Privacy Policy

1. Scope

This Policy applies to personal information processed by Clutch5 in connection with the Service.

It does not govern third-party websites or services you choose to visit, including Google, Stripe, broadcasters, streaming platforms, leagues, teams, or prediction-market services (such as Kalshi or Polymarket). Those services apply their own privacy policies.

2. Information We Collect

2.1 Account and Identity Information

If you create or use a Clutch5 account, we process:

• email address;
• display name;
• an internal Clutch5 user identifier;
• the name of the authentication provider you used (for example, Google), where applicable;
• a stable provider-side user identifier used to recognize the same account on future logins, where applicable; and
• account creation and update timestamps.

If you sign in with Google, Google provides basic profile information (email, name, provider identifier) as part of the sign-in flow. Clutch5 does not receive your Google password and does not store Google access or refresh tokens after your identity is verified.

2.2 Session and Security Information

To keep you signed in and protect the Service, we process:

• a session identifier;
• a cryptographic hash of your session token (the raw token is stored only in an HTTP-only cookie in your browser);
• session creation and expiration times;
• short-lived, single-use authentication state used to prevent login forgery;
• security and fraud-prevention signals; and
• request metadata reasonably necessary to secure and operate the Service.

A Clutch5 sign-in session is currently intended to last up to 90 days unless you log out sooner or the session is invalidated.

2.3 Sports and Notification Preferences

The Service stores the sports, leagues, conferences, teams, players, tournaments, or events selected for monitoring; alert sensitivity and notification settings; streaming service or viewing preferences; and other personalization settings.

How these are stored. Your preferences are stored against your Clutch5 account. Each account has its own saved selections; one person’s choices do not change what anyone else sees or is alerted about. Because they are linked to your account, they can be retrieved and are deleted when your account is deleted.

An account that has not saved any selections has no stored preference record at all. That is different from having saved an empty selection, which is a choice we keep as you made it.

2.4 Push Notification Information

If Web Push notifications are enabled, Clutch5 processes the push subscription generated by the browser. Depending on the browser and push service, this can include a push-service endpoint, cryptographic keys used by the browser push protocol, notification-permission status, and records reasonably necessary to avoid duplicate alerts.

How this is stored. A push subscription is stored against your Clutch5 account and against the individual browser or device it came from. You can have notifications switched on for more than one device at the same time; each is a separate record, and turning notifications off on one device does not affect the others or anyone else’s.

Notification records we keep. To send an alert to the right people once, and to retry a device that did not receive it, Clutch5 records:

• for your account: which sporting event an alert related to, the kind of alert, and when your account was first alerted about it;
• for each of your devices: which event an alert related to, when delivery was attempted, how many attempts were made, and whether the push service accepted it, is still being retried, or was given up on.

These records associate a sporting event, a time, and a delivery status with your account and with a particular device. They exist so the same alert is not sent to you repeatedly and so a device that missed one can be tried again.

“Delivered” means accepted by the push service, not seen by you. The only thing Clutch5 can observe is whether the browser’s push service accepted the message for onward delivery. We do not know, and do not record, whether a notification was displayed, opened, read, or dismissed.

Linking a device to your sign-in session. When you switch notifications on, Clutch5 also stores an identifier derived from your current sign-in session alongside that device’s record. It is used for one purpose: so that logging out on that browser also switches notifications off for it, without affecting your other devices. It is not used to decide whether to send you an alert — alerts continue to arrive when the app is closed and when you are not signed in — and simply closing the app or letting a session expire does not switch notifications off.

Clutch5 does not collect notification-open or click analytics for personalization. If we later begin using notification interaction analytics beyond what is necessary to open the destination you selected or prevent duplicate alerts, we will update this Policy before using that information for analytics or personalization.

2.5 Subscription and Billing Information

If you purchase a paid subscription, payment processing is handled by Stripe. Clutch5 receives and stores only limited billing information: a Stripe customer identifier, Stripe subscription identifier, subscription status, product or price identifier, current billing-period dates, transaction or webhook event identifiers, and payment status or failure information.

Clutch5 does not receive or store your full payment-card number or security code. Payment card details are handled by Stripe under Stripe’s own terms and privacy policy.

2.6 Technical and Usage Information

Clutch5 and its hosting, security, and networking providers automatically process technical information that may include IP address, browser and device type, operating system, request date and time, requested URL or route, referring URL, error and diagnostic information, security logs, and general service-performance information.

Infrastructure providers may derive or make available an approximate geographic region from an IP address, such as country or state. Clutch5 does not collect GPS-level location through the Service. If Clutch5 enables location-based restrictions for particular features, we may use approximate region information to apply those restrictions and will keep this Policy consistent with that use.

2.7 Communications

If you contact us, we collect your name, email address, message, attachments, and other information you choose to provide. Support mail sent to our published address is received and handled using third-party email routing and mailbox providers, and our replies are sent using a third-party transactional email provider. See Section 9.

3. Information We Do Not Collect

Clutch5 does not collect:

• your Google password;
• full payment-card numbers or security codes;
• bank-account login credentials;
• precise geolocation (GPS-level);
• health information;
• government identification numbers; or
• sensitive personal information unrelated to operating the Service.

