We collect what we need to run the Service and nothing else. We don’t sell your data. You can ask us to delete your account at any time.
Section 01
TBredIQ ("we", "us") publishes independent thoroughbred race intelligence at tbrediq.com. This policy describes what personal information we collect, how we use it, and the limited circumstances under which we share it.
Section 02
Email address (for account creation and the daily card). Display name (optional). Payment information — processed by Stripe; we never see or store full card numbers. Anything you write to us at support@tbrediq.com.
IP address, browser user-agent, referring URL, requested URL, response status. We use these to operate the site, prevent abuse, and produce aggregate usage analytics. We do not maintain a per-user behavioral profile beyond what’s necessary for these operational purposes.
Strictly necessary cookies for session and authentication. A first-party analytics cookie for aggregate usage. We do not use third-party advertising or cross-site tracking cookies.
Section 03
To deliver the Service: send the daily card, process subscriptions, restore your account when you sign in. To operate the Service: rate-limit, prevent fraud, fix bugs. To improve the Service: aggregate usage analysis. We do not use your data for advertising and we do not build advertising profiles.
Section 04
With service providers we contract to operate the Service — Stripe (payments), SendGrid (email delivery), our hosting provider, our error-tracking provider. Each is bound by a data-processing agreement that limits use of your data to providing services to us.
If we’re legally required to disclose information — a subpoena, a court order — we will. We do not sell your data and we do not "share" it for cross-context behavioral advertising under California law.
Section 05
Depending on where you live, you have the right to access, correct, port, delete, or restrict the processing of your personal information. California residents have additional rights to know and to opt out of "sale" or "sharing" (we don’t do either). EU and UK residents have rights under the GDPR / UK GDPR.
To exercise any of these rights, email privacy@tbrediq.com from the address on your account. We aim to respond within 30 days.
Section 06
Account data: kept while your account is active and for 90 days after deletion, then erased. Payment records: kept for the period required by tax and accounting law (typically seven years). Server logs: rotated after 30 days unless retained for security investigation.
Section 07
HTTPS everywhere. Passwords stored as bcrypt hashes. Production data encrypted at rest. Access limited to operators on a need-to-know basis. No system is perfectly secure; we will notify affected users of any breach without undue delay as required by law.
Section 08
The Service is not directed to anyone under the age of majority in their jurisdiction. We do not knowingly collect data from children. If you believe a child has provided us data, contact privacy@tbrediq.com and we will delete it.
Section 09
We may update this policy. Material changes will be announced on the site and to subscribed users by email at least 30 days before they take effect. Continued use after the effective date is acceptance.