Legal

Privacy policy

Last updated 30 August 2026 · NOVA Labs Holdings, LLC

What we collect

If you never create an account

Nothing that identifies you. Your browser requests pages and data in the ordinary way, and Cloudflare — our hosting provider — processes the request. To show the correct regional broadcast for a game, our server reads the approximate location Cloudflare already derives from your connection (country, region, city and timezone). That value is used to answer your request and is not stored, not logged to a database, and not attached to any profile.

If you create an account

• Email address. Used to identify your account, sign you in, and keep paid access in sync across the web, iOS and Android.
• Password. Stored only as a PBKDF2-HMAC-SHA256 hash with a per-account random salt. We never store, log, or transmit your password itself, and we cannot recover it or read it.
• Session tokens. A short-lived access token and a longer-lived refresh token, so you are not asked to sign in on every page.
• Subscription state. If you subscribe, whether your account is Free, Plus or Pro, and when that entitlement expires.

Sign-in security data

To stop password-guessing attacks we count recent failed sign-in attempts against your IP address and against the email address being tried. These counters are stored as one-way hashes, are used for nothing else, and expire automatically after 15 minutes.

Cookies and on-device storage

We use no advertising or tracking cookies. What we do set:

• wc_refresh — your sign-in session. Marked HttpOnly, Secure and SameSite=Lax, so page scripts cannot read it and it is not sent to other sites. Cleared when you sign out.
• wc_session — a marker containing no value or identity, which only tells the page whether a session might exist so it can avoid a pointless request.
• Local storage — your theme choice and view preferences, so the site looks the way you left it. In the iOS and Android apps only, your session refresh token is also stored here, because an app has no usable cookie store between launches. Access tokens are held in memory and never written to storage.

Who else processes your data

We use a small number of providers, each for one purpose:

• Cloudflare — hosting, content delivery and the database that holds accounts.
• RevenueCat — subscription state across platforms. RevenueCat identifies you by a pseudonymous identifier derived from your account through a keyed one-way function. Your email address is not sent to RevenueCat.
• Apple and Google — if you subscribe inside the iOS or Android app, they process the payment. We never see or store your card details.

Schedule, score, broadcast, ranking and betting-market data comes from third-party sports feeds. Those are outbound requests made by our server for public sports information; no personal data about you is sent to them.

What we do not do

• We do not sell or rent personal information, and we do not "share" it for cross-context behavioural advertising.
• We do not run third-party advertising networks, analytics suites, session recording, fingerprinting or tracking pixels.
• We do not build advertising profiles or infer sensitive characteristics.
• We do not send marketing email you did not ask for.

How long we keep it

• Account record — until you delete your account.
• Refresh tokens — 30 days, and each one is single-use. Signing out, or signing out everywhere, invalidates them at once.
• Access tokens — 15 minutes.
• Sign-in attempt counters — 15 minutes.
• Deleted accounts — a record that the account was deleted is kept for 7 days to prevent immediate re-registration abuse, then removed.

Deleting your account

Go to your account page, open "Delete my account", and confirm with your password. This is immediate and cannot be undone. It removes your account record, frees your email address, and signs out every device at once.

Deleting your account does not cancel a paid subscription. Subscriptions are billed by Apple, Google or our web billing provider, and only they can cancel one. Cancel your subscription first, or you may continue to be charged for an account that no longer exists.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, and not to be discriminated against for exercising those rights. Because we hold so little, most requests resolve quickly: your email address and subscription tier are visible on your account page, and deletion is self-service. For anything else, or to ask us to act on your behalf, email privacy@whatchannelisthegame.com. We do not charge for these requests and we do not require you to create an account to make one.

We have no "sale" or "sharing" of personal information to opt out of, because we do not do either.

Children

This service is not directed to children, and we do not knowingly collect personal information from anyone under 13. The paid analytical features discuss betting-market data and are intended for adults. If you believe a child has created an account, email us and we will delete it.

International transfers

We operate in the United States, and our providers run globally distributed infrastructure. If you use the service from outside the United States, your data will be processed in the United States and in the regions where those providers operate.

Security

Passwords are salted and hashed. Sessions use short-lived signed tokens with single-use refresh rotation, so a stolen token has a narrow window and cannot be replayed. Everything is served over HTTPS. No system is perfectly secure, but we do not store payment details or documents, which limits what a breach could expose.

Changes

If we change how we handle data we will update this page and its date. If a change is material we will say so on the site rather than leaving you to notice.

Contact

NOVA Labs Holdings, LLC
privacy@whatchannelisthegame.com