Privacy Policy

1. Information We Collect

We collect information in the following categories, depending on how you interact with the Service.

1.1 Information You Provide Directly

Fan Accounts (Optional)
If you choose to create a fan account, we collect your email address for one-time passcode (OTP) authentication. You may also provide information such as favorite teams, followed venues, and notification preferences.

Venue Operator Accounts
When you register as a Venue Operator, we collect your email address for OTP authentication, as well as your business name, venue address, phone number, operating hours, amenities, photos, and match screening schedules.

User-Contributed Content
We collect content you voluntarily submit, including reviews, ratings, match screening confirmations (“I’m watching here” reports), venue submissions, reports, tips, and photos.

Communications
If you contact us for support or feedback, we collect the contents of your messages and any information you provide within them.

1.2 Information Collected Automatically

Anonymous Identifiers
When you visit the Service, we assign an anonymous identifier (w2w_anon_id) stored as a cookie on your device. This identifier allows us to maintain a consistent, personalized experience across sessions without requiring account creation. It does not contain personally identifiable information.

Location Data
When you use the “Near Me” or map-based features, we may request access to your device’s geolocation through your browser or operating system. We use your coordinates only for the current search session to locate nearby venues and do not store your precise location history. For fan confirmations, we may retain a coarse proximity indicator (city-level) solely for abuse prevention purposes.

Usage Data
We collect anonymized usage events including page views, feature interactions, search queries, and navigation patterns. These events are collected through our analytics provider (PostHog) and do not contain personally identifiable information. Venue Operators see only aggregated analytics (total views, direction clicks, fan engagement metrics) for their own listings.

Device and Technical Data
We automatically collect certain technical information, including your IP address (hashed for rate-limiting purposes; not linked to your identity), browser type and version, operating system, device type, referring URLs, and the date and time of your visits.

Error and Performance Data
We use Sentry for error tracking, which may collect error stack traces, app context, and device information to help us identify and resolve technical issues.

1.3 Information from Third Parties

Match and Competition Data
We receive match schedules and competition data from third-party sports data providers (including Football-Data.org and ESPN) for display within the Service.

Venue Enrichment Data
We may supplement venue listings with publicly available information from third-party sources (such as Google Places) to enhance listing accuracy and completeness.

Payment Data
When Venue Operators subscribe to Premium, our payment processor Stripe collects and processes payment card information directly. We do not receive or store your full payment card number — only confirmation of subscription status, billing history, and limited transaction details.

2. How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery and Personalization — To show you nearby venues and match information, display community confirmations and reviews, personalize search results based on your location and preferences, and maintain your session and account.

Authentication and Security — To verify your identity through OTP codes for venue claims, operator features, and optional fan accounts, and to protect against unauthorized access.

Abuse Prevention — To detect and prevent fraudulent or abusive activity, including fake reviews, confirmation manipulation, and rate-limit abuse. We use hashed IP addresses and coarse proximity data for these purposes — never precise location tracking.

Venue Operator Analytics — To provide Venue Operators with aggregated, non-identifying performance data about their listings, including view counts, direction clicks, and engagement trends.

Service Improvement — To analyze anonymized usage patterns, identify bugs and performance issues, and improve the Service’s features, design, and user experience.

Communications — To send you OTP codes, account notifications, match alerts (if opted in), and transactional emails related to your use of the Service. We do not send marketing emails unless you have explicitly opted in.

Legal Compliance — To comply with applicable laws, regulations, legal processes, or governmental requests, and to enforce our Terms and Conditions.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share information only in the following circumstances:

3.1 Service Providers (Data Processors)

We work with trusted third-party partners who process data on our behalf under contractual obligations to protect your information. These partners assist us with essential functions such as database hosting and authentication, map rendering and geocoding, payment processing (via PCI-DSS compliant providers), transactional email delivery, product analytics (using anonymized, non-identifying data only), error tracking and performance monitoring, and hosting infrastructure. Our partners receive only the minimum data necessary to perform their specific functions and are contractually prohibited from using your information for any other purpose.

3.2 Publicly Displayed Information

Certain information is displayed publicly as part of the Service’s core functionality: venue listings (name, address, hours, amenities, photos), user reviews and ratings, match screening confirmations, and Venue Operator promotions. Reviews may be attributed to your display name or appear anonymously, depending on your account settings.

3.3 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you for research, analytics, industry reporting, or marketing purposes. For example, we may share aggregate statistics about match popularity or venue search trends.

3.4 Legal Requirements

We may disclose your information if we believe in good faith that such disclosure is necessary to: comply with a legal obligation, court order, subpoena, or government request; protect the safety, rights, or property of WhereToWatchSport, our users, or the public; detect, prevent, or address fraud, security issues, or technical problems; or enforce our Terms and Conditions.

3.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred to the successor entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4. Cookies and Similar Technologies

4.1 Cookies We Use

We use a limited set of cookies and similar technologies, focused on functionality rather than advertising:

Essential Cookies — Required for core Service functionality, including the anonymous identifier cookie (w2w_anon_id, 1-year duration), authentication session cookies for logged-in users, and Supabase auth tokens.

Preference Cookies — We use local storage to remember your preferences, such as dark/light mode, last viewed city, and display settings. These do not track you across third-party websites.

Analytics Cookies — PostHog may set cookies to collect anonymized usage data. These cookies do not contain personally identifiable information.

4.2 What We Do Not Use

We do not use third-party advertising cookies, cross-site tracking pixels, retargeting or remarketing technologies, or social media tracking widgets.

