Privacy Policy

When you use warpaintdfs.com we collect and store:

• Email address + hashed password — for login. Passwords are hashed with bcrypt; we never see or store the plaintext.
• Stripe customer ID and subscription status — payment card numbers themselves are held only by Stripe.
• DraftKings CSV uploads and generated lineups — retained in your account for the current NFL season so you can resume mid-slate. Deleted 90 days after the Super Bowl.
• Basic request metadata — IP address (for legality-state check + brute-force protection) and User-Agent string. IPs are hashed after 30 days.
• Error telemetry — via Sentry, when the app crashes we send the stack trace + a scrubbed request context. No passwords or Stripe tokens are sent.

• DraftKings login credentials — we never ask for them and could not use them.
• Payment card numbers or CVCs — Stripe handles these exclusively.
• Social security numbers, date of birth beyond birth-year for age gate, or any other US tax/PII data.
• Contents of your emails, texts, phone contacts, or any data outside the WarPaint DFS app.
• Advertising or third-party marketing pixels.

• Authentication cookie / JWT — required to stay logged in. Cannot be disabled without losing access.
• UI preference localStorage — remembers your last-selected slate tab, dark-mode preference, and Turbo Mode toggle. Cleared when you log out.

We do not use Google Analytics, Facebook Pixel, or any cross-site advertising trackers.

• Stripe — email + Stripe customer ID, for billing.
• Resend — email address, for password-reset and transactional emails.
• Sentry — scrubbed stack traces + user_id, for error monitoring.
• Anthropic (Claude) — anonymized slate text + your preset selection, for AI Attack Plan generation. Claude does not retain the data for training under our API contract.

We never share data with DraftKings, FanDuel, or any other DFS operator.

• Export your data — email us and we'll send you a JSON dump of everything we have on you within 30 days.
• Delete your account and data — click "Delete Account" on your billing page (self-service) or email support. We purge within 7 days; anonymized aggregate stats remain.
• Correct inaccurate data — email us.
• Opt out of email — every email has an unsubscribe link. Transactional emails (password reset, billing receipts) cannot be opted out of while your account is active.

• Active accounts: for the life of the account.
• Cancelled subscriptions: 90 days after cancellation, then account marked deletable.
• Deleted accounts: purged within 7 days; Stripe records retained per Stripe's own retention policy.
• Anonymized aggregate stats (e.g., "% of users who ran Turbo Mode last Sunday"): retained indefinitely.