Privacy Policy

Last updated: February 28, 2026

1. Introduction

This Privacy Policy explains how Heavytail Labs, LLC (“Heavytail Labs,” “we,” “us”), operating as Chalk, collects, uses, and protects your information when you use our service at chalk.is.

2. Information We Collect

2.1 Information You Provide

• Email address: Required for account creation and verification.
• Password: Hashed with bcrypt (an industry-standard algorithm) before storage. We never store or have access to your plaintext password.
• Phone number: Optional. Collected only if you are a Pro or Syndicate subscriber and opt in to SMS alerts. Used solely for delivering SMS notifications via Twilio. Removed when you disable SMS alerts or delete your account. We will not sell, rent, loan, or share your mobile phone number or SMS opt-in/opt-out data with any third parties for marketing or promotional purposes.
• Payment information: Credit card and billing details are collected and processed entirely by Stripe. We store your Stripe customer ID to manage your subscription. We never see or store your card number.

2.2 Information Collected Automatically

• Usage data: Which games you view and which features you use, stored in our application database.
• Server logs: IP address, browser type, operating system, access times, and pages visited. Standard web server logs retained for 90 days.

2.3 What We Do Not Collect

We do not run third-party analytics services — no Google Analytics, Posthog, Mixpanel, or similar. We do not use advertising trackers or third-party tracking pixels. We do not collect location data beyond what is derivable from your IP address. We do not collect data from social media accounts.

3. How We Use Your Information

• Authenticate your account and manage your subscription
• Deliver the Service, including predictions, insights, and alerts
• Process payments through Stripe
• Send SMS alerts if you have opted in (Pro and Syndicate plans)
• Send transactional emails (account verification, subscription changes)
• Enforce rate limits and prevent abuse
• Respond to support requests

We do not use your personal information for advertising, profiling, or sale to third parties.

4. Third-Party Services

We share data with the following providers, and only the data each needs to perform its function:

We also use public, read-only APIs for game data and market information as inputs to our analytical models. No user data is shared with these services.

We do not sell your personal information to anyone. We do not sell, share, or rent mobile phone numbers or SMS opt-in/opt-out data to third parties or affiliates for marketing or promotional purposes.

5. Cookies and Local Storage

We use two types of browser storage:

• Authentication cookie: An httpOnly JWT cookie with a 7-day expiry. Required to keep you logged in. Cannot be disabled while using the Service.
• Preferences (localStorage): Your tracked games, selected model, and view mode preferences. Stored locally in your browser — never sent to our servers. You can clear these from your browser settings.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

6. Data Retention

• Account data: Retained until you delete your account.
• Server logs: 90 days.
• Payment records: 7 years (legal requirement).
• SMS consent records: Retained for a minimum of 5 years from the date of consent or opt-out, as required by the Telephone Consumer Protection Act (TCPA).

When you delete your account, we deactivate it and your data is no longer accessible through the Service. Deactivated account data is permanently purged within 90 days, except for payment records retained as required by law.

7. Data Security

We protect your data with:

• TLS encryption for all data in transit
• Industry-standard password hashing (bcrypt)
• Hashed verification codes for phone number confirmation
• Rate limiting on authentication endpoints
• Internal API routes blocked from public access

No system is perfectly secure. We implement reasonable safeguards but cannot guarantee absolute security.

8. Your Rights

You can:

• Access your personal data by contacting us
• Correct inaccurate information in your account settings
• Delete your account and associated data from your account settings
• Opt out of SMS alerts by replying STOP or from your settings
• Export your data by contacting us

To exercise any of these rights, email privacy@chalk.is.

9. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights:

• The right to know what personal information we collect and how we use it (see Sections 2–4 above)
• The right to request deletion of your personal information
• The right to non-discrimination for exercising your privacy rights
• The right to opt out of the sale or sharing of your personal information (we do not sell or share personal information, so this right does not apply)

You may designate an authorized agent to submit a request on your behalf. We may require verification of both your identity and the agent’s authority.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

10. Do Not Track

We do not track users across third-party websites and therefore do not respond to Do Not Track (DNT) browser signals. We do not use third-party analytics or advertising trackers.

11. Children

Chalk is not intended for anyone under 18. We do not knowingly collect personal information from minors. If we learn that we have collected data from someone under 18, we will delete it.

12. International Users

Chalk is operated from the United States and hosted on US-based infrastructure. If you access the Service from outside the US, your data is transferred to and processed in the US. By using the Service, you consent to this transfer.

13. Changes to This Policy

If we make material changes to this policy, we will notify you by email or in-app notification at least 15 days before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance.

14. Contact

Privacy questions: privacy@chalk.is

General support: support@chalk.is