Privacy Policy

1. Scope

This Policy applies to personal information processed by Clutch5 in connection with the Service.

It does not govern third-party websites or services you choose to visit, including Google, Stripe, broadcasters, streaming platforms, leagues, or teams. Those services apply their own privacy policies.

2. Information We Collect

2.1 Account and Identity Information

If you create or use a Clutch5 account, we process:

• email address;
• display name, if you sign in with Google (email sign-in does not collect a name);
• an internal Clutch5 user identifier;
• the name of the authentication provider you used (for example, Google), where applicable;
• a stable provider-side user identifier used to recognize the same account on future logins, where applicable; and
• account creation and update timestamps.

If you sign in with Google, Google provides basic profile information (email, name, provider identifier) as part of the sign-in flow. Clutch5 does not receive your Google password and does not store Google access or refresh tokens after your identity is verified.

2.2 Session and Security Information

To keep you signed in and protect the Service, we process:

• a session identifier;
• a cryptographic hash of your session token (the raw token is stored only in an HTTP-only cookie in your browser);
• session creation and expiration times;
• short-lived, single-use authentication state used to prevent login forgery; and
• limits on how often sign-in codes can be requested and tried for an email address.

A Clutch5 sign-in lasts up to 90 days from when you sign in; it is not extended by use. It ends sooner if you log out on that browser.

IP address and browser information. The Clutch5 application does not record your IP address or your browser’s user-agent string in its database. Our hosting and network providers (Railway and Cloudflare, see Section 9) necessarily process IP addresses and request information to deliver and protect the Service, under their own logging practices.

2.3 Sports and Notification Preferences

The Service stores the sports, leagues, conferences, teams, players, tournaments, or events selected for monitoring; alert sensitivity and notification settings; streaming service or viewing preferences; and other personalization settings.

How these are stored. Your preferences are stored against your Clutch5 account. Each account has its own saved selections; one person’s choices do not change what anyone else sees or is alerted about. Because they are linked to your account, they can be retrieved and are deleted when your account is deleted.

An account that has not saved any selections has no stored preference record at all. That is different from having saved an empty selection, which is a choice we keep as you made it.

We also keep two small settings against your account: when you last viewed your games (so Clutch5 can show what is new since then), and, if you choose “Later” on the notification setup reminder, the time until which that reminder stays hidden.

2.4 Push Notification Information

If Web Push notifications are enabled, Clutch5 processes the push subscription generated by the browser. Depending on the browser and push service, this can include a push-service endpoint, cryptographic keys used by the browser push protocol, notification-permission status, and records reasonably necessary to avoid duplicate alerts.

How this is stored. A push subscription is stored against your Clutch5 account and against the individual browser or device it came from. You can have notifications switched on for more than one device at the same time; each is a separate record, and turning notifications off on one device does not affect the others or anyone else’s.

For each device we store the push-service address and encryption keys the browser provides, when the device was registered and last reached, a count of temporary delivery failures, and an identifier derived from the sign-in session that registered it. We do not store a device name, model, or IP address.

Notification records we keep. To send an alert to the right people once, and to retry a device that did not receive it, Clutch5 records:

• for your account: which sporting event an alert related to, the kind of alert, and when your account was first alerted about it;
• for each of your devices: which event an alert related to, when delivery was attempted, how many attempts were made, and whether the push service accepted it, is still being retried, or was given up on.

These records associate a sporting event, a time, and a delivery status with your account and with a particular device. They exist so the same alert is not sent to you repeatedly and so a device that missed one can be tried again.

“Delivered” means accepted by the push service, not seen by you. The only thing Clutch5 can observe is whether the browser’s push service accepted the message for onward delivery. We do not know, and do not record, whether a notification was displayed, opened, read, or dismissed.

