Privacy Policy

Last updated: October 12, 2026

1. Introduction

TheStats.ai ("we", "our", or "us") operates the TheStats.ai platform, a sports league management system. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (stored securely using industry-standard hashing). League administrators may also provide organization details such as organization name and contact information.

League & Game Data

We collect and store league data including team names, player names, jersey numbers, game scores, player statistics, and scheduling information that you provide through the platform.

Google Sign-In

If you sign in with Google, we receive your name, email address, and profile picture from Google. We use this only to create or sign in to your TheStats.ai account — it is not used for any other purpose. If you sign in as a fan, we also store the leagues and teams you follow so their games show up first, and, only if you enter one, an approximate location (rounded to about 100 m). You can delete your fan account at any time (see Data Deletion).

YouTube (League Administrators Only)

See "Google and YouTube Data" below.

Push Notifications

If you opt in to push notifications, we store your browser push subscription endpoint (a URL generated by your browser). This is not linked to any user account and is used solely to deliver game and league notifications.

Automatically Collected Information

We collect standard server logs, including IP addresses, browser type and access times, for security and performance monitoring. On our marketing and sign-up pages we also collect limited usage analytics and sign-up attribution. See "Analytics and Local Storage" below.

3. How We Use Your Information

  • To provide and maintain the league management platform
  • To display game statistics, standings, and leaderboards
  • To send push notifications about game results and league updates (with your consent)
  • To facilitate YouTube livestreaming of games (when connected by an admin)
  • To authenticate users and protect accounts
  • To improve and optimize the platform
  • To understand which pages and campaigns bring new organizers, and how the service is used, so we can improve it

4. Data Sharing

We do not sell your personal information. We may share data in the following circumstances:

  • Public League Pages: League names, team names, player names, game scores, and statistics may be publicly visible if the league administrator enables public access.
  • YouTube: When an admin connects a channel, we interact with the YouTube API only to create and manage that league's live broadcasts. See "Google and YouTube Data" below.
  • Service Providers: We use the following providers to run the platform. They process data on our behalf under their respective privacy policies:
    • Amazon Web Services (AWS): hosting and database
    • OpenAI: processing uploaded scoresheet images for automated stats extraction (OCR)
    • Google (Gemini): AI extraction of stats from video and images
    • Groq: AI text generation for game recaps and player reports
    • Anthropic: AI support assistant
    • Stripe: payment processing
    • Twilio: SMS messaging
    • Brevo: email delivery
    • Meta (WhatsApp): messaging, where enabled
    • YouTube (Google): live streaming, when an admin connects a channel
    • PostHog: product analytics on our marketing and sign-up pages, US-hosted
    • Cloudflare: content delivery, security and privacy-friendly page-view statistics
  • Legal Requirements: We may disclose information if required by law or to protect our rights.

5. Analytics and Local Storage

Where analytics runs

We use product analytics only on our home page, sport landing pages, audience pages (such as "for parks and recreation"), blog, pricing page, and our sign-up and welcome pages. We do not run it on the sign-in page, Google sign-in pages, public league or game viewer pages, or inside the league management dashboard.

What we collect in your browser

On those pages we record which page you visited, how you arrived, and whether you opened and submitted the sign-up form (with the sport, plan or bundle you chose). Our analytics provider also records standard browser details: browser, operating system, device type and screen size. Page addresses are stripped of everything except campaign tags (such as utm_source), and any page outside the list above is recorded only as "[excluded]". We do not automatically capture clicks or keystrokes, and we do not record sessions, heatmaps or page performance. Our analytics provider stores an anonymous ID in your browser's local storage and sets no cookies. Our analytics provider receives your IP address and uses it to estimate your approximate location (city, region and country); it is kept with analytics data for the retention period below.

Sign-up attribution

To learn which campaigns bring us new organizers, we store in your browser's local storage the campaign tags, referring site (without its query string) and landing page from your first visit and from your most recent visit that came from a campaign link or another website. If you sign up, we save that information to your account in our database.

