Privacy Policy

Dive Down Sports (divedown.ai) — operated by Dive Down Sports, LLC, a Georgia limited liability company.

Dive Down Sports, LLC, a Georgia limited liability company (“DDS”, "we", "us", "our"), respects your ("you" or "your") privacy and are committed to protecting it through our compliance with this Privacy Policy (this "Policy"). This Policy describes (i) how we collect, store, use, disclose, and retain data and other information, including Personal Information, about you in connection with the divedown.ai website (the "Site") and the Dive Down Sports fantasy football analytics service (together with the Site, the "Service"), including the paid Subscription plans "Regular League + Draft" ( “League”) and "DFS / Showdown" (a “DFS”) and (ii) our practices for using, maintaining, protecting and disclosing that information. Pricing is not stated in this Policy; it is set out in our Refund & Billing Policy, which is the controlling source for it. This Policy applies to visitors to the Site, persons who join the Waitlist, holders of an Account, and participants in the Referral Program.

This Policy applies only to information we collect: (i) through the Service, (ii) in communications, including email, text, chat, and other electronic messages, between you and the Service, and (iii) when you interact with our advertising and applications (including mobile apps) on third-party websites and services, if those applications or advertising include links to this Policy.

This Policy does not apply to information collected by: (i) us through any other means, including on any other website operated by us or any third party (including our affiliates and subsidiaries) that does not link to this policy, or (ii) any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Service.

We may provide additional or different privacy policies that are specific to certain features, services, or activities.

Please read this Policy carefully to understand our policies and practices regarding your information and how we treat it. By creating an Account, purchasing a Subscription, or otherwise affirmatively providing us with your information, you acknowledge and agree to the collection, use, and sharing of your information as described in this Policy. This Policy may change from time to time (see Changes to Our Privacy Policy). For material changes, we will provide notice and obtain your consent as described in that section. For non-material changes, your continued use of the Service after we post the revised Policy is deemed acceptance. Please check this Policy periodically for updates.

A plain-English companion summary of this Policy is published alongside it. The companion is provided for readability only; this Policy is the governing document, and if the two differ in any respect, this Policy controls.

1. Scope, roles, and defined terms

1.1 Scope

We provide sports analytics tools — rankings, projections, draft tools, and daily-fantasy lineup optimization. We do not operate fantasy contests, accept entry fees or wagers, or hold or transmit contest funds. This Policy covers Personal Information processed by us as the operator of the Service. Third parties named in this Policy (including our payment gateway and the fantasy platforms you elect to connect) handle information under their own privacy policies where indicated.

1.2 Defined terms

The following terms have the meanings given below wherever they appear capitalized in this Policy. Capitalized terms used but not defined in this Policy have the meanings given to them in our Terms of Service.

• "Account" — the record identified by your email address through which you access the Service.
• "Analytics Data" — the first-party measurement records described in Section 6.3.
• "Partner" — a third party enrolled in the Referral Program and issued a Referral Code.
• "Personal Information" — information that identifies, relates to, describes, directly or indirectly, or could reasonably be linked with a particular individual or household, such as (and by way of example only and not as any indication that we collect any of the following) your name, email address, telephone number, home address, or payment information (for example, account information such as name, postal address, and email address, credit card number, or any other identifier we may use to contact you online or offline). Information from which all identifiers have been removed, and which cannot reasonably be re-associated with an individual, is not Personal Information. See Section 2 for further details about actual applicable Personal Information.
• "Referral Code" — a code issued to a Partner and entered by a customer at checkout.
• "Referral Program" — the referral and commission arrangement described in Sections 2.1 and 7.4.
• "Subscription" — a paid subscription to the Service on one of the plans identified above, as priced in our Refund & Billing Policy.
• "Waitlist" — the pre-launch interest list collected on the Site, described in Section 2.1.
• "Your Content" — the leagues, rosters, settings, standings, and DFS lineups you create in or import into the Service.