Logging out. The session identifier stored with a device is used so that logging out on that browser stops notifications to it without affecting your other devices. This works when the device was set up under the sign-in that is logging out and the logout completes; otherwise alerts can continue until you turn notifications off in Settings or in your browser (see the Terms, Section 3.1). Logging out marks the device record as signed out; alerts are no longer sent to it, but the record is kept so that, if you sign back in to the same account on the same browser and notifications are still allowed, alerts resume without asking again. Turning notifications off in Clutch5 Settings deletes the device record. Simply closing the app or letting a sign-in expire does not switch notifications off.

Test notifications. When you send yourself a test notification, it goes only to the device you are using. We record that the push service accepted it, in the log described below; it is not added to your alert history.

Alert decision log. To troubleshoot alerts, Clutch5 keeps a short rolling log of why an alert was or was not sent (for example, “preferences did not match” or “accepted by the push service”), with the game, the kind of alert, and, where it concerns you, your account identifier. It never contains your email address or device keys. Only the most recent 500 entries across all users are kept; older entries are overwritten automatically. You can ask us for your entries (see Section 16).

No notification analytics. Clutch5 does not record on its servers whether you opened or tapped a notification. A short diagnostic log of recent notification-related app events is kept on your own device (see the Cookie Policy); it is not sent to Clutch5.

2.5 Subscription and Billing Information

If you purchase a paid subscription, payment processing is handled by Stripe. To set up billing, Clutch5 gives Stripe your email address and an internal Clutch5 account identifier. Clutch5 receives and stores only limited billing information: a Stripe customer identifier, Stripe subscription identifier, subscription status (which shows, for example, whether a payment is overdue), product or price identifier, the end date of the current billing period, and webhook event identifiers.

Clutch5 does not receive or store your full payment-card number or security code. Payment card details are handled by Stripe under Stripe’s own terms and privacy policy.

When you confirm a subscription at checkout, we record that confirmation: the version of the Subscription Terms shown, the checkout identifier, and the time. We do not record your IP address or device for this.

2.6 Technical and Usage Information

Clutch5’s hosting, security, and networking providers automatically process technical information that may include IP address, browser and device type, operating system, request date and time, requested URL or route, referring URL, error and diagnostic information, and security logs. Clutch5’s own application logs record errors and service events; they are not designed to contain your email address.

Infrastructure providers may derive or make available an approximate geographic region from an IP address, such as country or state. Clutch5 does not collect GPS-level location through the Service and does not currently use location for any feature. If that changes, we will update this Policy first.

2.7 Communications

If you contact us, we collect your name, email address, message, attachments, and other information you choose to provide. Mail sent to our published support address is received through Cloudflare Email Routing, which forwards it to a mailbox hosted by Google Workspace (Gmail), where the message is stored and we read it. See Section 9.

2.8 Watch-Button Measurements

When you tap a Watch button, Clutch5 records an event that is not linked to your account: which streaming service and kind of link was used, a coarse device category (for example, “iOS”), the game, whether the service matched your streaming selections, and how long it was until you left and returned to Clutch5. It contains no email address, account identifier, or IP address. We use it only to find and fix broken Watch links, and keep only the most recent 50,000 such events.

2.9 Consent Records

When you create an account or accept updated documents, we record the versions of the Terms of Service and Privacy Policy you accepted, your confirmation that you are at least 18, and the time. When you subscribe, we record the confirmation described in Section 2.5. We keep these records to show what you agreed to.

2.10 Invitations

If a Clutch5 administrator creates an invitation for you, we store the email address it was created for, who created it, and whether and when it was used. The invitation code itself is stored only in a form that cannot be read back. If complimentary access is added to your account, we record the kind of access, when it started and any end date, who granted it, and a short internal note.

3. Information We Do Not Collect

Clutch5 does not collect:

• your Google password;
• full payment-card numbers or security codes;
• bank-account login credentials;
• precise geolocation (GPS-level);
• health information;
• government identification numbers; or
• sensitive personal information unrelated to operating the Service.

Do not send us sensitive information we have not requested.

