Privacy Policy

1. Overview

CrunchClash ("we," "us") provides a Premier League data analysis workspace. This Privacy Policy explains what information we collect, how we use it, and the choices available to you. It is not a certification of compliance with any specific privacy law.

2. Information we collect

Account information. When you sign up or sign in, we store information such as your name (if provided), email address, password hash (for email/password accounts), profile image from OAuth providers (if any), and linked OAuth account identifiers. We may also store a customer identifier used with our payment provider.

Usage and query data. When you use Ask, Advanced Query, Explore, or related features, we may store natural-language questions, query definitions, status and error summaries, result metadata (such as row counts and timing), explanations produced by the query pipeline, saved queries, and saved dataset definitions. This helps power history, saved items, billing for usage, debugging, and product operation.

Credits and purchases. We store credit balances, credit transactions, and purchase records (including plan identifiers, amounts when available, status, and payment-provider references). We do not store full payment card numbers on our servers.

Technical and security data. We use session cookies for authentication. We may use caching and rate-limiting infrastructure that temporarily stores request identifiers or usage counters. Theme preference may be stored in your browser (for example via local storage) when you change appearance settings.

3. How we use information

• Provide, secure, and improve the Service
• Authenticate users and maintain sessions
• Interpret queries, run previews/exports, and show history or saved items
• Track credits, process purchases, and handle payment-provider events such as refunds
• Enforce rate limits and prevent abuse
• Respond to support requests you send us

4. AI processing

Natural-language questions may be sent to a third-party AI provider so we can interpret them into structured queries. Do not submit secrets, passwords, or personal data about others that you do not want processed by those providers.

5. Payment processing

Credit purchases are processed by Kelviq, our payment partner. Kelviq (and any underlying payment processors they use) receive information needed to complete checkout and send us webhooks about payment status. Their handling of payment data is governed by their own policies.

6. Cookies and local storage

We use authentication session cookies required to keep you signed in. The Service may store non-essential UI preferences (such as light/dark theme) in browser storage. We do not currently operate a separate marketing cookie consent banner because we do not run third-party advertising trackers in the application as shipped.

7. Analytics

We do not currently integrate a third-party product analytics or advertising pixel suite in the application. Operational metrics related to rate limiting, caching, and service health may still be generated by our infrastructure providers.

8. Service providers

We use third parties to operate the Service, including:

• Hosting and application infrastructure
• Managed databases for application and football data
• Redis-compatible caching and rate limiting
• Authentication providers you choose (for example Google or GitHub OAuth)
• AI providers for query interpretation
• Kelviq for checkout and payment events

These providers process data only as needed to provide their services to us, subject to their terms and our configuration.

9. Data retention

We retain account, query history, saved items, credit, and purchase records for as long as needed to operate the Service, meet legal or accounting needs, resolve disputes, and enforce our terms. Cached query results and rate-limit counters are typically temporary. If you want account deletion or specific record removal, contact us — we will review reasonable requests and explain what we can delete or anonymize.

10. Security

We use industry-common practices such as hashed passwords for credential accounts, encrypted transport (HTTPS) in production deployments, and access controls around server secrets. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

11. Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete personal information, or to object to certain processing. CrunchClash does not claim automated fulfillment of every jurisdiction-specific right (such as formal GDPR or CCPA request portals). Email hello.crunchclash@gmail.com with your request and account email; we will respond as reasonably practicable.

You can update some account details in Settings when signed in, manage saved queries and datasets in the workspace, and sign out to end your session.

12. Children

The Service is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us so we can take appropriate action.

13. International processing

We and our providers may process information in countries other than where you live. Those countries may have different data-protection rules than your own.

14. Changes

We may update this Privacy Policy from time to time. The effective date at the top of this page will change when we do. Continued use of the Service after an update means you acknowledge the revised policy.

15. Contact

Privacy questions: hello.crunchclash@gmail.com. See also our Terms of Service and Contact page.