2. Information we collect

2.1 Information you provide

1. Email address. Your email address is your Account identifier and sole login credential. We use passwordless authentication: we never ask you to create a password and no password for the Service exists anywhere in our systems.
2. Waitlist signups. The Site collects an email address plus a source tag recording which page or button the signup came from (for example, a pricing-page button). One record is kept per email address; source tags accumulate on that record. Section 5.2 governs the consent required before any marketing message is sent to a Waitlist address.
3. Age confirmation. Signup requires you to affirmatively confirm — by checking a box or equivalent affirmative action — that you are at least 18 years old (Section 11), and that confirmation is recorded with your Account. We ask for a confirmation, not your date of birth, and we do not collect or store your date of birth or your actual age.
4. Your Content. Leagues, rosters, settings, standings, and DFS lineups that you enter manually or import into the Service.
5. Roster screenshots. If you upload a screenshot of a roster for automatic import, the image is processed in memory by our own internal service to extract the roster text. The image is not written to disk, is not retained after processing, and is not sent to any third-party OCR or AI provider. The extracted roster text is stored with your Account as part of Your Content.
6. Fantasy-platform connections. If you elect to link an outside fantasy account, we store what that connection requires: for Sleeper, your public account identifier and username (no secret is involved); for Yahoo, OAuth access and refresh tokens; for ESPN, two cookie values you copy from your browser — espn_s2 and SWID — together with the league identifier you wish to connect. Yahoo tokens and the ESPN espn_s2 value are stored encrypted at rest; the ESPN SWID value serves as your ESPN account identifier and, like the Sleeper identifier, is stored unencrypted.
7. Referral Code. If you purchase a Subscription using a Referral Code, the code and its attribution details are recorded with your Subscription. Before the code is applied, the Service displays the name of the Partner to whom it belongs, so that you know a referral relationship exists at the moment you elect to use it (Section 7.4).
8. Partner information. For each Partner enrolled in the Referral Program we hold: the Partner's name, the Partner's contact email address, an associated Partner Account, an append-only history of that Partner's commission rate, and — where required for tax reporting — the Partner's taxpayer identification information (collected via IRS Form W-9 or equivalent). Commission payments may be reported to the IRS as required by applicable law (e.g., Form 1099-NEC).

2.2 Information created or collected automatically

1. Display name. We derive a display name automatically from the portion of your email address preceding the "@". We never ask for, and do not collect, your real name.
2. Account and preference data. Your plan tier (Free plan, League, or DFS), preferred scoring ruleset, and preferred DFS platform.
3. One-time login codes. When you sign in, we generate a six-digit code, email it to you, and store it briefly for verification. Codes expire after five minutes and are automatically deleted from our database; repeated incorrect guesses invalidate a code early.
4. Session token. After sign-in, a signed session token valid for approximately five days is stored in your browser's localStorage (not in a cookie).
5. Analytics Data. The first-party measurement records described in Section 6.3.
6. Server logs. Our hosting infrastructure (Google Cloud) generates standard request logs, which can include your IP address, browser and device information, request timestamps, and requested URLs — including any campaign parameters present in a link you followed (Section 6.3). Billing requests never contain card numbers or security codes (Section 3), and we do not log payment details; operational logs may record non-payment facts about a billing action, such as the plan involved in a declined charge or that a Referral Code was submitted and rejected.
7. Billing records. See Section 3. We store gateway-issued identifiers (customer profile, payment profile, recurring-subscription, and transaction identifiers), card display metadata (brand, last four digits, expiration month and year), Subscription status and billing-period dates, and records of gateway webhook events.

2.3 Information we do not collect

We do not collect: passwords; full payment card numbers or security codes (see Section 3); phone numbers; postal addresses; date of birth; government identifiers; precise geolocation; biometric or health information. We do not purchase data about you from data brokers, we do not use identity-graph or data-enrichment vendors, and we do not build advertising profiles. Section 6.4 states the specific technical practices our measurement system is prohibited from using.

2.4 California Residents

If you are a California resident, at such time as we become subject to the California Consumer Privacy Act (“CCPA”), you will have access to our supplemental California privacy statement by visiting the applicable hyperlink which will be provided in this Policy at such time. We will become subject to the CCPA at such time as we meet one of the following thresholds: (i) we had annual gross revenues for the prior calendar year (January to December) that exceeded $26.625 million (with periodic inflation adjustments), (ii) we annually buy, sell, or share the Personal Information of more than 100,000 consumers or households, or (iii) we derive 50% or more of our annual revenues from selling or sharing consumers' Personal Information. Until we satisfy one of the foregoing thresholds, we are not subject to the CCPA.

3. Payment card information

Card entry occurs inside a hosted payment form served by Authorize.net (our payment gateway, a Visa company) from Authorize.net's own web address. Your card number and security code are transmitted directly to Authorize.net. They are never transmitted to, stored on, or readable by our servers. The underlying merchant processing is performed by Maverick Payments. We retain only opaque gateway identifiers and display metadata (card brand, last four digits, expiration month and year) so that you can recognize your card in the Service. Authorize.net and Maverick Payments process your payment information under their own privacy policies.

