Privacy Policy

1. Who We Are

WhereToWatchSports (“we,” “us,” or “our”) operates wheretowatchsports.ai — a US-based marketplace that connects sports fans with bars and restaurants televising specific games. The platform serves two audiences: fans who want to find a venue showing their game, and bar operators who claim and manage their venue listings.

Questions about this policy? Contact us at team@wheretowatchsports.ai.

2. Information We Collect

2a. Fan (Consumer) Information

Fans browse and search WhereToWatchSports without creating an account. The information we collect from fans is limited to what is needed to show nearby bars and improve the service.

• Email address (voluntary): If you sign up for game alerts, updates, or our newsletter through the “Get Updates” feature on our homepage, we collect your email address. We use it to send you sports-bar availability alerts, platform updates, promotional offers, and future newsletter communications. Providing your email is entirely voluntary — you can use the bar-finder without signing up. See Section 5 for your unsubscribe rights.
• Location (GPS or typed address): When you use the “near me” distance filter, your browser requests your precise GPS coordinates. If you type a city, ZIP code, or address into the search bar, our geocoding provider converts it to approximate coordinates. We use this location data solely to return nearby bar results.
• Anonymous usage and analytics: We log which games you view, which bars you click on, and anonymized geographic search signals for service improvement and business analytics. See Section 3 for how we handle this data.
• Timezone and device signals: We infer your local timezone from your browser, an opt-in cookie, or your network’s approximate location (via Vercel’s edge infrastructure) to display game times correctly in your local time. No account is required for this.

2b. Operator (Bar Owner / Manager) Account Information

Bar operators create accounts to claim and manage their venue listings. We collect:

• Account credentials: Email address and password (stored by Supabase using industry-standard hashing).
• Bar claim information: Business name, address, phone number, website, and any documentation you provide to verify your association with the venue.
• Game schedule and listing data: Games you mark as showing at your venue, listing attributes, and photos you upload to your profile.
• Billing information: If you buy a paid plan or tool, payment is processed entirely by Stripe. We do not store your card number, CVV, or full payment details. We receive and retain only non-sensitive billing identifiers (Stripe customer ID, subscription status, and invoicing records) as required for account management. See Section 4.

3. How We Use Your Information

3a. Location Data

Precise GPS coordinates are stored only in a short-lived, server-side session cookie (httpOnly, Secure, SameSite=Lax) that expires automatically after one hour. Raw coordinates are never written to our database.

When we record a search event for analytics purposes, we convert your coordinates to a coarsened geographic cell (H3 hexagon at resolution 7, covering approximately 5 square kilometers). This cell identifier is what we store — the original coordinates are discarded and cannot be reconstructed from the stored value. Free-text address queries are never persisted.

3b. Fan Email Address

If you provide your email address for updates or game alerts, we use it for:

• Game-day availability alerts and sports-bar recommendations near you (when you opt in to specific notifications).
• Platform updates, new features, and promotional offers related to WhereToWatchSports.
• Future newsletter and account features as the platform grows.

We do not sell, rent, or trade your email address to third parties for their own marketing purposes. We may share it with our email delivery provider (Resend) solely for the purpose of sending you messages on our behalf — see Section 6.

3c. Anonymous Usage Analytics

We record anonymous click events (which bar or game card you interacted with, your position in the ranked list, and the trust tier of the result) using a random session token that contains no name, email, or identifying information. We use these analytics to measure the fairness of our ranking algorithm, identify popular bars, and improve the fan experience. The session token is not linked to your identity unless you are a logged-in operator.

3d. Operator Account Data

We use operator account data to authenticate you, administer your bar listings, send transactional emails (claim confirmation, billing receipts, verification notices), and provide support. We may also use aggregate, de-identified operator data to improve the platform.

3e. Assisted Predictions

WhereToWatchSports uses a prediction layer (powered by Anthropic) to estimate which bars are “Likely” to be showing a given game based on bar attributes, historical patterns, and public data. This prediction process does not use any personal information about fans or operators. Bar data used for predictions is sourced from public directories and operator-submitted information.

4. Payment Data (Paid Plans and Tools)

Billing for paid plans and tools is handled by Stripe, a PCI-compliant payment processor. When you enter payment information, it is transmitted directly to Stripe — your card number, security code, and full card details are never sent to or stored on our servers. We comply with PCI DSS SAQ-A requirements for businesses that outsource all card processing to a compliant third party.

We retain Stripe-issued identifiers (customer ID, subscription ID, and invoice records) in our database for account management, subscription status tracking, and as required by law.