4.3 Your Cookie Choices

You can manage cookies through your browser or device settings. Most browsers allow you to block or delete cookies, though doing so may affect certain features of the Service (for example, clearing cookies will sign you out). For more information, consult your browser’s help documentation.

4.4 Do Not Track Signals

The Service currently does not respond to “Do Not Track” browser signals. However, because we do not engage in cross-site tracking or targeted advertising, the practical effect of our data practices is consistent with the intent of Do Not Track signals.

5. Data Retention

We retain your information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

Account Data — Retained while your account is active. Upon account deletion, personal information is removed within 30 days, except where retention is required by law (e.g., billing records for tax compliance).

Reviews and Confirmations — Retained as long as the associated venue listing exists on the Service. If a venue is permanently removed, associated reviews and confirmations may be deleted or anonymized.

Anonymous Identifiers — The w2w_anon_id cookie expires after 1 year and is automatically renewed on subsequent visits.

Analytics Data — Anonymized usage events are retained in aggregate form indefinitely for trend analysis and Service improvement. Individual event-level data is not linked to personal identities.

Hashed Rate-Limiting Data — IP hashes used for abuse prevention are retained for a limited period (typically 30 days) and automatically purged.

Payment and Billing Data — Retained in accordance with Stripe’s policies and applicable tax and financial record-keeping laws, typically for a minimum of 7 years from the transaction date.

6. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information.

6.1 All Users

Regardless of your location, you may:

• Access your data — Request a copy of the personal information we hold about you
• Correct your data — Request correction of inaccurate or incomplete information
• Delete your data — Request deletion of your account and associated personal data
• Control location access — Deny or revoke location permissions through your browser or device settings; the Service remains functional using city-based search
• Manage cookies — Clear cookies through your browser settings
• Manage notifications — Control email and push notification preferences in your account settings

To exercise any of these rights, contact us at support@wheretowatchsport.com.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: know what categories and specific pieces of personal information we collect about you and why; request deletion of your personal information, subject to certain exceptions; opt out of the “sale” or “sharing” of personal information (note: we do not sell or share personal information for targeted advertising); and not be discriminated against for exercising your privacy rights. We will respond to verifiable consumer requests within 45 days, as required by law.

6.3 Residents of Virginia, Colorado, Connecticut, and Other U.S. States with Privacy Laws

If you reside in a state with a comprehensive consumer data privacy law (including but not limited to Virginia, Colorado, Connecticut, Indiana, Kentucky, and Rhode Island), you may have rights similar to those described above, including the right to access, correct, and delete your data, as well as the right to opt out of certain data processing activities. Contact us at support@wheretowatchsport.com to exercise these rights.

6.4 European Economic Area, United Kingdom, and Switzerland Residents (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR, including the right to: access your personal data and receive a copy; rectify inaccurate personal data; erase your personal data (“right to be forgotten”); restrict processing of your personal data; data portability (receive your data in a structured, commonly used, machine-readable format); object to processing based on legitimate interests; and withdraw consent at any time where processing is based on consent.

Our lawful bases for processing personal data include: consent (e.g., for location access and optional notifications), performance of a contract (e.g., providing the Service to Venue Operators), legitimate interests (e.g., fraud prevention, analytics, and Service improvement), and legal obligations (e.g., tax record-keeping for billing).

To exercise your rights or lodge a complaint, contact us at support@wheretowatchsport.com. You also have the right to lodge a complaint with your local supervisory authority.

6.5 International Data Transfers

The Service is operated in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to such transfers. Where required by applicable law, we ensure appropriate safeguards are in place for international data transfers, such as Standard Contractual Clauses.

7. Children’s Privacy

The Service is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@wheretowatchsport.com. If we become aware that we have collected personal information from a child under 13, we will take prompt steps to delete that information.

Users between 13 and 18 may use the Service with parental or guardian consent, as described in our Terms and Conditions.

8. Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit — All data transmitted between your device and the Service is encrypted using HTTPS/TLS
• Database security — We use row-level security (RLS) policies on our database to ensure users can only access data they are authorized to view
• Hashed identifiers — IP addresses used for rate-limiting are stored as cryptographic hashes and cannot be reversed to reveal the original IP address
• Authentication security — One-time passcode (OTP) authentication eliminates the risk of password-related breaches
• Access controls — Administrative access to data is restricted to authorized personnel only
• Payment security — All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk. If you become aware of a security vulnerability or data breach, please report it immediately to support@wheretowatchsport.com.

9. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services that are not operated or controlled by WhereToWatchSport (such as venue websites, map providers, or social media platforms). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you visit. We are not responsible for the privacy practices or content of third-party services.

10. Automated Decision-Making and AI

As of the date of this policy, the Service does not use artificial intelligence or automated decision-making in ways that produce legal or similarly significant effects on users. We may use basic algorithmic features (such as proximity-based sorting and relevance ranking) to enhance your search experience. These features are based on transparent, non-discriminatory criteria (such as distance, match timing, and community engagement). If we introduce AI-powered features in the future that materially affect how your data is processed, we will update this policy and provide appropriate notice and controls.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable laws. When we make material changes, we will update the “Last Updated” date at the top of this page and may provide additional notice through the Service or via email. Your continued use of the Service after the revised Privacy Policy is posted constitutes your acceptance of the changes. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to submit a data deletion request, please contact us at:

WhereToWatchSport
Email: support@wheretowatchsport.com

For data protection inquiries specifically related to GDPR or UK GDPR, please include “Data Protection Request” in your subject line. We aim to respond to all privacy-related inquiries within 30 days.