4. How we use information

We use the information described above to:

• Provide, maintain, and improve the Service, including generating and displaying Your Content, rankings, and lineups;
• Authenticate you (one-time email codes and session tokens);
• Create and manage Subscriptions, process charges through our gateway, apply upgrades, handle failed payments, and maintain billing records;
• Send transactional service email (Section 5.1);
• Send marketing email to Waitlist and Account addresses that have given the consent described in Section 5.2, and to no others;
• Attribute Subscriptions to Referral Codes and compute Partner commissions (Section 7.4);
• Measure the performance of our own marketing — which campaign, channel, or referral produced a visit, a Waitlist signup, or a Subscription — and understand how the Service is used, by the first-party means described in Section 6.3;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations, enforce our terms, and protect the rights, safety, and property of DDS, our users, and others.

We do not use Personal Information for targeted advertising, we do not perform profiling that produces legal or similarly significant effects, and we do not use Analytics Data to make decisions about individual users.

5. Email communications

5.1 Transactional email

Transactional and account-related messages — one-time login codes, billing and payment notices, and notices of changes to our terms or policies — are part of operating the Service and are not subject to marketing opt-out while you maintain an Account. Transactional email is delivered via Resend from the sending domain messages.divedown.ai, with one exception: the per-transaction payment receipt described in the Refund & Billing Policy is sent by our payment gateway from its own systems, to the email address held in your gateway customer profile (Sections 3 and 7.2).

5.2 Marketing email and consent

We send marketing email only to addresses that have affirmatively opted in to receive it. Joining the Waitlist is not by itself consent to marketing; the consent is a separate, affirmative election presented at the point of signup and recorded with the Waitlist record. An address that has not given that consent receives no marketing message from us, including no launch announcement.

5.3 Opt-out

Every marketing message includes (i) a clear notice of the recipient’s right to not receive (opt out of) future messages from us and (ii) a working unsubscribe mechanism (which remains functional for at least 30 days after the message is sent) of either (A) a functional return email address, allowing the recipient to simply “reply” to the email to opt out, or (B) another internet-based opt-out mechanism (for example, a link to a separate web page containing the opt-out mechanism). Every marketing message will also include (i) complete and accurate transmission and header information which are not misleading or falsified, (ii) the “From” line will identify us as the sender, (iii) the “Subject” line will accurately describe the message’s content without being misleading or false, and (iv) our valid physical postal address (whether a physical address or a post office box). You may also withdraw marketing consent at any time by writing to the address in Section 14. We honor withdrawals promptly and in any event within the period required by applicable law (i.e., no later than ten (10) business days). Any withdrawal of marketing consent remains in effect unless and until you provide new affirmative consent to receive marketing communications. Withdrawing marketing consent does not stop transactional messages under Section 5.1.

6. Cookies, browser storage, analytics, and tracking

6.1 Cookies

We set one cookie on visitors' browsers: dd_vid, a first-party analytics cookie described in Section 6.3. It is set by our own servers on our own domain, is HttpOnly (scripts running on the page cannot read or write it), and carries a signed, randomly generated visitor identifier and nothing else. It is not a third-party cookie, it is not readable by any other party, and it is not used for advertising.

A second cookie, dd_internal, is set only on a browser that has been deliberately marked as belonging to DDS personnel, so that our own visits are excluded from our measurements. It is not set on customer or visitor browsers in the ordinary course.

We set no other cookies. The Service contains no third-party analytics, no advertising pixels or tags, no session-replay tools, and no social-media widgets.

6.2 Browser storage

The Service uses your browser's localStorage and sessionStorage for functional state: your session token, an early-access preview code if you have one, your active league selection, your last visited page, a pending checkout selection, a record that you have dismissed an in-app tutorial tip, and the analytics values described in Section 6.3. This data is stored in your browser and is sent only to us: the session token (and, during early access, the preview code) accompanies your requests to our servers in order to authenticate them. None of it is sent to any third party.

6.3 First-party analytics and marketing attribution

We operate our own measurement system to learn which campaigns, channels, and referrals bring people to the Service and which of those visits become Waitlist signups and Subscriptions. It is built and run entirely by DDS, on our own domain, and no third party receives Analytics Data.