5. Email Marketing and Your Opt-Out Rights (CAN-SPAM)

Commercial emails we send comply with the CAN-SPAM Act. Specifically:

• Every marketing email includes a clear, working unsubscribe link. Clicking it removes you from our marketing list within ten (10) business days as required by law.
• We honor all opt-out requests promptly. Once you unsubscribe from marketing emails, we will not send you further promotional messages. Transactional emails (billing receipts, security alerts, claim status notifications) are not affected by the marketing unsubscribe and will still be sent as needed to operate your account.
• Our outgoing emails identify WhereToWatchSports as the sender. We do not use deceptive subject lines or misleading “From” addresses.

To unsubscribe from marketing emails at any time, use the “unsubscribe” link in any email we send, or contact us at team@wheretowatchsports.ai.

6. Third-Party Service Providers

We work with the following third-party processors and service providers. Each processes only the data necessary to provide their service to us and is contractually bound to protect your information.

• Supabase — Our database, authentication, and backend hosting provider. Stores operator account data, bar listing information, and anonymous analytics. Based in the United States. Privacy policy: supabase.com/privacy
• Stripe — Payment processing for operator subscriptions. Receives billing information directly from you; we never see your full card details. Privacy policy: stripe.com/privacy
• Vercel — Web hosting and edge delivery. Processes request data (IP addresses, user agents, request headers) to serve the application. Privacy policy: vercel.com/legal/privacy-policy
• Vercel BotID — bot protection on bar photo, hours and rating requests. Runs a script in your browser and receives your IP address and browser signals.
• PostHog — Product analytics. Runs in a cookieless, anonymous configuration: no persistent cross-session cookie (only a same-browser localStorage identifier), IP addresses are masked, and session recording is disabled. Fans are never identified by name, email, or account — only logged-in bar operators may be identified. Privacy policy: posthog.com/privacy
• Google Analytics 4 (GA4) — Traffic and acquisition analytics. Runs with Consent Mode v2 and analytics storage denied by default, so GA4 receives cookieless, modeled pings rather than a persistent tracking cookie; Google Signals (cross-device/ads linking) is not enabled. If your browser sends a Global Privacy Control signal, we don’t load Google Analytics at all. Our app never loads Google Analytics. Privacy policy: policies.google.com/privacy
• Mapbox — Geocoding and map display. When you type a location into the search bar, your query is sent to Mapbox to convert it to coordinates. Mapbox may retain query logs subject to its own privacy policy. Privacy policy: mapbox.com/legal/privacy
• Resend — Transactional and marketing email delivery. Receives your email address when we send you messages on your behalf. Privacy policy: resend.com/legal/privacy-policy
• Google (Places API) — Bar information, photos, and business details. We retrieve publicly available bar data from Google Places. Fan location data is not shared with Google through our use of this service. Privacy policy: policies.google.com/privacy
• Anthropic — infrastructure used for our “Likely” prediction layer and bar description generation. Bar attribute data (not personal fan data) is processed to generate predictions and text summaries. Privacy policy: anthropic.com/legal/privacy
• Firebase Cloud Messaging (Google) — planned for push notifications once our mobile app ships. Will receive a device token and the alert text once in use.
• Upstash — rate limiting on our forms and sign-in flows. Receives a one-way code derived from your IP address.
• Cloudflare Turnstile — bot protection on sign-in, sign-up, password reset and bar claims. Receives your IP address and browser signals.
• Inngest — runs background jobs. Receives the job data needed to run them.
• Sentry — error monitoring. Receives technical error details, which can include your IP address and account ID.

Organizations, Groups, and Other Notices

These notices cover data practices tied to specific features. They apply once the related feature is live on your account.

Organizations and teams

If you attach your bar to an organization, the organization’s owner and managers can see and edit your bar’s WhereToWatchSports settings and receive operational emails about it. Read-only members can see it. With your updated consent, they can also see paid-tool data (such as Insights, Promotions, the Marketing Calendar, and later tools like reviews, social posts and connected-account analytics). We never show one person’s email address to another.

Groups

If you run a group, we store your email, your acceptance of the Group Terms, and any verification documents (deleted 30 days after our decision). Written authorizations from a team, league or university are kept while the group is official and for one year after. Group names and the bars they list are public.

Reports

If you report a listing or a group, we store your report and a one-way code derived from your IP address for abuse prevention. The code is removed 30 days after we resolve the report, or after 180 days if it is never resolved.

Push notifications

Delivered through Google’s Firebase Cloud Messaging, which receives a device token and the alert text.

Your approximate area

We use the city-level location your connection provides (through our host, Vercel) to show nearby bars. It is not stored.

