashes (scrypt), never in plaintext
• Card data is handled by Stripe and never touches our servers
• Access to production systems is restricted to authorized personnel

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know and access the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to (described in Sections 1–3).
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months.
• Limit use of sensitive personal information. We use your account password only to sign you in, and we do not use sensitive personal information to infer characteristics about you.
• Non-discrimination for exercising any of these rights.

To make a request, use the in-app export and delete tools or email [email protected] from the address on your account. We will verify your request by confirming control of that email address and respond within 45 days. You may use an authorized agent; we may ask the agent for signed permission and ask you to confirm your identity with us.

9. Age Requirement

The Service is only for people 21 and older. We do not knowingly collect personal information from anyone under 21. If we learn that we have, we will delete it promptly. If you believe someone under 21 has given us personal information, contact us at [email protected].

10. Third-Party Links

The Service links to sites and apps we do not operate, including sportsbooks such as Hard Rock Bet and sports data providers. Their privacy practices are governed by their own policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time and will change the "Last updated" date above when we do. For material changes to how we handle your personal information, we will notify you by email at least 30 days before the changes take effect.

12. Contact

EdgeGoat is operated by InnateDuty LLC. Questions or requests about this Privacy Policy or your data: [email protected].