1. Visitor identifier. Our server issues a signed, randomly generated visitor identifier and stores it in the dd_vid cookie described in Section 6.1. The identifier is minted and read only by our servers; page scripts can neither read it nor supply one.
2. Campaign parameters. When you arrive from one of our tagged links or advertisements, we record the campaign parameters in that link (for example utm_source, utm_medium, utm_campaign) and any advertising click identifier it carries. Our links never contain your email address, a hash of it, or any other identifier of you.
3. Referring site. Where your browser supplies a referring address, we store its host and path only; the query string is discarded before storage.
4. Page and event records. We record page views within the Service and a defined list of product milestones — for example, a Waitlist signup, a sign-in, a checkout start, a successful or failed payment, a plan change, and a cancellation — each associated with the visitor identifier.
5. Email as a hashed key. Where a measurement record must be tied to a person — a Waitlist signup or a Subscription — the email address appears in Analytics Data only as a keyed cryptographic hash, never in readable form. This is a data-minimization measure, not anonymization. The set of possible email addresses is enumerable and we hold the key, so we continue to treat hashed records as Personal Information and this Policy affords them the same protection as any other Personal Information we hold. The key is held in managed secret storage (Section 9).
6. IP addresses. Our measurement system never stores a raw IP address. Where a coarse duplicate-detection signal is required, it stores a truncated, salted hash that changes daily and from which the original address cannot be recovered. This is separate from the hosting request logs described in Section 2.2(6), which do contain IP addresses.
7. Visitors outside the United States. Our advertising is directed only to the United States. Where a visitor's browser indicates a location outside the United States, the measurement system operates in a degraded mode in which it sets no identifier and persists no analytics record. The location signal used to make that determination is read at the moment of the request and is not itself stored.

6.4 What our measurement system does not do

1. No third-party pixels or tags. No advertising or analytics code from any other company runs on our pages.
2. No sale and no sharing. Analytics Data is not sold, rented, or disclosed to any third party, and is not used for cross-context behavioral advertising (Section 7.1).
3. No fingerprinting. We do not use canvas, WebGL, or audio fingerprinting, font or plugin enumeration, precise screen or hardware metrics, battery status, or any identity-graph or data-enrichment vendor.
4. No Personal Information in links. See Section 6.3(2).
5. No use against individuals. Analytics Data is used to measure marketing and product performance in aggregate. It is not used to price differently, to make eligibility decisions, or to target an individual.
6. Uploading conversion data to advertising platforms is not adopted. We do not currently upload conversion data, hashed or otherwise, to any advertising platform. If we later change this practice and decide to send hashed conversion data to advertising platforms, we will build an opt-out, honor Global Privacy Control signals, and revise this Policy, each as a condition to doing so.

6.5 Analytics retention

Scope of this Section. This Section governs Analytics Data only — the first-party measurement records described in Section 6.3 and listed in Section 2.2(5). The hosting request logs described in Section 2.2(6) are not Analytics Data and are not covered by the table below. Those logs are produced by our hosting provider rather than by our measurement system; they are written append-only and their entries cannot be deleted individually before their retention period elapses. They are therefore held for the fixed operational period stated in Section 8.8 and are not deleted in response to a request under the deletion right in Section 10.4.

Analytics Data is retained as follows:

When the periods run. The 180-day and 400-day periods above are fixed at the moment the record is created and are not extended by your later activity. For a page view or other event record, the period runs from the event. For a campaign-touch record and for a visitor record, it runs from the first time we created that record — from the first time we saw that browser, not from the last. A visitor who returns repeatedly over more than 400 days does not thereby cause the original visitor record to be kept longer.

Milestone records. The milestone records that carry no expiry date, and are retained until erasure, are records of the following events, each associated with a visitor identifier and, where the event is tied to a person, with the hashed email address described in Section 6.3(5): a Waitlist signup; a Waitlist confirmation; Account creation; a sign-in; connecting a fantasy platform; creating a league; starting checkout; subscribing; a successful payment; a failed payment; a plan change; a cancellation request; the lapse of a Subscription; and a reactivation. Some of these are records of your use of the Service rather than of a payment. They are listed here in full so that the scope of the "until erasure" row is not left to inference.

A sign-in *request* — the issuance of a one-time login code — is a separate record from a completed sign-in and, where such a record is produced, is retained for 400 days rather than until erasure.

