Privacy Policy

Last updated: June 15, 2026

1. Overview

SplitWinner ("we", "us", "our") is a mobile sports-analytics app operated by SplitWinner. This policy explains how we collect, use, store, and protect your data — with particular focus on our AI feature, our Kalshi helper, and our billing.

By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein.

2. Legal Basis for Processing

We process your personal data on the following legal bases:

Contractual necessity — processing required to provide the services you signed up for (account management, predictions, AI chat, billing)
Consent — where you have explicitly opted in (e.g., sending messages to SplitWinnerGPT™)
Legitimate interests — security, fraud prevention, service improvement, and enforcing our Terms of Service
Legal compliance — where required by applicable law

3. Data We Collect

3.1 Account Data

You sign in with Apple ("Sign in with Apple"). We collect and store:

A Supabase account identifier (UUID) linked to your Apple sign-in
Your email address, only if Apple chooses to share it (you may use Apple's "Hide My Email"); it may be a private relay address
A signup timestamp
Your in-app preferences (such as theme, sport filters, and notification settings)

We do not collect a phone number, a password, or a public display name.

3.2 Billing and Entitlement Data

Purchases are made through the Apple App Store and managed via RevenueCat. We collect and store:

A RevenueCat / Apple transaction identifier
The product purchased (the Daily Pass or Weekly Pass) and your entitlement status (whether you have an active pass and when it expires)
Billing event records (event type, amount, currency, source, transaction identifier, timestamp, and the raw event payload from RevenueCat)

If you redeem a promotional code via Settings → Redeem Code, we additionally log the code identifier, the granted pass type (Daily-equivalent or Weekly-equivalent), the time of redemption, and the granted access window. This log lives in our promo_redemptions table and is used only for fraud prevention, affiliate accounting, and operational ledger purposes; it is never shared for advertising or sold.

We do not collect or store your payment-card number, bank-account details, or billing address. All payment information is handled directly by Apple. Apple's and RevenueCat's handling of your data is governed by their respective privacy policies.

3.3 Kalshi Credentials — Stored Only on Your Device

If you use the Kalshi helper, you provide your Kalshi API Key ID and RSA private key. These are stored only on your device, in the operating system's secure keychain/keystore. They are never transmitted to, received by, or stored on our servers. We cannot read them. All requests to Kalshi are made directly from your device, signed locally with your key. You can delete them from your device at any time.

3.4 Trading Activity Data

Because your Kalshi credentials never leave your device, your Kalshi portfolio and any orders you place are fetched and sent directly between your device and Kalshi. We do not store your Kalshi positions, orders, fills, settlements, or trade history on our servers.

3.5 SplitWinnerGPT™ Data

When you use SplitWinnerGPT™, your messages are sent to Anthropic's API to generate a response. We do not persist your chat conversations on our servers — see Section 6.

3.6 Usage and Analytics Data

We use product analytics and crash reporting to understand how the App is used and to fix problems:

PostHog — records in-app events and screen views (for example: viewing the daily sheet, opening a pick, changing a sport or timeframe filter, viewing insights or metrics, sending a chat message, opening the Kalshi tab) along with a coarse free/pro tier trait. We do not use this for advertising or cross-app tracking.
Sentry — records crashes and errors, with breadcrumbs (such as which API endpoint was called and the response status). Request and response bodies are not captured, and screenshots are disabled in release builds.

We do not perform device fingerprinting, IP-based geolocation tracking, impossible-travel detection, or content moderation in the App.

3.7 Security and Rate-Limiting Data

Our API enforces rate limits to prevent abuse. Transient request metadata may be processed to apply those limits. These controls are used solely to protect the service.

3.8 On-Device Storage

Your session token and Kalshi credentials are stored in the OS secure keychain/keystore
Your preferences (such as theme and filters) are stored in the app's local storage on your device

See our Cookie Policy for full details on on-device storage.

4. How We Use Your Data

Provide and operate the App, including predictions, insights, metrics, and the AI assistant
Process SplitWinnerGPT™ messages via Claude
Verify and unlock your Daily Prediction pass via Apple and RevenueCat
Understand product usage and fix crashes and errors
Prevent abuse of our API and enforce rate limits
Enforce our Terms of Service
Communicate important updates about the App

5. SplitWinnerGPT™ — How Your Data Is Handled

SplitWinnerGPT is powered by Claude. When you send a message to SplitWinnerGPT:

Your messages are sent to Anthropic's API for processing, along with recent messages from your current conversation for context. Anthropic retains API data for a limited period for safety monitoring, then deletes it.
Anthropic does not use API data to train its models. This is Anthropic's standing policy for API customers.
We do not sell, share, or distribute your chat conversations to any third party beyond what is necessary to provide the service.
Prediction context (current game data and model outputs) is included with messages to provide relevant analysis. No payment or credential data is sent to the AI.
Chat history is not persisted on our servers. Your conversation lives in your app session.

6. Kalshi Credential Security

Your Kalshi API Key ID and RSA private key are stored only on your device, in the operating system's secure keychain/keystore, and are never transmitted to our servers. Because we never receive them, we cannot access your Kalshi account. All Kalshi requests are signed locally on your device. You are responsible for the security of your device and your Kalshi account, including enabling two-factor authentication on Kalshi and rotating your API credentials periodically. You can remove your stored credentials from the App at any time.