4. How We Collect Information

We collect information directly from you (account creation, sign-in, preferences, subscription, support contact); from Google when you choose Google sign-in; from Stripe when you purchase or manage a subscription; from a Clutch5 administrator who invites you (your email address); automatically through cookies, browser storage, service workers, and server logs; and from service providers that help us host, secure, operate, or support the Service.

5. How We Use Information

We use personal information to:

• create, authenticate, and maintain accounts and keep you signed in;
• send one-time sign-in codes when you use email sign-in;
• provide sports alerts and recommendations about games worth watching;
• remember the Service’s alert and viewing preferences;
• deliver push notifications that are requested and prevent duplicate or abusive alerts;
• provide, administer, and support paid subscriptions and process billing events;
• provide customer service and respond to requests;
• secure the Service and investigate fraud, abuse, or security incidents;
• troubleshoot alerts and Watch links, and debug, maintain, test, and improve the Service;
• comply with law and enforce our agreements;
• protect the rights, property, or safety of Clutch5, users, or others; and
• support a merger, financing, acquisition, reorganization, or sale of all or part of the business, subject to applicable law.

We may use de-identified or aggregated information for any lawful purpose. We maintain de-identified data in de-identified form and do not attempt to re-identify it.

6. Google Sign-In

If you use Google to sign in, Google authenticates you and, with your authorization, provides your email address, display name, and Google user identifier, which we use to create or recognize your Clutch5 account. Clutch5 requests only the openid, email, and profile scopes needed for sign-in.

Clutch5’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

If Clutch5 later requests additional Google permissions, we will update this Policy before using that access.

7. Passwordless Email Sign-In

Clutch5 does not use reusable passwords. In addition to Google sign-in, Clutch5 offers passwordless email sign-in, which is available in the current build.

When you sign in with your email address:

• you enter your email address and Clutch5 emails you a six-digit, single-use sign-in code;
• the code is short-lived and expires a short time after it is issued (currently ten minutes) and is invalid once used;
• Clutch5 stores a cryptographic hash of the code, not the code itself, together with the email address, issue and expiry times, a count of failed attempts, and whether it has been used;
• repeated incorrect attempts invalidate the code; and
• the sign-in message is delivered by a third-party transactional email provider (currently Resend). Clutch5 writes the message with no marketing content, no links, and no tracking pixels, and open and click tracking are turned off for our sending domain.

Clutch5 does not store a password for your account because none exists.

8. Web Push Notifications

If push notifications are enabled, your browser or operating-system vendor (Apple, Google, Mozilla, or Microsoft) operates the push-delivery service. Clutch5 sends each notification to that service encrypted for your device. A notification contains sports information such as the teams, score, time remaining, the kind of alert, and a link to the game or streaming service chosen from your streaming selections. It does not contain your name, email address, or account identifier.

Notifications can be disabled at any time through browser or device settings and through Clutch5 settings.

9. How We Disclose Personal Information

We disclose personal information only as reasonably necessary to operate the Service, when you direct us to do so, or as otherwise described below.

Service providers acting on our behalf or supporting the Service include:

• Railway — application hosting and infrastructure, including the database;
• Cloudflare — DNS, network delivery, and security for the Clutch5 website; email routing for mail sent to our published support address; and storage of our encrypted backups (Cloudflare R2, see Section 12);
• Google — authentication if you choose Google sign-in; and, through Google Workspace (Gmail), hosting of the mailbox that receives and stores support mail forwarded from our published support address;
• Stripe — payment processing and billing if you subscribe;
• Resend — a transactional email provider used to deliver sign-in codes; and
• browser and operating-system push services (Apple, Google, Mozilla, Microsoft) — notification delivery if push is enabled.

Sports-data sources are not recipients. Clutch5 obtains scores, schedules, rankings, listings, and betting prices from third-party sports-data sources. Clutch5 requests that data on its own behalf; it does not send them any information about you.