Shared-device records. Where a browser has been associated with one person's email address and is later used to sign in with a different email address, we do not merge the two people. Devices are weak evidence of identity and merging would combine two unrelated customers' records. Instead we re-associate the browser with the second person and keep, on that second person's visitor record, a dated entry noting that the browser was previously associated with the first person's hashed email address. That entry is a record about the first person held on the second person's record. It is retained for as long as the second person's visitor record is retained, and it is removed when either person exercises the deletion right in Section 10.4: if the second person requests deletion, the record it sits on is deleted; if the first person requests deletion, we remove that entry from the second person's record without deleting the second person's record, which is not ours to delete on someone else's request.

Global Privacy Control. Where your browser sends a Global Privacy Control signal (Section 6.7), we record that fact on the visitor record for that browser. That notation is retained for as long as the visitor record it sits on, and it is deleted together with that record when you exercise the deletion right in Section 10.4 — we do not keep a separate copy of the signal after erasure, and we do not maintain a suppression list that survives deletion — that would require retaining an identifier for someone who asked to be forgotten. Because Global Privacy Control is a setting in your browser rather than a preference stored with us, a browser that sends the signal sends it again on its next visit and we record it again.

Advertising opt-out. If you ask us not to send your conversion data to an advertising platform, we record that on your visitor record and it applies across every browser we have associated with you, not only the one you asked from. We do not currently send conversion data to any advertising platform at all (Section 6.4(6)).

The opt-out is deleted along with everything else when you exercise the deletion right in Section 10.4. We do not keep a suppression list that outlives an erasure, because keeping one would mean retaining an identifier for a person who asked to be forgotten — which is the opposite of what they asked for. The consequence is worth stating plainly rather than leaving to inference: if you are erased and later return, we hold no memory of your earlier choice, and you would make it again.

Aggregated statistics. Where aggregated campaign and rollup tables are produced, they carry no visitor identifier, no email hash, and no IP address, cannot identify anyone, and are not deleted in response to a deletion request.

What deletion reaches. Everything else listed above is deleted when you exercise the deletion right in Section 10.4. We delete it by the identifiers that tie those records to you — your hashed email address, your Account identifier, and the visitor identifiers we can still attribute to you. Two limits follow from that method and are stated here rather than implied. First, records generated on a browser that has since become another person's browser (the shared-device case above) carry no identifier of you and are indistinguishable from that other person's records; we leave them in place, because they can no longer be attributed to you and deleting them would destroy records belonging to someone who made no such request. Second, the aggregates described above, where produced, are not deleted. Section 8.7 states the outer time limit within which removal completes.

6.6 Third-party resources loaded by our pages

One external resource is loaded by our pages, and no others:

1. Our payment gateway's hosted payment form, on the checkout page only. Card entry is served by Authorize.net from its own web address inside a frame on our page (Section 3), so your IP address and browser information reach Authorize.net when that page loads.

No advertising, analytics, session-replay, or social-media resource from any third party is loaded on any page (Section 6.4(1)). No font, script, or stylesheet is loaded from any third party on any page.

6.7 Do Not Track and Global Privacy Control

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data "sales" as defined under certain laws. When we detect such a signal, we will honor it as a valid opt-out of the sale and sharing of Personal Information for cross-context behavioral advertising, as required by applicable law. Because we do not sell or share Personal Information for cross-context behavioral advertising (Section 7.1), our practices already align with the preferences a GPC signal expresses, and no change to your experience results from the signal. Our first-party analytics collection (Section 6.3) — which is used solely for our own internal measurement and is not shared with third parties — continues to operate when a GPC signal is present, as it does not constitute a sale or sharing of Personal Information under applicable law.

7. How we share information

7.1 No sale, no sharing

We do not sell or rent Personal Information, and we do not share Personal Information with third parties for cross-context behavioral advertising. This statement covers Analytics Data (Section 6.4(2)) as fully as it covers Account and billing information. If our practices on this change in the future, we will update this Policy and obtain any consent required by applicable law before any such sale or sharing begins.

7.2 Service providers (processors)

Companies that process information on our behalf under contractual limits, currently:

1. Authorize.net — payment gateway. Receives your email address (forwarded to your gateway customer profile) and, directly from your browser, your card details (Section 3). It also sends the per-transaction payment receipt to that address from its own systems (Section 5.1), and serves the hosted payment form embedded on our checkout page (Section 6.6(2)).
2. Maverick Payments — merchant processor underlying Authorize.net.
3. Resend — transactional and marketing email delivery; receives recipient email addresses and message content.
4. Google Cloud — application hosting, storage, secret management, and logging.
5. MongoDB Atlas — our primary database, hosted on Google Cloud infrastructure in the United States (us-central1).

