Privacy Policy

This Privacy Policy explains what information Orca DFS LLC ("we," "us") collects through orcadfs.com and the Orca DFS application (the "Service"), and what we do with it.

The Service is operated from the United States and is intended for users in the United States.

• Account information. Email address and a password (stored as a salted hash — we never store or see your actual password), whether you've verified your email, when you accepted our Terms, and short-lived tokens used for email verification and password resets.
• Billing information. Handled directly by Stripe. We store which plan you're on (and, for a 7-day pass, when it ends) and Stripe's own customer/subscription identifiers — never your card number.
• Things you save. Your game picks (your spread and total picks and confidence levels) and saved modifier presets, if you use those features.
• Usage information. Which features you use (e.g. signing up, running the optimizer, saving a modifier preset or a game pick), your subscription tier at the time, and coarse details like which DFS site and slate — used to understand how the product is used, not to build an advertising profile. See "Analytics" below.
• Technical information. IP address and request logs, kept briefly for security purposes (e.g. rate-limiting abusive traffic) and general server logs.

We don't collect payment card numbers, government ID numbers, or precise location.

• To operate the Service — authenticate you, run the optimizer, manage your subscription.
• To communicate with you — email verification, password resets, and account or billing notices.
• To understand and improve the product — which features get used, where people hit plan limits.
• To keep the Service secure — detect and limit abuse.

We don't sell your personal information, and we don't use it for third-party advertising.

We share information only with the service providers that make the Service work:

• Stripe, to process payments and manage subscriptions.
• Hosting providers, to run the backend, database, and background jobs and to host the website's front end.
• An email provider, to send account emails like verification and password resets.
• An error-monitoring service: when something breaks, it receives a report of the error. We don't intentionally send it account details, but a report can include technical details of the failing request, such as the page address and error message.

We don't send your personal information to the sports-data sources the product reads from — those are one-way data sources, not recipients of your data. We disclose information beyond this list only if required by law or to protect the Service and its users from fraud or abuse.

The Service doesn't use advertising or tracking cookies. Your login is a token kept in your browser's local storage, not a cookie; the admin panel uses a single session cookie strictly for admin authentication. If you go to Stripe's hosted checkout, Stripe may set its own cookies there, under its own policies.

We log certain in-product actions — signing up, running the optimizer, saving a modifier preset or a game pick, hitting a plan limit, starting checkout — tied to your account and your subscription tier at the time. This is first-party usage analytics, used to understand how the product is actually used and where people hit plan limits; it's never shared with or sold to third parties, and never used to build an advertising profile.

We don't currently use third-party analytics or advertising trackers (e.g. Google Analytics, ad pixels). The error monitoring described in section 4 isn't used for analytics or advertising. If we add third-party analytics — for example, anonymous traffic/pageview analytics — we'll update this policy first.

We keep your account information for as long as your account is active. If you delete your account (or ask us to — see Contact), we delete your account record and the data tied to it, including your usage history, game picks, and any saved presets. Stripe keeps its own payment records under its own policies, and copies in routine backups and server logs age out on their normal schedule.

• You can ask us to update your account details by emailing us — see Contact.
• You can ask us to delete your account and associated data, or to export the personal information we hold about you, by emailing us — see Contact.
• Depending on where you live, you may have additional privacy rights. Email us to exercise them and we'll respond as the law requires.

The Service isn't directed at anyone under 18, and we don't knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we'll remove it.

Passwords are hashed, not stored in plain text; the Service is served over HTTPS. No method of storage or transmission is perfectly secure, but we take reasonable steps to protect your information.

If we make a material change to this policy, we'll post the update here with a new effective date and email you about it.

Questions about this policy, or a request to access/delete your data: support@orcadfs.com.