1. Information We Collect

1.1 Information You Provide

• Email address
• Username
• Password (hashed and salted; we never store plaintext passwords)
• Profile information (bio, avatar, social media links, affiliations, custom links)
• Account type preferences (standard or creator)
• Payment information (processed by Stripe; we do not store full card details)

1.2 Content You Create

When you use Sports Index, you may create and upload content including:

• Collections, timelines, and pages
• Text, images, videos, and other media files
• Data tables, datasets, charts, and statistical visualizations
• Tags, topic associations, and metadata
• Topic page contributions and editorial content

This content may contain personal data depending on what you include.

1.3 Automatically Collected Information

• IP address (hashed for unique viewer counts; raw IP not stored long-term)
• Device and browser information
• Usage analytics (page views, clicks, time on platform)
• Cookies and session tokens
• View and engagement statistics for content you create

1.4 Third-Party Authentication

If you use third-party login services (e.g., Google OAuth), we may collect identifiers provided by that service, such as your name, email address, and profile picture.

2. How We Use Information

We use your information to:

• Operate, maintain, and improve Sports Index
• Authenticate users and manage account security
• Display your content on topic pages, portfolios, discovery feeds, and collection views
• Power content discovery, search, and recommendations
• Generate semantic embeddings of content to improve search relevance and content organization
• Auto-categorize content using our tag scoring engine
• Calculate and display leaderboards, contributor rankings, and content statistics
• Process payments and manage subscriptions
• Prevent abuse, fraud, and policy violations
• Send transactional emails (verification, password reset, welcome)
• Send service announcements and policy updates

3. How We Share Information

We do not sell your personal information.

We may share data with the following service providers who assist us in operating the platform:

• Hosting and Infrastructure: Railway (application hosting), Amazon Web Services (cloud storage for uploaded media)
• Email: SendGrid (transactional emails)
• Payments: Stripe (payment processing)
• AI Services: OpenAI (semantic embedding generation for content search and organization; content text is sent to OpenAI's API for processing)
• Legal authorities (if required by law, subpoena, or court order)

Content you publish on Sports Index is public by default. This includes collections, timelines, topic page contributions, and portfolio content. Your username and profile information are visible to other users.

4. Third-Party Embeds

Sports Index allows embedding content from third-party platforms including X/Twitter, YouTube, Instagram, TikTok, ESPN, and Substack. When these embeds load on a page you visit:

• The third-party platform may set cookies and collect data according to their own privacy policies
• Your browser connects directly to the third-party platform's servers to load the embed
• We do not control what data these platforms collect

We encourage you to review the privacy policies of platforms whose content you interact with on Sports Index.

5. Cookies

We use cookies for:

• Authentication: JWT tokens to keep you logged in
• Session management: Maintaining your session state
• Preferences: Remembering your theme (light/dark mode) and display settings
• Analytics: Understanding how the platform is used to improve the experience

Third-party embeds may set additional cookies as described in Section 4.

6. Data Retention

• Account information is retained until you request deletion.
• Uploaded media files are stored in cloud storage until you delete them or your account.
• Backup copies may persist for up to 90 days after deletion.
• Semantic embeddings generated from your content are deleted when the source content is deleted.
• Content you contributed to topic pages may persist if other users have also tagged or contributed that content.
• Anonymized, aggregated analytics data may be retained indefinitely.

7. Data Security

We use reasonable technical and organizational measures to secure your data, including:

• Password hashing with bcrypt
• Encrypted data transmission (HTTPS)
• Database connection pooling with health checks
• Secure cloud storage for uploaded files

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Children's Privacy

The Service is not intended for users under 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly.

9. Your Rights

Depending on your location and applicable law, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information
• Data portability: Request your data in a portable format

To exercise these rights, contact us at ben@sportsindex.io. We may verify your identity before processing requests. We may refuse requests that are unreasonable, repetitive, or technically impractical.

10. Account Deletion

If you delete your account:

• Your profile information, email, and account credentials are permanently removed
• Collections, timelines, and pages you created are removed
• Uploaded media files are deleted from cloud storage
• Content you contributed to shared topic pages may persist if other users have also associated that content
• Semantic embeddings of your content are deleted
• Backup copies may persist for up to 90 days

11. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, contact us at ben@sportsindex.io. We will verify your identity before processing requests.

12. Do Not Track Signals

Some browsers transmit "Do Not Track" signals. We currently do not respond to DNT signals, as there is no industry standard for compliance. We will update this policy if a standard is established.

13. Changes to This Policy

We may update this Privacy Policy at any time. We will notify you of material changes by posting a notice on the platform or sending an email. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy-related questions or to exercise your rights, contact us at:

• Email: ben@sportsindex.io
• X (Twitter): @sportsindexapp