Privacy Policy

Version 2026-11-03 · Effective November 3, 2026 · [Coconuts LLC]

1. What we collect

• Account: from your sign-in provider (Google, and later Apple or Facebook), your email address and account ID. In our own database we keep only your first name (for your greeting; you can change it in Settings), never your last name. Your sign-in record at our authentication provider may hold the name and photo your provider shares; it is deleted with your account.
• Eligibility: that you confirmed you are 21 or older, and your state. We check your date of birth once to confirm your age but do not store it.
• Agreement records: the version of these policies and the Terms you accepted, when, and the IP address you accepted from (at signup, at checkout, and when a new version is accepted).
• Settings: the books you use, your default bankroll figure (used only for stake-split arithmetic and units) and its change history, and alert preferences.
• Waitlist and referrals: your email, when you agreed to be contacted, whether you confirmed it, the state and books you chose to tell us (optional), your referral code and how many friends confirmed with it.
• App invites: your invite code, who invited you (if anyone), and counts of friends who signed up or started Pro with your link, so we can apply the free month to both of you. We never show your friends' names or emails to you.
• Alert history: which LOCK alerts matched your rules, when, and whether we sent them (push, email or why not). Visible only to you; deleted with your account.
• Devices: if you turn on push alerts, a push token for that browser or device.
• Billing: from Stripe, your customer ID, plan, status, renewal dates and whether a trial or founding code was used. Payments are handled by Stripe (and Link, where shown); we never receive your full card number.
• Bet tracker (sensitive): the bets you choose to enter or import: book, sport, event, market, side, odds, stake, date, result, cash-out amount, tags and notes, plus, for bets you add from a Coconuts card, the closing line for that bet. We treat betting history as sensitive personal information. It is stored only under your account, readable only by you (enforced by our database rules), never used for analytics, advertising or profiling, and never shared or sold.
• Responsible-gaming settings: a cool-off or self-exclusion end date.
• Analytics (cookieless): daily totals of page views, waitlist sign-ups and which site referred visitors. No cookies, no IP addresses stored, nothing that identifies you.
• Security logs: our hosting providers process IP addresses and request data briefly to deliver and protect the Service (for example rate limits and abuse prevention).
• Emails you send us.

2. Why we use it (and legal bases)

• To provide the Service and your account (performance of our contract with you), including computing your bet tracker statistics on your device.
• To check eligibility and comply with law, including age limits, state restrictions, tax and payment records (legal obligation and legitimate interests).
• To bill you, send required notices such as trial-ending and renewal reminders, and send alerts you asked for (contract).
• To send waitlist and launch emails you agreed to (consent, which you can withdraw any time).
• To keep the Service secure, prevent abuse and enforce our Terms (legitimate interests).
• To understand aggregate usage through cookieless counts (legitimate interests).

3. Who we share it with

We share personal information only with service providers that process it for us under contract:

• Google (Firebase and Google Cloud): sign-in, database, hosting, functions, push notifications.
• Stripe: payments, subscriptions and the billing portal.
• Brevo: transactional and waitlist email.
• Google reCAPTCHA Enterprise (Firebase App Check): bot protection on forms and the app.

We also share information if the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy still applies. We do not sell personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We don't use third-party advertising cookies.

4. How long we keep it

• Account, settings and agreement records: while your account is open. They are deleted when you delete your account, except as below.
• Billing records: Stripe keeps payment and tax records as the law requires, typically up to 7 years. We delete our copy of your Stripe customer link when you delete your account.
• Waitlist: until launch plus 12 months, or until you unsubscribe or ask us to delete it.
• Self-exclusion: if you self-exclude and then delete your account, we keep only a one-way hash of your email and the end date, so the exclusion still applies if you sign up again.
• Deletion log: a one-way hash of your account ID and the date it was deleted, as proof we honored the request.
• Bet tracker: until you delete a bet or your account. "Delete my account" deletes your whole bet history.
• Cookieless analytics: daily totals, kept indefinitely (they identify no one). They never include anything about your bets.

5. Your rights and choices

Depending on where you live (including California under the CCPA/CPRA, and states such as Colorado, Connecticut, Virginia, Texas, Oregon and others), you may have the right to access, correct, delete or port your personal information, and to opt out of sale, sharing for targeted advertising, and profiling. We honor these rights for every user, wherever you live.

• Delete: use Settings → Delete my account (below), or email us.
• Access, correct, export: most of your data is visible and editable in Settings. Your bet tracker has "Export my bets" (CSV). For a full copy of everything, email hello@coconutsedge.com from your account email.
• Emails: every marketing or waitlist email has an unsubscribe link. Required account notices (such as renewal reminders) continue while you have a subscription.
• Push alerts: turn them off in Settings or in your browser.
• We respond within 45 days and won't discriminate against you for using your rights. You may use an authorized agent, and you can appeal a decision by replying to our response.

6. Delete my account

In the app, go to Settings → Delete my account and type DELETE. This immediately:

1. cancels any subscription and deletes your Stripe customer record (Stripe keeps payment records it must keep by law);
2. deletes your Coconuts profile, settings, agreement records, your entire bet tracker history, push tokens, your invite code, and your waitlist entry and referral code;
3. deletes your sign-in account.

It can't be undone. If you can't sign in, email hello@coconutsedge.com from your account email and we'll do it for you.

7. Age limit

Coconuts is only for people 21 and older. We do not knowingly collect personal information from anyone under 21. If we learn we have, we delete it.

8. Security

We use encryption in transit (HTTPS with HSTS), least-privilege access, server-side access rules, bot protection, secrets kept in a managed secret store, and logging. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires, without undue delay.

9. Where data is processed

We operate in the United States and process data in the US. If you use the Service from elsewhere, your information is transferred to and processed in the US.

10. Changes and contact

We'll post changes here with a new version and effective date. For material changes we'll notify you and ask you to accept the new version. Questions or requests: [Coconuts LLC], hello@coconutsedge.com. [Mailing address — to be added before launch.]