Do not send us sensitive information we have not requested.

4. How We Collect Information

We collect information directly from you (account creation, sign-in, preferences, subscription, support contact); from Google when you choose Google sign-in; from Stripe when you purchase or manage a subscription; automatically through cookies, service workers, and server logs; and from service providers that help us host, secure, operate, or support the Service.

5. How We Use Information

We use personal information to:

• create, authenticate, and maintain accounts and keep you signed in;
• send one-time sign-in codes when you use email sign-in;
• provide sports alerts and recommendations about games worth watching;
• remember the Service’s alert and viewing preferences;
• deliver push notifications that are requested and prevent duplicate or abusive alerts;
• provide, administer, and support paid subscriptions and process billing events;
• provide customer service and respond to requests;
• secure the Service and investigate fraud, abuse, or security incidents;
• restrict features that are unavailable in your location;
• debug, maintain, test, and improve the Service;
• comply with law and enforce our agreements;
• protect the rights, property, or safety of Clutch5, users, or others; and
• support a merger, financing, acquisition, reorganization, or sale of all or part of the business, subject to applicable law.

We may use de-identified or aggregated information for any lawful purpose. We maintain de-identified data in de-identified form and do not attempt to re-identify it.

6. Google Sign-In

If you use Google to sign in, Google authenticates you and, with your authorization, provides your email address, display name, and Google user identifier, which we use to create or recognize your Clutch5 account. Clutch5 requests only the openid, email, and profile scopes needed for sign-in.

Clutch5’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

If Clutch5 later requests additional Google permissions, we will update this Policy before using that access.

7. Passwordless Email Sign-In

Clutch5 does not use reusable passwords. In addition to Google sign-in, Clutch5 offers passwordless email sign-in, which is available in the current build.

When you sign in with your email address:

• you enter your email address and Clutch5 emails you a six-digit, single-use sign-in code;
• the code is short-lived and expires a short time after it is issued (currently ten minutes) and is invalid once used;
• Clutch5 stores a cryptographic hash of the code, not the code itself, together with the email address, issue and expiry times, a count of failed attempts, and whether it has been used;
• repeated incorrect attempts invalidate the code; and
• the sign-in message is delivered by a third-party transactional email provider (currently Resend). The message is transactional only: it contains no marketing content and no tracking pixels.

Clutch5 does not store a password for your account because none exists.

8. Web Push Notifications

If push notifications are enabled, your browser or operating-system vendor (for example, Google, Apple, or Mozilla) operates the push-delivery infrastructure. A push message may contain sports information, score information, time remaining, alert context, and a destination link.

Notifications can be disabled at any time through browser or device settings and through Clutch5 settings.

9. How We Disclose Personal Information

We disclose personal information only as reasonably necessary to operate the Service, when you direct us to do so, or as otherwise described below.

Service providers acting on our behalf or supporting the Service include:

• Railway — application hosting and infrastructure;
• Cloudflare — DNS, networking, and security features when enabled, and email routing for mail sent to our published support address;
• Google — authentication if you choose Google sign-in, and the business mailbox used to receive and handle support mail;
• Stripe — payment processing and billing if you subscribe;
• Resend — a third-party transactional email provider used to deliver sign-in codes and service email, including replies to support messages; and
• browser and operating-system push services — notification delivery if push is enabled.

Sports-data providers supply game information to Clutch5. Clutch5 does not intentionally send your account profile, email address, or billing information to a sports-data provider merely to retrieve game data.

Third-party destinations you choose. When you follow a link to a broadcaster, streaming service, league, team, or prediction-market service, your browser communicates directly with that third party. That third party may receive technical information ordinarily sent by a browser, including IP address and browser information, and may receive referral information depending on the destination and browser behavior. Clutch5 does not intentionally append your account email or internal Clutch5 user identifier to outbound prediction-market or streaming URLs.

Professional advisers and authorities. We may disclose information to lawyers, accountants, insurers, auditors, security advisers, regulators, law enforcement, or courts when reasonably necessary or legally required.

Business transactions. Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of the Service to a successor or affiliated entity, subject to applicable law.

10. No Sale of Personal Information; No Targeted Advertising

Clutch5 does not sell personal information, has not sold personal information in the preceding 12 months, and does not share personal information for cross-context behavioral advertising. We do not use third-party advertising cookies, advertising pixels, or data brokers, and we do not knowingly sell or share the personal information of anyone under 16.

If we later introduce targeted advertising or practices that constitute “selling” or “sharing” under applicable law, we will update this Policy and provide legally required choices, including a “Do Not Sell or Share My Personal Information” link, before those practices begin.

11. Cookies and Similar Technologies

Clutch5 uses cookies and similar technologies that are necessary to operate the Service: an authentication and session cookie, security cookies that may be set by our infrastructure and payment providers, and service workers together with browser push subscriptions for Web Push notifications.

We do not use non-essential analytics or advertising cookies. See the Cookie Policy for details, including a table of the technologies in use.

12. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account and billing records, complying with legal obligations, resolving disputes, preventing fraud, and enforcing agreements.

Our intended retention schedule for the public Service is:

Before public launch, Clutch5 will verify that deployed hosting, logging, and backup settings match these commitments. We may retain aggregated or de-identified information for longer periods where permitted by law.

13. Account Deletion and Data Requests

You may request deletion of your Clutch5 account by emailing [email protected] from the email address associated with your account. Clutch5 intends to add an in-product deletion control before broad public launch; until that control is available, the support-email process is the documented deletion method.

Responding to your request and completing the deletion are two different steps, and they have different timing.

Responding. We will verify your request as reasonably necessary and respond within the time required by applicable law.

Completing the deletion. After a request is verified, Clutch5 will generally aim to complete a verified account-deletion request within 45 days. We may request an extension or take additional time where permitted by applicable law, including when reasonably necessary to verify the request, complete technical deletion processes, preserve legally required records, address security or fraud concerns, resolve disputes, or comply with legal obligations.

Deletion is subject to legal and operational exceptions. We may retain information where reasonably necessary to comply with law, maintain tax or billing records, detect or prevent fraud or abuse, exercise or defend legal claims, enforce agreements, or maintain security and integrity. Information retained under one of these exceptions is kept only for as long as that purpose reasonably requires.

What account deletion removes. Deleting your Clutch5 account removes the records held against it, including your saved sports and notification preferences, your registered notification devices and their push subscriptions, and the notification records described in Section 2.4. Records that identify only a sporting event, and never an account — such as the note that an alert for a given event was already in progress — are not account information and are not removed.

When a Google-authenticated Clutch5 account is deleted, Clutch5 will remove the association between the Clutch5 account and the Google identifier stored in Clutch5 systems, subject to the same legal exceptions. Revoking any separate Google-side authorization is managed through the user’s Google account.

14. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including HTTPS/TLS in transit, hashed storage of session tokens and one-time sign-in codes, access controls, secret management, and the security controls of our infrastructure providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for the security of the email account, Google account, browser, and device you use to access Clutch5.

If we become aware of a security incident affecting your personal information, we will notify you and any regulators as required by applicable law.

15. Children

Clutch5 is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected personal information from a child under 13, we will delete it promptly. If you believe a minor has provided us personal information, contact [email protected].

16. Additional Information for U.S. State Residents

Residents of California, Texas, and other U.S. states with comprehensive privacy laws may have the rights described below, depending on the law, applicable thresholds, and exemptions. Clutch5 will honor verified requests to the extent required by applicable law and may voluntarily honor additional reasonable requests.

16.1 Categories of Personal Information (preceding 12 months)

We do not sell or share personal information. We do not use or disclose sensitive personal information.

16.2 Your Rights

Depending on your state, you may have the right to: know/access the personal information we hold; correct inaccurate information; delete your information; obtain a portable copy; opt out of sale, sharing, targeted advertising, or profiling (we do not engage in these); limit use of sensitive information (we do not collect it); and appeal a decision on your request.

The limitation described in Sections 2.3 and 2.4 affects what we are able to locate in response to a request: records the Service does not associate with an account cannot be identified as yours.

16.3 How to Exercise Rights

Submit a request by emailing [email protected]. A postal address for privacy correspondence will be published here once it is confirmed; until then, email is the way to reach us. We verify requests by confirming control of the email address on the account and may request additional information for higher-risk requests. An authorized agent may submit a request on your behalf with written authorization; we may also require you to confirm your identity directly.

We respond within the period required by applicable law. Where a state law provides an appeal right, you may appeal a denial by replying to our decision email with “Appeal” in the subject line, and we will handle the appeal within the legally required period. You may also have the right to contact your state attorney general or other regulator.

We do not discriminate against you for exercising privacy rights.

16.4 Global Privacy Control

Clutch5 does not sell personal information or share personal information for cross-context behavioral advertising. Because we do not currently engage in practices to which a GPC opt-out would apply, a Global Privacy Control signal does not change how we process your data today. If our practices change, we will update our handling of recognized preference signals as required by applicable law.

16.5 California “Shine the Light”

We do not disclose personal information to third parties for their direct-marketing purposes.

16.6 Nevada

We do not sell covered information as defined under Nevada law. Nevada residents may submit an opt-out request to [email protected].

17. Users Outside the United States

Clutch5 is operated from the United States and is directed to users in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your location. Clutch5 does not currently market the Service to residents of the European Economic Area, United Kingdom, or Switzerland; if that changes, we will add the disclosures those laws require.

18. Changes to This Policy

We may update this Policy as the Service changes. The version and last-updated date at the top indicate the current version.

If changes are material, we will provide notice by email, within the Service, or on our website at least 30 days before they take effect. We will not use previously collected personal information in a materially different manner without first notifying you and, where required, obtaining your consent.

19. Contact

For privacy questions, account deletion, or privacy requests:

Clutch5 — operated by FlipCard LLC
Email: [email protected]
Website: https://clutch5.app

A postal address for privacy correspondence will be published here once it is confirmed.