Third-party destinations you choose. When you follow a link to a broadcaster, streaming service, league, or team, your browser communicates directly with that third party. That third party may receive technical information ordinarily sent by a browser, including IP address and browser information, and may receive referral information depending on the destination and browser behavior. Clutch5 does not add your account email, internal Clutch5 user identifier, or any tracking or affiliate code to outbound links.

Professional advisers and authorities. We may disclose information to lawyers, accountants, insurers, auditors, security advisers, regulators, law enforcement, or courts when reasonably necessary or legally required.

Business transactions. Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of the Service to a successor or affiliated entity, subject to applicable law.

10. No Sale of Personal Information; No Targeted Advertising

Clutch5 does not sell personal information, has not sold personal information in the preceding 12 months, and does not share personal information for cross-context behavioral advertising. We do not use third-party advertising cookies, advertising pixels, or data brokers, and we do not knowingly sell or share the personal information of anyone under 16.

If we later introduce targeted advertising or practices that constitute “selling” or “sharing” under applicable law, we will update this Policy and provide legally required choices, including a “Do Not Sell or Share My Personal Information” link, before those practices begin.

11. Cookies and Similar Technologies

Clutch5 uses cookies and similar technologies that are necessary or functional: one sign-in cookie, a service worker, browser push subscriptions for notifications, small amounts of browser storage for an optional setting and on-device diagnostics, and security cookies that our infrastructure or payment providers may set on their own pages.

We do not use non-essential analytics or advertising cookies. See the Cookie Policy for details, including a table of the technologies in use.

12. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account and billing records, complying with legal obligations, resolving disputes, preventing fraud, and enforcing agreements.

Our current retention practices are:

Where this table says a record is “not yet removed automatically,” we intend to add automatic removal, and will update this Policy when we do. We may retain aggregated or de-identified information for longer periods where permitted by law.

13. Account Deletion and Data Requests

You may request deletion of your Clutch5 account by emailing [email protected] from the email address associated with your account. There is not yet a delete button in the app; until there is, the support-email process is the way to delete your account, and our team carries out the deletion.

Responding to your request and completing the deletion are two different steps, and they have different timing.

Responding. We will verify your request as reasonably necessary and respond within the time required by applicable law.

Completing the deletion. After a request is verified, Clutch5 will generally aim to complete a verified account-deletion request within 45 days. We may request an extension or take additional time where permitted by applicable law, including when reasonably necessary to verify the request, complete technical deletion processes, preserve legally required records, address security or fraud concerns, resolve disputes, or comply with legal obligations.

Deletion is subject to legal and operational exceptions. We may retain information where reasonably necessary to comply with law, maintain tax or billing records, detect or prevent fraud or abuse, exercise or defend legal claims, enforce agreements, or maintain security and integrity. Information retained under one of these exceptions is kept only for as long as that purpose reasonably requires.

What account deletion removes. Deleting your Clutch5 account removes the records held against it, including your saved sports and notification preferences and other account settings, your sign-in sessions, your registered notification devices and their push subscriptions, the notification records described in Section 2.4, and sign-in code and invitation records for your email address. Records that identify only a sporting event, and never an account — such as the note that an alert for a given event was already in progress — are not account information and are not removed. Entries in the alert decision log are overwritten in normal operation (Section 12).

Subscriptions are handled first, separately. Cancelling a paid subscription does not wait for your data to be deleted. The fastest way is to cancel it yourself in Clutch5 Settings (Manage subscription); that takes effect at once. If you ask us to delete your account, our team cancels any active subscription in Stripe as soon as we have verified your request, before and separately from deleting your data. This is done by hand, so it is not instant; if a renewal date is close, cancel it yourself as well. See the Subscription Terms, Section 5.

What we may keep. Under the exceptions above, we may keep records of what you agreed to (Section 2.9) and billing records where the law requires or allows it.

Backups. Deleted information can remain in our encrypted backups until those backups expire, about 14 days after they were made (Section 12). Backups are used only to recover the Service after data loss.