7.3 Fantasy platforms you connect

When you link Sleeper, Yahoo, or ESPN, we make requests to that platform using the identifier, token, or cookie you provided, and receive your league and roster data in return. Those requests necessarily identify your account on that platform to that platform. Each platform handles your data under its own privacy policy; we do not push your data concerning us to these platforms beyond what the retrieval requests themselves contain.

7.4 Referral Partners

Two commitments govern the Referral Program:

1. What you are told. When you enter a Referral Code at checkout, the Service displays the name of the Partner to whom that code belongs — "Referred by [Partner name]" — before the code is applied. You are told that a referral relationship exists, and with whom, at the moment you choose to use the code.
2. What a Partner is told. A Partner's payout reporting contains aggregate, anonymized figures only: counts, amounts, plan tier, and dates for Subscriptions attributed to that Partner's code, together with the transaction identifiers needed to reconcile a payout. Commission payments may be reported to the IRS as required by applicable law (e.g., Form 1099-NEC). A Partner never receives, and never has access to, subscriber names, email addresses, Account identifiers, or Your Content. A Partner cannot learn from us which individual purchased a Subscription using its code.

7.5 Legal and safety

Notwithstanding any provision of this Policy to the contrary, we may disclose information to comply with law, legal process, or enforceable governmental requests; to enforce our terms; or to protect the rights, property, or our safety, our users, or the public.

7.6 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, Personal Information may be transferred as part of that transaction, subject to this Policy or successor terms. We will provide notice to Account holders before any such transfer takes effect — through both email and in-product notice — and you will have the opportunity to exercise your deletion rights under Section 10.4 before the transfer is completed.

7.7 No other categories

We do not share Personal Information with any other categories of third parties.

8. Data retention

We keep the categories of Personal Information described in this Policy for as long as reasonably necessary to fulfill the purposes described or for as otherwise legally permitted or required, such as maintaining the Service, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain Personal Information. At the end of the applicable retention period, Personal Information will be deleted, destroyed, or deidentified. See the remainder of Section 8 for further details.

If you are a California resident, at such time as we become subject to the CCPA, by visiting the applicable hyperlink which will be provided in this Policy at such time, you will have access to our supplemental California privacy statement for more information about the retention periods that apply to the Personal Information categories we collect. See Section 2.4 for further details.

8.1 Account data

Account data (email address, derived display name, preferences, Your Content, and fantasy-platform connections) is retained for as long as your Account exists, and thereafter only as Section 8.7 permits.

8.2 One-time login codes

Automatically deleted approximately five minutes after issuance, or sooner on failed attempts.

8.3 Uploaded roster screenshots

Not retained at all — processed in memory and discarded (Section 2.1(5)).

8.4 Billing and transaction records

Gateway identifiers, card display metadata, Subscription and transaction history, and webhook event records are retained as long as reasonably necessary for accounting, tax, dispute-handling, fraud-prevention, and legal-compliance purposes including taking into account applicable statutes of limitations which vary based upon the nature of the matter, but in no event longer than seven (7) years after the end of the calendar year in which the transaction occurred, unless a longer period is required by applicable law. This retention may extend beyond Account closure. These are the "records we are required to keep" referred to in Section 8.7.

The payment method vaulted with our gateway is retained separately from the records described above, and separately from your Subscription: because Subscriptions are seasonal, it is held between Seasons so that a Subscription for the following Season may be purchased without re-entering it, and no charge is made against it in the meantime (Refund & Billing Policy, Section 3.4). It is deleted when you exercise the payment-method removal right in Section 10.5 or the deletion right in Section 10.4.

8.5 Analytics Data

Retained as stated in the table in Section 6.5.

8.6 Waitlist records

A Waitlist record is retained until you ask us to remove it or your Account is deleted. After launch, the Waitlist is not deleted: it becomes our marketing list, and only those records carrying the affirmative marketing consent described in Section 5.2 are used for that purpose. A Waitlist record without that consent receives no marketing message; you may ask us to remove your Waitlist record at any time under Section 10.4.

8.7 Retention after Account deletion

When you exercise the deletion right in Section 10.4, we remove your Personal Information from our live production systems promptly, and no Personal Information associated with your deleted Account is retained by us more than 90 days after we complete the deletion request — except:

1. Records we are required to keep. The billing and transaction records described in Section 8.4, which we retain for accounting, tax, dispute-handling, and legal-compliance purposes taking into account applicable statutes of limitations which vary based upon the nature of the matter. As stated in Section 10.4, your Account identifier is stripped from those records, so they can no longer be traced to you.
2. Aggregated statistics, where produced. The non-identifying aggregates described in Section 6.5, which carry no visitor identifier, no email hash, and no IP address, and cannot identify anyone.
3. Backups. Encrypted backup copies, which are isolated, are not used for any purpose in the interim, and age out within the 90-day period stated above.

