Privacy Policy

This document reflects Big Shoota Plays' current data practices. It is a template subject to review by a licensed attorney, particularly regarding CCPA/CPRA, GDPR, and other state or international privacy regimes that may apply to our subscriber base.

1. Introduction

Big Shoota Plays ("BigShoota," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect through bigshootaplays.com and related services (the "Service"), how we use and share it, and the choices available to you. This Policy is incorporated into and forms part of our Terms of Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, and password (stored only as a salted cryptographic hash — we never store your plaintext password).
• Billing information: when you subscribe, payment card details are entered directly into Stripe's hosted checkout and are transmitted to Stripe, our payment processor. We do not receive or store your full card number, CVV, or bank account details. We do receive limited billing metadata from Stripe, such as subscription status, plan, and billing period dates.
• Communications: information you provide when you contact support, such as the content of your message and the email address you use.

2.2 Information Collected Automatically

• Usage data: pages viewed, Plays viewed, timestamps, and general interaction data with the Service.
• Messaging data: if you connect Telegram to receive play alerts, we store your Telegram chat identifier and a connection token, solely to deliver alerts to you through Telegram. If you use any legacy browser push notification feature, we store the associated push subscription endpoint and cryptographic keys issued by your browser's push service for the same purpose.
• Log and technical data: IP address, browser type, operating system, and referring URLs, collected automatically by our hosting infrastructure for security and diagnostic purposes.

2.3 Cookies and Similar Technologies

We use cookies and similar technologies (such as your authentication session token) that are strictly necessary to keep you signed in and to operate the Service securely. If we add analytics or advertising technologies in the future, this Policy will be updated accordingly and, where required by law, we will request your consent.

3. How We Use Information

We use the information described above to:

• Create and administer your account and authenticate your sign-ins;
• Process subscription payments and manage billing status through Stripe;
• Deliver Plays and related content you are entitled to access based on your active subscription;
• Send notifications (Telegram, email, and in-app) when new Plays are posted or results are updated, and to send billing-related and account-related communications;
• Maintain the security, integrity, and proper functioning of the Service, including detecting fraud and abuse;
• Comply with legal obligations and enforce our Terms of Service;
• Analyze aggregate usage trends (such as notification open rates) to improve the Service.

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, we process your personal data under the following legal bases: performance of a contract (to provide the Service you subscribed to), legitimate interests (to secure and improve the Service), consent (for optional communications, where applicable), and compliance with legal obligations.

5. How We Share Information

We do not sell your personal information. We share information only as follows:

• Service providers acting on our behalf: Stripe, Inc. (payment processing and subscription billing); Resend (transactional and notification email delivery); Telegram (delivery of play alerts to members who connect it), along with any browser push notification services operated by Google, Mozilla, Apple, and similar vendors used for legacy notifications; Neon (database hosting) and Vercel (application hosting and infrastructure). Each provider is contractually restricted from using your data for purposes other than providing services to us.
• Legal and safety reasons: where required to comply with a legal obligation, protect the rights or safety of BigShoota, our users, or the public, or investigate fraud or security issues.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case your information may be transferred as part of that transaction, subject to standard confidentiality protections.

6. Data Retention

We retain account and subscription information for as long as your account remains active and for a reasonable period thereafter to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Telegram connection data is removed when you disconnect Telegram from your account or when the messaging provider reports that our bot has been blocked; any legacy browser push subscription is deleted when the browser reports it as expired or when you disable notifications. You may request earlier deletion of your account as described in Section 8.

7. Data Security

We implement administrative, technical, and organizational safeguards designed to protect personal information, including password hashing (bcrypt), encrypted data transmission (HTTPS/TLS) between your browser and our servers and between our servers and Neon's database endpoint, and role-based access control restricting administrative functions to authorized ADMIN accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

8. Your Rights and Choices

8.1 Access, Correction, and Deletion

You may access and update certain account information directly through your account settings. You may request access to, correction of, or deletion of your personal information by contacting us at support@bigshootaplays.com. We will respond within the timeframe required by applicable law. We may retain certain information as required for legal, billing, or fraud-prevention purposes even after a deletion request.

8.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how it is used and shared, the right to request deletion of your personal information, the right to correct inaccurate information, and the right to non-discrimination for exercising these rights. BigShoota does not sell or share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.

8.3 EEA/UK Residents (GDPR)

If you are located in the EEA or UK, you have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing, and to lodge a complaint with your local data protection authority. To exercise these rights, contact us at support@bigshootaplays.com.

8.4 Notification Preferences

You may disconnect Telegram alerts at any time from your account or within the Telegram app, and may manage in-app and email notification preferences through your account, subject to certain administrative communications (such as payment failure notices) that we may need to send regardless of preference.

9. Children's Privacy

The Service is not directed to, and is not intended for use by, individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at support@bigshootaplays.com.

10. International Data Transfers

Our infrastructure providers may process and store information in the United States and other countries. Where we transfer personal information from the EEA, UK, or other regions with data transfer restrictions, we rely on appropriate safeguards recognized under applicable law, such as Standard Contractual Clauses, where required.

11. Third-Party Links and Services

The Service may reference or link to third-party sportsbooks, payment pages, or other external sites. This Policy does not apply to those third parties, and we encourage you to review their own privacy policies. Note that BigShoota does not itself accept wagers; any sportsbook you use independently is a separate service governed by its own privacy practices.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by email or an in-app notice) before the changes take effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.

13. Contact Us

Questions or requests regarding this Privacy Policy or your personal information may be directed to:

Big Shoota Plays — support@bigshootaplays.com — Big Shoota Plays, Wilmington, Delaware 19801