Account events

Our servers send our analytics provider events about how the service is used, grouped under your organization's account: account created, trial started, league created, team created, game created, game completed, and subscription activated or updated. These events contain internal IDs (including the ID of the user who took the action), sport, plan, bundle, status and sign-up method, and the account-created event also carries the sign-up attribution described above (campaign tags, referring site and landing page). They never contain names, email addresses, phone numbers, or team or player names. Account events are part of operating the service and are sent for all accounts; the choices below control analytics in your browser. When you sign up, the anonymous browser ID is linked to your account.

Page-view statistics

On all pages we use Cloudflare Web Analytics, a cookieless tool that collects aggregate page views, referring site, country and device type. It does not build personal profiles.

Where analytics data is kept

Our analytics provider, PostHog, hosts our analytics data in the United States.

Your choices

We do not load analytics or store sign-up attribution for visitors in the European Economic Area, the United Kingdom or Switzerland, or if your browser sends a Global Privacy Control or Do Not Track signal. You can also turn analytics off at any time with this control:

Your opt-out choice is saved in your browser's local storage. Clearing local storage removes the stored analytics ID and attribution data, and also resets this choice, so you would need to turn analytics off again. We do not sell your personal information or share it for cross-context behavioral advertising.

Retention

Analytics data is kept for 12 months. Sign-up attribution is kept with your account and deleted with it.

6. Google and YouTube Data

TheStats.ai lets league administrators livestream their games to their own YouTube channel. This section describes exactly what that involves.

Who grants access, and to what

Only a league administrator who clicks "Connect YouTube" in League Settings grants us access — nothing happens automatically. We request Google's https://www.googleapis.com/auth/youtubescope, and we use it solely to create, start, stop, list, and delete live broadcasts and live streams for that league's games, and to read the connected channel's ID and title so the admin can confirm the right channel is linked. We do not read, modify, or delete the channel's existing videos, comments, subscriptions, or playlists.

What we store

For a connected league, we store the channel ID, channel title, OAuth tokens (the refresh token and stream key are encrypted at rest), the token's expiry, and a reusable YouTube stream ID. This data is used only to manage that league's broadcasts.

Retention and deletion

This data is kept only while the league stays connected. Clicking "Disconnect" revokes the OAuth token with Google and permanently deletes the stored connection. You can also review or revoke TheStats.ai's access at any time at myaccount.google.com/permissions, or by contacting [email protected].

What we don't do with this data

We do not sell this data, do not share it except as needed to provide the livestreaming feature itself, do not use it for advertising, and do not use it to train AI or machine-learning models.

TheStats.ai's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

TheStats.ai uses YouTube API Services. By connecting a YouTube channel, you also agree to the YouTube Terms of Service and the Google Privacy Policy.

7. Data Security

We implement industry-standard security measures including encrypted data transmission (HTTPS), hashed passwords, encrypted OAuth tokens (AES-256-GCM), and secure cloud infrastructure (AWS).

8. Data Retention

We retain your data for as long as your account is active. League and game data is retained as long as the league exists on the platform. You may request deletion of your account and associated data by contacting us.

9. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and data
  • Opt out of push notifications at any time
  • Disconnect third-party integrations (e.g., YouTube) at any time
  • Opt out of analytics at any time (see "Analytics and Local Storage" above)

10. Children's Privacy and Youth Leagues

TheStats.ai is a tool for league organizers. It is not directed to children, and children should not create their own accounts.

Youth leagues, schools and programs may add players who are minors, including children under 13 — for example a player's name, jersey number, team and statistics, and, if the organizer chooses, a photo or game video. The organizer decides what is added and whether the league is public or private. Our Terms of Service require the organizer to have permission from each player, and from a parent or legal guardian for any player under 18, before adding them. For children under 13, we handle this information on the organizer's behalf, as its service provider, to run that league. We do not sell children's information.

Parents and guardians:you can ask your child's league to change or remove your child's profile, or contact us directly at [email protected] with the league name and your child's name. We will confirm the request, let the league know, and remove the profile.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page with a revised date.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].