The 90-day period is an outer limit on residual copies, not a waiting period before deletion begins.

8.8 Server logs

Retention depends on which service produced the log.

• Application request logs (the API behind your Account) are retained for 30 days,

after which Google Cloud deletes them automatically.

• Access logs for our public marketing site are retained for 400 days. These are

ordinary web-server access lines — IP address, timestamp, requested URL including any campaign parameters — kept as a backstop source for the marketing measurement described in Section 6.3, whose own records are retained on the schedule in Section 6.5.

9. Security

We use commercially reasonable technical and organizational safeguards appropriate to protect the data we handle from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure, including:

• Encryption in transit (TLS) for connections to the Service;
• Card data isolation: payment card numbers and security codes never reach our systems at all — they pass directly from your browser to our payment gateway's hosted form (Section 3);
• No password database: because authentication is passwordless, there are no user passwords in our systems to be stolen;
• Short-lived, auto-deleted login codes with attempt limits;
• Encryption at rest for stored third-party platform secrets (Yahoo OAuth tokens and the ESPN espn_s2 cookie value); platform account identifiers that are not secrets (the Sleeper identifier and username, the ESPN SWID) are stored unencrypted;
• Managed secret storage for application credentials, including the keys used to hash email addresses and IP addresses in Analytics Data (Section 6.3), and access to production systems limited to personnel who require it.

However, no website, mobile application, system, electronic storage, or online service is completely secure, and no security program can guarantee absolute protection. No method of transmission or storage is completely secure, and we cannot promise that information will never be accessed or disclosed without authorization. We cannot guarantee the security of your Personal Information transmitted to, through, using, or in connection with the Service. In particular, email, texts, and chats sent to or from the Service may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of Personal Information is at your own risk. The safety and security of your Personal Information also depends on you. You are responsible for taking steps to protect your Personal Information against unauthorized use, disclosure, and access. If we learn of a breach affecting your Personal Information, we will notify you and regulators as required by applicable law.

10. Your rights and choices

10.1 Access and Data Portability

Most of your Account information (email address, plan, preferences, Your Content, card display metadata) is visible to you in the Service. You may confirm whether we process your Personal Information and access a copy of the Personal Information we process. To the extent feasible and required by state law, depending on your state, any Personal Information which is not Account Information visible to you will be provided in a portable format. Depending on your state, you may have the right to receive additional Personal Information and it will be included in the response to your access request. You may request a copy of the Personal Information we hold about you via the contact in Section 14.

10.2 Correction

You may update your scoring-ruleset and DFS-platform preferences in the Service. Your display name is derived from your email address and is not separately editable. You may request that we correct inaccuracies in any of the other of your Personal Information that we maintain, taking into account such other Personal Information's nature and processing purpose.

10.3 Changing your email address

Your email address is also your sign-in credential, so a change to it is treated as an account-security request rather than a profile edit.

• Where you can still receive mail at your current address, we will change the address after confirming the request from that address.
• Where you have lost access to that address, we will not move your Account to a new one. We cannot distinguish you from a person who merely knows your email address, and the payment details we hold — card brand and last four digits — appear on receipts and statements and are not evidence of Account ownership.
• In either case, and without requiring proof, we will cancel your Subscription on request so that charges stop. You may then create a new Account.

10.4 Deletion

Subject to certain exceptions under applicable state law, you may request deletion of your Account and the Personal Information associated with it that we maintain by writing to the contact in Section 14. On such a request we will cancel any active Subscription, remove your stored payment credential from our payment processor, and delete your Account record, your connected fantasy-platform credentials, your leagues and lineups, the Analytics Data associated with you (Section 6.5), and your Waitlist entry if you have one. We retain the financial records described in Section 8.4 with your Account identifier removed, so that those records can no longer be traced to you. Section 8.7 states the outer time limit within which removal completes.

10.5 Payment-method removal

You may request deletion of the payment method stored with our gateway without deleting your Account, by writing to the contact in Section 14. Where a Subscription is then active, removal cancels it, because a recurring charge requires a stored payment method. This right is the counterpart of the between-Seasons card retention described in Section 8.4 and in Section 3.4 of the Refund & Billing Policy.

