Website Privacy Policy
Last updated: June 2026
This policy describes how SplitWinner LLC ("SplitWinner", "we", "us", "our") collects, uses, and protects your data on splitwinner.com — our marketing website and developer portal.
It does not cover the SplitWinner mobile app (see the App Privacy Policy) or the SplitWinner API (see the API Privacy Policy).
We are based in the State of Texas, United States.
1. The minimum, by design
We collect the minimum data needed to run the site, send the newsletter (if you sign up), authenticate developer-portal users (if you sign up), and keep the site working. We do not run ads, retargeting, cross-site tracking, fingerprinting, or behavioral profiling. We do not sell or share personal information.
2. Data we collect on the marketing site
Newsletter signup
If you submit the newsletter form, we collect:
- Your email address
- A honeypot field (
company); discarded if filled, used only to detect bots
Submissions are sent to Listmonk, our self-hosted mailing-list manager. Outbound email is delivered via Resend as our SMTP provider. We do not enrich your email with any other data. We send marketing and product updates — not paid Daily Prediction drops.
You can unsubscribe at any time via the one-click link in any newsletter email.
Automatic analytics
The marketing site uses two Vercel services for aggregate measurement:
- Vercel Analytics — page views, navigation events, country and device class. No personal identifiers, no advertising IDs, no cross-site tracking.
- Vercel Speed Insights — web-vitals measurements (LCP, CLS, INP) used for performance tuning.
Error reporting
If a client-side error occurs while you are using the site, the Sentry browser SDK may send a sampled error trace (currently 10% of errors). Sentry receives the stack trace and minimal context. We do not capture request or response bodies. Session Replay is off.
Bot protection
The newsletter signup form uses Vercel BotID to detect automated submissions. BotID checks happen at the form-submit level and do not persist data beyond the validation result.
Browser storage
The marketing site uses localStorage to remember your theme preference (light or dark). See the Cookie Policy for the full list.
3. Data we collect on the developer portal
The developer portal (splitwinner.com/developers) is for B2B customers integrating with the SplitWinner API. Sign-in is required.
Authentication
We use Supabase Auth for sign-in. You may sign up with:
- Email and password (Supabase hashes the password; we never see it)
- Sign in with Apple or Google (we receive only the auth token; the OAuth provider holds your credentials)
We store your account identifier and (where shared) your email address.
Enterprise application form
If you apply for an enterprise tier API account, we collect:
- Company name
- Applicant name and title
- Website URL
- Use case description
- Target jurisdictions
- Contact email and phone
- Budget range
- Timeline
This information is used to evaluate the application, sign the appropriate Master Services Agreement, and provision the customer record.
API keys and usage metadata
We mint API keys you can use against api.splitwinner.com. We store:
- The first 16 characters of the key (for identification in the dashboard)
- A SHA-256 hash of the full key (for authentication and revocation)
- Optional restrictions you set (CIDR allowlist, expiration date)
- Usage events — request counts and metering, per key
We never store the raw key value. It is shown once at creation; after that, only you have it.
Brief operational cookies
Two short-lived cookies are set during specific dashboard actions:
dev_portal_raw_key— shows a freshly minted API key in the dashboard once, then is cleared (60 seconds)dev_portal_apply_error— flashes an error after a failed application submission (30 seconds)
4. What we do NOT collect
- No advertising identifiers, no cross-site tracking, no retargeting
- No precise geolocation
- No device or browser fingerprinting
- No contacts, photos, files, or microphone/camera access
- No payment-card data on this site (enterprise customers invoice; the marketing site does not handle payments)
5. Processors and subprocessors
| Service | Purpose | What they receive |
|---|---|---|
| Vercel | Hosting, CDN, Analytics, Speed Insights | Marketing site requests; aggregate analytics |
| Supabase | Authentication and database for the developer portal | Account identifier, email, application data, key metadata |
| Listmonk (self-hosted) | Newsletter list management | Your email if you subscribe |
| Resend | SMTP delivery for Listmonk-sent email | Email envelopes for outbound newsletter mail |
| Sentry | Error reporting (browser + server) | Stack traces; no request/response bodies |
| Vercel BotID | Bot detection on newsletter form | Form submission metadata |
We share only the minimum data necessary for each service to function. Each subprocessor operates under its own privacy policy.
6. How we use your data
- Operate the marketing site and developer portal
- Send the newsletter (if you signed up) and operational/account email (if you have an account)
- Mint, restrict, and revoke API keys you create
- Evaluate enterprise applications and provision customer records
- Detect and prevent abuse, fraud, and bot activity
- Comply with applicable law
We do not use your data for advertising, profiling, or any cross-context behavioral purpose.
7. Retention
| Category | Retention |
|---|---|
| Newsletter subscribers | Until you unsubscribe; bounced addresses removed automatically |
| Developer-portal accounts | While the account is active; deletable on request |
| API keys | Until you revoke them; revoked keys retained for audit |
| Application form data | While the application is active and for a reasonable period after to support audit and contract |
| Vercel Analytics | Per Vercel's defaults |
| Sentry errors | Per project retention |
| Supabase auth records | Per Supabase's defaults until account deletion |
Account deletion is available on request to support@splitwinner.com. We will delete or anonymize your account-related data within 30 days, except where retention is required by law.
8. Security
- All site and API traffic is encrypted via TLS.
- Passwords are hashed by Supabase; we never see them.
- API keys are stored as SHA-256 hashes; raw values are never persisted.
- Two short-lived cookies (60 s and 30 s) are used for specific dashboard interactions and cleared automatically.
- Subprocessors are operated under their own security standards.
If you discover a security issue, please report it via our Security Disclosure.
9. Breach notification
If we confirm a breach that compromises your personal information, we will notify affected users via email (where available) within 72 hours of confirmation, unless law enforcement requests a delay. We will describe the nature of the breach, the data affected, and recommended next steps.
10. Your rights
You may at any time:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Port your data in a machine-readable format
- Unsubscribe from the newsletter (one-click in any email)
To exercise any of these, email legal@splitwinner.com or support@splitwinner.com. We will verify your identity and respond within 30 days.
11. California privacy rights (CCPA / CPRA)
If you are a California resident, you have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
The categories of personal information we collect on this site are: identifiers (email, account ID), commercial information (enterprise application details), and Internet/app activity (page views, error logs). We do not collect biometric, geolocation, or sensitive personal information.
To exercise CCPA rights, email legal@splitwinner.com.
12. Other state privacy rights
If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you may have additional rights including access, correction, deletion, data portability, and the right to opt out of targeted advertising (we do not target ads) and the sale of personal data (we do not sell).
13. International users
splitwinner.com is operated from and intended for users in the United States. We do not target, market to, or solicit users outside the United States. If you use the site from outside the United States, you do so at your own initiative and consent to the transfer, processing, and storage of your data in the United States.
14. Children's privacy
This site is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us at legal@splitwinner.com.
15. Changes to this policy
We may update this policy. Material changes will be noted with an updated "Last updated" date at the top.
16. Contact
- Privacy questions: legal@splitwinner.com
- General support: support@splitwinner.com
- Security: security@splitwinner.com