Privacy Policy

Last updated: May 19, 2026

Plain version: SportsCal is a paid sports calendar. We collect the minimum we need to run the service, charge you, send you transactional emails, and keep the site working. We do not sell your data. We do not rent it. We do not share it with data brokers or ad networks. We do not build advertising profiles about you. If that ever changes, we'll tell you in writing before it does and you can delete your account.

1. Who runs this

SportsCal is operated by 920four LLC (the "we", "us"). Contact: sportscal@920four.com.

2. What we collect, and why

• Email address. Required to create an account, send calendar links, send receipts, and handle password resets. This is the only piece of personal information we require.
• Name and password. Only if you provide them. Passwords are hashed (we never see or store the plain text).
• Payment details. When you pay, you enter card information directly into Stripe's checkout. We never see your full card number — Stripe sends us back only a customer ID, the last 4 digits, and the brand so we can show "Visa ••3742" on your account page.
• Calendar subscription tokens. Each calendar feed has a unique URL containing a random token. We store the token, which teams or leagues you picked, and your timezone, so we can serve the right schedule.
• IP address and basic request metadata. Logged when you visit the site or when a calendar app fetches your feed. Used to keep the service running, detect abuse, and enforce one-account-per-subscription (see §4).
• Usage analytics. Anonymous page views and clicks via Google Analytics 4 and an X (Twitter) conversion pixel on a few marketing pages, so we can see what's working. No login state, no email, no calendar contents are sent to either.
• Error reports. If something on the site crashes, Sentry captures the error and a stack trace. We've configured it to strip cookies, headers, and form values.

That's the complete list. If a field isn't above, we don't collect it.

3. What we do NOT do

• We do not sell your personal information. Not to advertisers, not to data brokers, not to "marketing partners". Not for any price.
• We do not share your email with anyone outside of the strictly necessary service providers listed in §4 (and only the information each one needs to do its job).
• We do not build an ad profile about you. We don't track you across other websites. We don't drop third-party advertising cookies on your browser.
• We do not read your calendar. We generate the feed; your calendar app downloads it. We don't pull data back from Google, Apple, or Outlook.
• We do not train AI models on your account data.

4. Who we share data with (and exactly what they get)

We use a small number of service providers to run the business. Each gets only what they need:

• Stripe (payments) — your card details, billing email, and country. We never see the full card. Stripe's privacy policy: stripe.com/privacy.
• Resend (transactional and product emails) — your email address and what we're sending you (receipt, calendar link, password reset, occasional product update). Every marketing email has a one-click unsubscribe link; we'll still need to send service emails like receipts and security notices.
• Google Analytics 4 (web analytics) — anonymous page-view events from your browser, plus the IP address Google sees (Google anonymizes IPs for GA4 by default). We don't push your email or user ID to GA.
• X (Twitter) conversion pixel — on a handful of marketing pages (the homepage, pricing, this page, and terms), so we can measure ad effectiveness. It sees that your browser visited the page. If you don't want that pixel to load, block third-party scripts from ads-twitter.com — the site keeps working.
• Sentry (error monitoring) — stack traces and the URL that failed. We've turned off captures of request bodies, cookies, and form values.
• API-Sports (the data source for schedules) — receives no information about you. We just pull public schedule data from them on a cron.
• Telegram — only relevant if you choose to link your account to our Telegram bot. In that case Telegram receives messages you send the bot and we receive your Telegram user ID. Don't link a Telegram account and Telegram is not involved.
• Hosting — the servers that run sportscal.io and the database that stores your account. They see traffic but don't operate on your data beyond keeping the machines running.

If we ever add a new provider that touches your personal data, we'll add it to this list before they start touching your data.

5. Calendar link sharing detection

Calendar feeds are tied to a paid account. To detect feeds being shared with people who didn't pay, we keep a rolling log of which IP addresses fetched which feed and how often. If a single feed is being pulled from many different networks, we may pause the account and email you to ask about it. We don't sell or share this data — it's only used to enforce one-account-per-subscription.

6. Cookies and local storage

• Auth cookie / token. So you stay signed in. Strictly necessary.
• Preferences (timezone, dark mode). Stored in your browser only.
• Analytics cookies. Google Analytics sets a _ga cookie. You can block it; nothing on the site breaks.

There are no third-party advertising cookies.

7. Your rights — and how to actually use them

Wherever you live, the following options are available to anyone with a SportsCal account, by emailing sportscal@920four.com from the address on your account:

• See what we have on you. We'll send back the data on your account in JSON or CSV within 14 days.
• Delete your account. We'll delete your account record, your calendar tokens, and your subscription preferences immediately. Stripe payment records are kept for tax/accounting reasons (7 years, per US law). Server logs roll off in 90 days.
• Correct anything wrong. Email and we'll fix it.
• Opt out of marketing email. Unsubscribe link in every marketing email. We'll still send transactional email (receipts, security, schedule-change notices) until you delete your account.

If you're in the EU/UK (GDPR) or California (CCPA/CPRA), those laws give you the same set of rights. The mechanism above is how you exercise them. We don't sell personal information, so there's nothing to opt out of "selling" — but the form still works if you'd like a "do not sell" record on file.

8. Data retention

• Account record, calendar tokens, subscription preferences: kept while your account is active. Deleted within 7 days of account deletion.
• Stripe payment records: retained 7 years (US tax/accounting requirement).
• Server logs (including IP addresses): 90 days rolling.
• Analytics: GA4 retention is set to 14 months.
• Email contents (Resend): retained for 12 months for deliverability/troubleshooting, then purged.

9. Security

The site runs on HTTPS only. Passwords are hashed with bcrypt. Database access is restricted to the application server. We use Stripe for payments specifically so we never have to store card data. No system is bulletproof, but we'll tell you within 72 hours if we discover a breach that affects you.

10. Children

SportsCal isn't designed for or marketed to children under 13. We don't knowingly collect personal information from anyone under 13. If you think a child has signed up, email us and we'll delete the account.

11. Changes to this policy

If we change something material — adding a new third party that gets your data, changing what we collect, or anything that narrows your rights — we'll email everyone with an account at least 30 days before it takes effect, and you can delete your account before then. We'll keep an honest changelog of edits at the bottom of this page.

12. Contact

Privacy questions, deletion requests, or anything that needs a human: sportscal@920four.com. We aim to reply within two business days.