Deletion record. So that a deleted account is not brought back if we ever have to recover from a backup, we keep a record that the account was deleted: its internal identifier and the dates of the request, the subscription cancellation, and the deletion. It contains no email address or name. It is written to our backup storage, separately from the database, before your account is deleted. We keep it for at least 90 days after the deletion, and for as long as any backup made before the deletion is still kept. If we restore a backup, we first re-apply every deletion in this record to the restored copy, before the restored Service sends any notification or lets anyone sign in. We do not restore a backup this record cannot cover.

When a Google-authenticated Clutch5 account is deleted, Clutch5 will remove the association between the Clutch5 account and the Google identifier stored in Clutch5 systems, subject to the same legal exceptions. Revoking any separate Google-side authorization is managed through the user’s Google account.

14. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including HTTPS/TLS in transit, hashed storage of session tokens and one-time sign-in codes, access controls, secret management, and the security controls of our infrastructure providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for the security of the email account, Google account, browser, and device you use to access Clutch5.

If we become aware of a security incident affecting your personal information, we will notify you and any regulators as required by applicable law.

15. Children

Clutch5 is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will close the account and delete the associated personal information promptly, except records we must keep by law. If you believe a minor has provided us personal information, contact [email protected].

16. Additional Information for U.S. State Residents

Residents of California, Texas, and other U.S. states with comprehensive privacy laws may have the rights described below, depending on the law, applicable thresholds, and exemptions. Clutch5 will honor verified requests to the extent required by applicable law and may voluntarily honor additional reasonable requests.

16.1 Categories of Personal Information (preceding 12 months)

We do not sell or share personal information. We do not use or disclose sensitive personal information.

16.2 Your Rights

Depending on your state, you may have the right to: know/access the personal information we hold; correct inaccurate information; delete your information; obtain a portable copy; opt out of sale, sharing, targeted advertising, or profiling (we do not engage in these); limit use of sensitive information (we do not collect it); and appeal a decision on your request.

16.3 How to Exercise Rights

Submit a request by emailing [email protected]. You can also write to us at FlipCard LLC, 5900 Balcones Drive, STE 100, Austin, Texas 78731. There is not yet a self-service download of your data; we provide copies on request. We verify requests by confirming control of the email address on the account and may request additional information for higher-risk requests. An authorized agent may submit a request on your behalf with written authorization; we may also require you to confirm your identity directly.

We respond within the period required by applicable law. Where a state law provides an appeal right, you may appeal a denial by replying to our decision email with “Appeal” in the subject line, and we will handle the appeal within the legally required period. You may also have the right to contact your state attorney general or other regulator.

We do not discriminate against you for exercising privacy rights.

16.4 Global Privacy Control

Clutch5 does not sell personal information or share personal information for cross-context behavioral advertising. Because we do not currently engage in practices to which a GPC opt-out would apply, a Global Privacy Control signal does not change how we process your data today. If our practices change, we will update our handling of recognized preference signals as required by applicable law.

16.5 California “Shine the Light”

We do not disclose personal information to third parties for their direct-marketing purposes.

16.6 Nevada

We do not sell covered information as defined under Nevada law. Nevada residents may submit an opt-out request to [email protected].

17. Users Outside the United States

Clutch5 is operated from the United States and is directed to users in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your location. Clutch5 does not currently market the Service to residents of the European Economic Area, United Kingdom, or Switzerland; if that changes, we will add the disclosures those laws require.

18. Changes to This Policy

We may update this Policy as the Service changes. The version and last-updated date at the top indicate the current version.

If changes are material, we will provide notice by email, within the Service, or on our website at least 30 days before they take effect. We will not use previously collected personal information in a materially different manner without first notifying you and, where required, obtaining your consent.

19. Contact

For privacy questions, account deletion, or privacy requests:

Clutch5 — operated by FlipCard LLC
Email: [email protected]
Website: https://clutch5.app

Postal address: FlipCard LLC, 5900 Balcones Drive, STE 100, Austin, Texas 78731.