Privacy
Effective 2026-09-28.
Short version: we collect the minimum needed to run a sports product responsibly, we don't sell what we collect, and we never combine identifiable data with the proprietary Knox training signal.
What we collect
- Account data: email, display name, password hash (we never store passwords in plaintext), preferences.
- Usage data: pages viewed, queries asked, picks made, feedback given. Tied to your account when you're signed in, anonymized when you're not.
- Device data: IP address (used for rate limiting and regional routing), user-agent string, the high-level browser/OS family.
- Server logs: timestamp, route, response status, duration. IP and user id are stripped after 30 days.
What we don't collect
- We don't collect biometric data, precise location data, contacts, calendar, or health data.
- We don't fingerprint your browser beyond what's necessary for rate limiting and security.
- We don't track you across other websites. We don't run third-party ad networks on the product surface.
How the data flows
- Account + usage data is stored in our private operational database.
- Anonymous Knox query patterns feed our trust calibration so the product improves over time. This signal is aggregated and never tied back to your identity.
- We use these processors, each under a data-processing agreement: Hetzner (hosting), Stripe (payments; we never see your full card number), Postmark (account and notification email) and PostHog (product analytics, without advertising identifiers). We don't sell your data or share it with anyone for marketing.
Cookies
We use cookies for session authentication and (with consent) light analytics. You can disable cookies in your browser; the signed-in experience won't work without the session cookie.
Your rights
Depending on where you live, you have the right to access, correct, delete, or export your account data. Email privacy@statvault.org and we will respond within 30 days. If we already have a deletion path in-product (settings → delete account) we will point you there.
Children
StatVault is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has registered with us, email privacy@statvault.org and we will delete the account.
Changes
Substantive changes are versioned and announced on the StatVault changelog. Continued use after a change constitutes acceptance.
Contact
privacy@statvault.org.
Version 2026-09-28. Earlier versions are listed on the changelog.