7. Cookies and Browser Storage

We use a small number of cookies and browser storage mechanisms to operate the service:

• Geolocation session cookie: When you activate the “near me” distance filter, we store your GPS coordinates in an httpOnly, Secure cookie that expires automatically after one hour. This cookie is read server-side only — it is not accessible to JavaScript running in the page.
• Timezone cookie: We store your IANA timezone string (e.g., “America/New_York”) in a browser cookie so game times display correctly in your local time across visits. No personal information is contained in this value.
• Supabase authentication cookie: For logged-in operators, Supabase sets session cookies to maintain your authenticated state. These cookies are required to use the operator dashboard and are removed when you sign out.
• Anonymous session token: A random identifier (not linked to any personal information) is used to associate usage events (searches and bar clicks) within a single browsing session for analytics purposes. This token does not persist across browser restarts unless you are a logged-in operator.

We do not use advertising cookies, third-party tracking pixels, or cross-site behavioral tracking cookies. Most browsers allow you to refuse or delete cookies through your browser settings. Note that disabling cookies may affect the “near me” filter and timezone-correct game times.

8. Data Retention

• Geolocation cookie: Expires automatically after one hour. Not stored in our database.
• Fan email addresses: Retained until you unsubscribe or request deletion. We remove email addresses from our marketing list promptly upon request.
• Usage data: We keep usage data — including search and click analytics — indefinitely in a form that can’t be linked to a device or browser; the identifying parts (the anonymous session token, exact coordinates, and IP-derived values) are removed after 13 months.
• Privacy requests: We keep a privacy request for 24 months after we respond to it; a request that is never verified is deleted 7 days after we receive it.

What we delete and keep when you delete your account: We delete your account data right away. We keep invoices for paid tools as tax law requires, a record that your email opted out of marketing email so we never email you again, and security audit records with your name and email removed. Deleted data may persist in encrypted backups for a limited period before being permanently removed.

[Lawyer and accountant: confirm these periods, including the backup retention window once it is confirmed with the infrastructure team.]

9. Security

We implement technical and organizational measures to protect your information, including:

• Transport Layer Security (TLS / HTTPS) for all data in transit.
• Row-level security (RLS) policies in our database that restrict access so operators can only access their own bar’s data.
• httpOnly and Secure cookie flags for sensitive session data so it cannot be read by client-side scripts.
• No storage of raw payment card data on our servers — all payment processing is delegated to Stripe under PCI DSS SAQ-A.
• Passwords are hashed using industry-standard methods by Supabase Auth — we do not have access to your plaintext password.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we take the steps described above to protect your information.

10. Your Privacy Rights

You can ask to see, correct or delete the personal information we hold about you, or tell us not to sell or share it, at wheretowatchsports.ai/privacy/requests or by emailing team@wheretowatchsports.ai. We confirm the request through a link sent to your email, answer within 45 days (we may extend once by up to 45 more days and will tell you why), accept requests from someone you authorize if you confirm that permission with us, and never treat you differently for using these rights. If we deny a request, you can appeal using the link in our reply, and we answer appeals within 45 days. We do not sell your personal information.

• Access: You may request a copy of the personal information we hold about you.
• Correction: If any information we hold about you is inaccurate, you may request that we correct it. Operators can also update most listing information directly through the operator dashboard.
• Deletion: You may request that we delete your personal information. We will honor deletion requests subject to our legal obligations and the limitations of anonymized aggregate data that cannot be associated back to you.
• Opt-out of marketing: You may unsubscribe from marketing emails at any time — see Section 5.
• Data portability: Operator account holders may request an export of their bar listing and account data.

We may need to verify your identity before fulfilling a request to protect against unauthorized access to your data.

[Lawyer: confirm which state laws apply, the Sale/Share statement, response windows and appeal duties.]

11. Children’s Privacy

WhereToWatchSports accounts are for adults 18 and older, and the Service is not directed to children. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at team@wheretowatchsports.ai.

12. When We Disclose Your Information

We do not sell your personal information. We disclose information only in the following circumstances:

• Service providers: To the third-party processors listed in Section 6, solely for the purpose of providing their services to us.
• Organization and group owners and managers: To the owners and managers of an organization or group you join, as described above.
• Legal requirements: When required by law, regulation, legal process, or governmental request (for example, a valid subpoena or court order).
• Protection of rights and safety: To protect the rights, property, or safety of WhereToWatchSports, our users, or others when we have a good-faith belief that disclosure is necessary.
• Business transfer: In connection with a merger, acquisition, or sale of all or a portion of our assets, in which case we will provide notice before personal information is transferred and becomes subject to a different privacy policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, provide additional notice (such as an in-app notification or email to registered operators). Your continued use of WhereToWatchSports after any changes become effective constitutes your acceptance of the updated policy.

We encourage you to review this page periodically to stay informed about how we handle your information.

14. How to Contact Us

For privacy questions, requests to access or delete your data, or to report a concern, please contact us: