Privacy policy

• Your email address and OAuth profile. When you sign in with Discord, Google or Apple we receive your email address, a display name and an avatar image URL from that provider, plus the provider's own account identifier. We never receive or ask for your password at any provider. If you use Sign in with Apple and choose to hide your address, we only ever see the Apple private relay address and that is all we store.
• What you save in the app. Bets you log or import, picks you track, filters and price alerts you set, and any public capper profile you choose to create.
• Marketing consent. Only if you tick the optional box: whether you opted in, the moment you did it, and where you did it (sign up or account settings). We store that so we can prove the opt-in was real.
• Fantasy league connections. When you sync a league we store which platform it is on (Sleeper, Yahoo, ESPN, CBS or MyFantasyLeague), the league and team identifiers, and your roster, either in this browser or on your account if you are signed in. For Yahoo we keep the access tokens Yahoo issues so we can read your league; for a private ESPN, CBS or MyFantasyLeague league, the cookie, token or session that platform gave you, used only to read that league.
• Email and push sign-ups. If you give us an address for the weekly email or the Yahoo sync notice, or turn on push notifications, we store the address or the browser's push subscription and the team it is for.
• Questions you ask Parlae. The text of a question and the answer, kept as a thread you can delete.
• Usage analytics. Page views and product events (which tools are used, whether a sync worked) recorded by Parlae itself, plus standard server request logs. With your consent where the law requires it, PostHog also records clicks, page views and session replays, with everything you type masked. Advertising cookies set by Google and its partners are covered in the Advertising section below.
• Outbound link clicks. If you follow a link to a sportsbook we record that a click happened, which book it was and which page it came from, so we can be paid correctly and audit our own rankings.
• A device and browser fingerprint. Once per browser per day we collect a detailed technical profile of your device and send it to a research dataset run by TBU Pro, a separate company. It is not linked to your account and nothing in Parlae reads it back. It is the most invasive thing on this page, so it has its own section below, including how to switch it off.

The email address and provider identifier exist so an account can exist: so your bets, filters and alerts follow you to another device, and so we can reach you about your account if something breaks. Saved bets and picks exist because they are the product. Analytics tell us which pages are worth keeping. Click records exist because that is how the site is funded, and because our honest ranking claim has to be auditable.

We send marketing email only to people who ticked the optional box. Signing in does not opt you in, and nothing in the app is gated on marketing consent.

A visitor who allows it has a detailed technical profile of their device and browser collected once shortly after the page loads, and sent to a public ingest endpoint run by TBU Pro at tbupro.com. In the EEA, the UK and Switzerland, and anywhere we cannot tell where you are, it runs only after you consent to measurement and to device scanning in Google's consent message. Elsewhere it runs unless you reject it there, use the switch below, or send a Global Privacy Control signal. TBU Pro stores it and a separate research project analyses it. Nothing in Parlae reads it back, it is never joined to your account, and it has no effect on the odds, prices or picks you see.

This is fingerprinting, and it is thorough: the combination of values below identifies a device without any cookie. We run TBU Pro's collector unmodified, so a device already recorded elsewhere is recognised as the same device instead of being recorded twice. The collection runs twice per capture, once on the page and once on a background worker thread, because the two report slightly different values.

It runs at most once per browser per day, only on a secure connection, and only in a browser that lets us save the setting below - if your browser blocks site storage we cannot record your choice or enforce that daily limit, so we do not collect at all.

What the capture contains

• Browser identity: user agent, platform, browser vendor, language list, and the client hints your browser exposes, including CPU architecture, device model, platform version and full browser version, plus the legacy app-version string and whether a Chrome extension bridge is present.
• Hardware: CPU core count, approximate device memory, maximum touch points.
• Display: screen and available screen size, colour and pixel depth, pixel ratio, orientation and window size.
• Graphics: WebGL vendor and renderer strings including the unmasked GPU identifiers, driver and shader versions, the full list of supported graphics extensions, and around twenty numeric capability limits. These are the most identifying values in the capture.
• A canvas rendering hash. Your browser draws a fixed test image off-screen and we send numeric hashes of the resulting pixels, plus the measured pixel width of the test string in a named font - a font-rendering signal in its own right. Small differences in how your GPU, drivers and fonts draw it are highly distinctive. The image itself is never sent and nothing appears on the page you are looking at.
• An audio rendering hash. Your browser renders a short tone through an audio compressor entirely in memory and we send a hash of the result, a sum of its sample values, the sample rate and the output latency. This is a rendering test, not a recording: your microphone is never accessed and no sound is played.
• Environment signals: whether the browser reports itself as automated, and a count and hash of the names defined in the browser's global scope, which changes with the extensions you have installed. We receive the count and the hash, never the names or any list of your extensions.
• Locale: time zone, resolved locale and winter/summer UTC offsets.
• Network: connection type, estimated round-trip time and downlink, data-saver flag.
• Storage: the storage quota your browser offers this site, how much is used, and the per-subsystem breakdown of that usage. Numbers only, never the contents.
• Display preferences: wide-colour support, reduced motion, dark mode, fine pointer, hover.
• Diagnostics: which of the above checks failed or were blocked, this site's origin, and whether the page was served securely and cross-origin isolated.
• Your IP address, recorded by the receiving endpoint from the connection itself.

What it does not contain

• No cookies or session data. The request is sent with credentials omitted.
• No account, profile, email or sign-in identifier, and no logged-in state.
• No page address, referrer or browsing history beyond this site's origin. It cannot show anyone which Parlae pages you viewed.
• No canvas or audio content, only the hashes described above, which cannot be turned back into an image or a sound.
• No microphone, camera, location, contacts, clipboard, battery or file access.
• No list of your installed fonts or extensions. Note that the canvas measurement above is still a font-rendering signal, even though we never enumerate your fonts.
• No bets, picks or anything you typed into the site.

TBU Pro derives a fingerprint by hashing nine of these values together - platform, CPU cores, device memory, language, the four unmasked GPU strings and time zone - and keeps one row per distinct fingerprint. A device already in the table is discarded rather than recorded again, so the dataset shows that a device has been seen, not how often you visit or what you did. Because those nine values describe a class of hardware rather than a person, two identical devices with identical settings become a single row, and changing your time zone or updating a graphics driver creates a new one.

We take no money for your personal data. We do not sell, rent or trade it, and we do not hand your email address or account details to data brokers or advertising networks. The advertising cookies described in the Advertising section are set by Google and its partners in your browser, not shared from our records.

We do share two things, and we would rather name them than hide behind that sentence. First, the ordinary providers needed to run the site: our hosting and database provider, our email sending provider, and the sign-in provider you chose, all listed by name under Service providers below. Second, and more significant: the device fingerprint described above goes to TBU Pro, a separate company, which keeps it and provides it to a research project. That transfer is for their research purposes, not ours - we get nothing back from it and no money for it.

Some privacy laws, including California's, define selling or sharing broadly enough that a transfer like that one can count even where no money changes hands. We are not going to argue the point in a footnote. Treat the fingerprint transfer as something you can refuse: the switch above stops it, so does the "Do Not Sell or Share My Personal Information" link at the foot of every page, and we honour Global Privacy Control, which is the browser signal those laws use for opting out. Sportsbooks receive an anonymous tracking code when you follow a link, never your email address.

We use Google AdSense to show ads on Parlae. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.

We pass your cookie choice to Google through Google Consent Mode. Until you accept Advertising, and whenever you reject it, Google is told not to use advertising cookies or personalise ads, and it shows non-personalised or limited ads instead. In the EEA, the UK and Switzerland that is the starting point for every visitor.

You can opt out of personalized advertising in Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info/choices or youradchoices.com.

For how Google handles this information, see How Google uses information from sites or apps that use our services.

The first time you visit from the EEA, the UK or Switzerland, or from anywhere we cannot place, Google's certified consent message asks before anything optional runs, and until you choose only strictly necessary storage is used. PostHog runs there only if you consent to device storage and to measurement (IAB TCF purposes 1, 8 and 9) in that message; the device research capture also needs your opt-in to device scanning (special feature 2), and stays off if the message does not ask for it. Everywhere else, including the United States, the optional purposes are on by default: Cookie settings opens our own panel, where "Reject all" and "Accept all" sit side by side, to turn them off, and a Global Privacy Control signal turns them off for you.

• Strictly necessary (always on): your sign-in session, the teams and settings you saved in this browser, your theme, and the parlae_consent cookie that remembers this choice for about six months.
• Analytics: PostHog product analytics and session replay. Not loaded at all until allowed.
• Advertising: cookies Google AdSense and the Google Ads tag use to personalise and measure ads.
• Device research: the TBU Pro device capture described above.

Change your mind any time with "Cookie settings" at the foot of every page. "Do Not Sell or Share My Personal Information", beside it, switches all three optional purposes off in one tap. Both apply to the browser you use them in.

These companies process personal data for us to run the site. Each receives only what its job needs.

• Lovable - application hosting, the transactional and weekly email we send, and the AI gateway that answers questions you ask Parlae (it passes the question text to the underlying model provider).
• Supabase - our database and sign-in sessions, through Lovable Cloud.
• Cloudflare - the network in front of the site, which handles every request and sees your IP address and approximate country.
• Google - AdSense ads and the Google Ads tag (subject to your consent), Google Fonts (which receives your IP address when it serves the site's typefaces), and Sign in with Google if you choose it.
• PostHog - product analytics and session replay, only with your consent where the law requires it.
• Apple and Discord - Sign in with Apple and Sign in with Discord, if you choose them. We also use a private Discord channel to tell our team a new account was created; it shows the display name and a masked email.
• Sleeper, Yahoo, ESPN, CBS and MyFantasyLeague - the platforms your synced leagues come from. We ask them for your league data using the identifiers or credentials you gave us.
• Your browser's push service (for example Google, Mozilla or Apple) - delivers the notifications you turned on.
• TBU Pro - receives the device capture described above, for its own research, subject to your consent.

• Account data (email, profile, saved bets and picks): until you ask us to delete it.
• Marketing consent records: kept while the account exists, including after an opt-out, because the record of the opt-out is the proof that we stopped.
• Outbound click records: about 180 days, then purged automatically.
• Device fingerprints: no automatic expiry today. TBU Pro runs no retention window on that dataset, so rows persist until someone deletes them by hand. Ask us and we will have yours removed.
• Odds, scores and other market data: kept on rolling windows measured in hours to days and pruned automatically. It is not personal data.

• Device fingerprinting: use the switch in the section above, or turn on Global Privacy Control in your browser, which we honour automatically and which overrides that switch, or reject "Device research" in Cookie settings. Outside the EEA, the UK and Switzerland the capture runs by default a few seconds after a page opens, so this browser may already have been recorded once. The switch stops every future capture, but it cannot recall that first one: to have it deleted, email hi@parlae.io.
• Marketing email: turn it on or off any time in account settings, or use the unsubscribe link in any email we send.
• Cookies, ads and analytics: Cookie settings at the foot of every page, as described above.
• Deletion and a copy of your data: see Your rights, below.

You can ask for a copy of the personal data we hold about you, in a machine-readable format, ask us to correct it, or ask us to delete it. Email support@parlae.io from the address on the account, or, if you never made an account, tell us the email address you gave us. There is no charge. We may ask one question to confirm the request is really yours.

We reply within 30 days and confirm when it is done. Deletion removes your account and profile, your saved bets, picks, alerts and Ask threads, your synced leagues and saved teams with any platform tokens or credentials stored for them, your email and push sign-ups, and your marketing consent record, and we ask TBU Pro to remove any device capture you identify. Ordinary server logs age out on their own schedule.

You can remove a synced league yourself at any time from My Team, and disconnect Yahoo from the same page. If you live in the EEA, the UK or Switzerland you can also complain to your local data protection authority; we would rather you wrote to us first.

Parlae is for adults only. The site is intended for people 18 and over and we do not knowingly collect data from anyone under 18. If you believe a minor has an account, tell us and we will remove it.

If we change what we collect or why, we change this page. Questions, deletion requests and privacy complaints all go to hi@parlae.io.

See also our terms of use.