7. Third-Party Services

Service	Purpose	Data Shared
Claude (Anthropic)	SplitWinnerGPT™ responses	Chat messages and prediction context for the current conversation
Kalshi	Prediction-market trading (direct from your device)	Your API requests, signed on-device with your own key — not shared by us
Supabase	Authentication and database	Account identifier, preferences, billing/entitlement records
Apple	Sign in with Apple, App Store payments	Apple sign-in token; purchase transactions (handled by Apple)
RevenueCat	In-app-purchase entitlement management	Transaction identifiers, product and entitlement status
Sentry	Crash and error reporting	Error stack traces, app/device info, breadcrumbs (no request/response bodies; no screenshots in release)
PostHog	Product analytics	In-app events, screen views, coarse free/pro tier trait

Each third-party service is governed by its own privacy policy. We share only the minimum data necessary for each service to perform its function.

8. Data We Do NOT Collect or Share

We do not collect a phone number, password, or public display name
We do not collect biometric data
We do not collect precise GPS location
We do not perform device fingerprinting or IP-based geolocation tracking
We do not access your contacts, photos, or files
We do not receive or store your Kalshi credentials, positions, or trade history
We do not store your payment-card number, bank-account details, or billing address
We do not sell your personal information to any third party
We do not share your personal information for cross-context behavioral advertising
We do not use advertising, retargeting, or cross-app tracking

9. Data Retention

We retain data for the minimum period necessary to provide our services, comply with legal obligations, and maintain security.

Account data: retained as long as your account is active
Billing and entitlement records: retained as long as your account is active and for a reasonable period thereafter as required for accounting, tax, and legal purposes
SplitWinnerGPT™ conversations: not persisted on our servers
Kalshi credentials and trading data: stored only on your device; never on our servers
Analytics events (PostHog): retained per PostHog's data-retention configuration
Crash/error logs (Sentry): retained per Sentry's data-retention policy
Claude API data: retained for a limited period by Anthropic, then deleted

Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law, necessary for fraud prevention, or needed to resolve disputes. Aggregate, anonymized data that cannot identify you may be retained indefinitely.

10. Automated Decision-Making

The App does not make automated decisions that produce legal or similarly significant effects about you. Our API may automatically rate-limit requests to prevent abuse. If you believe an automated action was taken on your account in error, you may contact support@splitwinner.com for human review.

11. Data Security

All data in transit is encrypted via TLS/HTTPS
Authentication is handled by Supabase using Sign in with Apple
Your session token and Kalshi credentials are stored in your device's secure keychain/keystore and never sent to our servers
Sentry is configured not to capture request/response bodies, and screenshots are disabled in release builds
Our API enforces request signing and rate limiting to prevent abuse

While we implement industry-standard security measures, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

12. Data Breach Notification

In the event of a data breach that compromises your personal information, we will investigate and contain the breach, notify affected users via email (if available) and/or in-app notification within 72 hours of confirming the breach (unless law enforcement requests a delay), describe the nature of the breach and the data affected, notify applicable regulatory authorities as required by law, and provide recommendations for protecting yourself.

Because your Kalshi credentials are stored only on your device and never reach our servers, a breach of our systems cannot expose them.

13. Your Rights

Regardless of your location, you have the following rights regarding your personal data:

Access — request information about what personal data we hold about you, including a copy
Deletion — request deletion of your account and all associated data
Correction — request correction of inaccurate personal information
Data portability — request a copy of your personal data in a structured, commonly used, machine-readable format
Opt out of features — use SplitWinner without SplitWinnerGPT™ or the Kalshi helper
Object to processing — object to specific processing activities based on our legitimate interests
Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email support@splitwinner.com. We will verify your identity and respond to verified requests within 30 days.

14. Account Deletion

You may request deletion of your account and all associated personal data by emailing support@splitwinner.com from the email associated with your account, or via the in-app account-deletion option where available. Upon verification, we will:

Delete your user profile and account preferences
Delete your entitlement records
Remove your authentication record from Supabase Auth

Your Kalshi credentials and trading data are stored only on your device; uninstalling the App or clearing its storage removes them. Account deletion is permanent and irreversible. The following data may be retained: billing records required for accounting, tax, or legal purposes; anonymized or aggregated data; and data required by law. Third-party services (Apple, RevenueCat, Anthropic, Sentry, PostHog) retain data according to their own policies.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:

Right to know — request the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it
Right to delete — request deletion of your personal information, subject to certain exceptions
Right to correct — request correction of inaccurate personal information
Right to opt out of sale/sharing — We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise your rights, email support@splitwinner.com. We will verify your identity before processing your request and respond within 45 days (extendable by an additional 45 days with notice).

Categories of Personal Information Collected (CCPA Disclosure)

Category	Examples	Collected
Identifiers	Account identifier, email (if shared by Apple)	Yes
Commercial information	Daily Prediction pass purchases, entitlement status	Yes
Internet/app activity	In-app events, screen views, crash/error logs	Yes
Geolocation data	—	No
Biometric information	—	No
Sensitive personal information	—	No

16. Additional State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you may have additional rights including the right to access, correct, and delete your personal data, the right to data portability, the right to opt out of targeted advertising (we do not engage in targeted advertising), the right to opt out of profiling, the right to opt out of the sale of personal data (we do not sell your personal data), and the right to appeal a denial of your privacy request.

To exercise any of these rights, email support@splitwinner.com. If we deny your request, you may appeal by replying to our response.

17. International Users

SplitWinner is operated from and intended for users in the United States. The App, all data processing, and all services are governed exclusively by the laws of the United States and the State of Texas. We do not target, market to, or solicit users outside the United States. If you use the App from outside the United States, you do so at your own initiative and consent to the transfer, processing, and storage of your data in the United States under U.S. law.

18. Children's Privacy

SplitWinner is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us at support@splitwinner.com.

19. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be communicated via the App or by email, and we will update the "Last updated" date at the top of this page. Continued use of the App after changes are posted constitutes acceptance of the updated policy.

20. Contact

For privacy questions, data requests, or to exercise any of your rights, contact us at support@splitwinner.com.