10.6 Marketing opt-out

Every marketing message carries a working unsubscribe mechanism, and you may withdraw consent at any time (Section 5.3). Marketing is sent only to addresses that opted in (Section 5.2). Depending on your state, you may also have the right to request that we not use your Personal Information for purposes of sales, targeted advertising, or profiling that produces legal or similarly significant effects. As stated in Sections 6.4 and 7.1, we do not currently engage in any of those practices.

10.7 Platform disconnection

You may request that we disconnect a linked fantasy platform and delete the stored credentials for it, without deleting your Account, by writing to the contact in Section 14.

10.8 U

S. state privacy rights. Depending on your state of residency, you may have certain other rights related to your personal data, including the right to designate an authorized agent to exercise these rights on your behalf.

Important: The exact scope of these rights vary by state. There are also several exceptions where we may not have an obligation to fulfill your request.

To exercise any of these rights, please write the contact in Section 14. We may need to verify your identity before fulfilling your request, and we will do so using reasonable means appropriate to the sensitivity of the request, such as confirming ownership of the email address associated with your Account. To appeal a decision regarding a consumer rights request, also please write the contact in Section 14 and you will be provided further details on any appeal procedure.

See Section 6.7 concerning Global Privacy Control.

Nevada provides its residents with a limited right to opt out of certain personal data sales. Residents who wish to exercise their sale opt-out rights may submit a request to this designated address: support@divedown.ai. However, please know we do not currently sell data triggering that statute's opt-out requirements.

If you are a California resident, at such time as we become subject to the CCPA, additional information applies to you. By visiting the applicable hyperlink which will be provided in this Policy at such time, you will have access to our supplemental California privacy statement to learn more about California’s residents’ privacy rights. For further details, see Section 2.4.

10.9 Nondiscrimination

We will not deny you the Service, charge different prices, or degrade quality because you exercised a privacy right.

11. Children's privacy

The Service is intended for adults. You must be at least 18 years old to create an Account or purchase a Subscription. This threshold matches the age requirement in our Terms of Service, and the two must be read together. The Service is not intended for nor directed to children under the age of 18. In particular, we do not knowingly collect Personal Information from children under the age of 13 as defined by the Children's Online Privacy Protection Act (COPPA). If we learn we have collected or received Personal Information from a person under 18 years old without verification of parental consent, we will delete that Personal Information. This commitment encompasses our obligations under COPPA with respect to children under 13.

12. Users outside the United States

The Service is operated from the United States, is directed to residents of the United States only, and stores and processes information on servers located in the United States. If you reside outside the United States you are not authorized to use the Service and should not use the Service. We do not knowingly collect or process Personal Information from individuals located outside the United States, and any unauthorized use by a non-US person is at the user's sole risk and does not impose any obligation on us under non-US data protection law. Section 6.3(7) describes the reduced analytics collection applied to visitors who appear to be located outside the United States.

13. Changes to this Policy

We may revise this Policy from time to time. The "Last Updated/Review" date at the top reflects the most recent version revised and/or reviewed by us. We will notify you of changes to this Policy by updating the "Last Updated/Reviewed" date and posting the updated Policy on the Site. For material changes on how we use Personal Information we will provide notice through both channels: by email to Account holders, and by prominent in-product notice — before the changes take effect, each with a click-through consent, but you should check our Site periodically to see the current Policy and any changes we have made to it. In addition to applicable click-through consents, for non-material changes, your continued use of the Service after a revision takes effect indicates acceptance of the revised Policy.

14. Contact

Privacy questions and requests: support@divedown.ai, a monitored mailbox staffed by our team.

We aim to respond to privacy requests promptly and will in all cases respond within the time period required by applicable law (generally 45 days, which may be extended by an additional period where reasonably necessary, with notice to you of such extension).

Postal address: PO Box 54067, Atlanta, GA 30308, USA

Entity: Dive Down Sports, LLC, formed in Georgia.

15. Relationship to the Terms of Service

This Policy forms part of, and is incorporated into, our Terms of Service. The provisions of our Terms of Service on governing law, dispute resolution, the time limit on claims, the disclaimers, and the limitation of liability are incorporated into this Policy by reference and apply to this Policy as if they were repeated in this Policy and to any claim arising out of or relating to this Policy, except to the extent such provisions are prohibited or limited by applicable privacy or consumer-protection law. See our Terms of Service for full details. Capitalized terms not defined in this Policy have the meanings given in our Terms of Service.