Privacy Policy

Parlotto. Effective October 10, 2026.

The short version. Parlotto asks for your email to sign in. No password, no name, nothing else. We keep the address and the tickets you save against it. We do not sell data. On the website we measure our own X ads with X's pixel and a report we send X, described under "Measuring our X ads". The iPhone app sends X nothing. We take no bets: every ticket is placed by you, at a licensed sportsbook, in that book's own app.

What we collect

Your email. Enter it and we email you a six-digit code. Typing the code signs you in. It works once and expires in 15 minutes. No password. It's what your account is; there's no anonymous way to use Parlotto past the front door.
Email from us. Besides the sign-in code, we send a few things. When your Pass starts, a guide, then a short run of setup guides. Once, a note if you sign in and leave without doing anything. Once, a note the day after a checkout you did not finish. A note to you when a friend signs in through your invite link. The morning tickets email is off. The setup guides and the sign-in follow-up have a link at the foot that turns them off. The checkout note and the friend-joined note do not.
A signed session cookie. From your first visit, a cookie called pl_uid holds a random signed id. When you sign in it points at your account. It is only used to know who you are.
The tickets you save. The legs, the book, the stake and odds you entered, and how each leg settled. Saving a ticket is your choice; nothing is saved as a ticket when you only look at the board. When you tap Load, we hold that ticket for 72 hours so we can ask whether you placed it. It becomes a saved ticket only if you say yes.
Your state, if you pick one. Saved on your account and in your browser, so a new phone opens on the same books. It filters the board you asked for.
Where you came from. If you arrive through a Parlotto post or link, or from another site, we keep which one with your account when it is created, to count which posts work. If you come through a friend's invite link, we keep who invited you.
Picks you report as suspended. Kept against your account until the game starts.
Application logs. Our server logs specific events, such as a ticket tracked, a pack built or an error, with a timestamp, for debugging and reliability. It does not log your IP address or a record of every page you visit. A log line can include your email address, for example when we send you a guide.
Your IP address. It is held in memory for a short time to slow down repeated sign-in attempts and other repeated requests. The address that asks for a sign-in code is also saved with that code's record, and removed when you delete your account. On the website it is also sent to X, as described under "Measuring our X ads".

What we do not collect

No name, phone number, date of birth, payment details or password. Your email is the only thing we ask for.
No location beyond the state you choose yourself. We do not use your device's location.
No social media login, and no advertising network other than X (see "Measuring our X ads").
Nothing from the sportsbooks. When you tap into a book, you are in that book's app under that book's own privacy policy. We do not see what you do there, whether you placed a bet, or what you won or lost, unless you come back and tell us by saving or updating a ticket.

Cookies and local storage

Our only cookie is pl_uid, as described above. It is signed so it cannot be forged, marked HttpOnly so scripts cannot read it, and it lasts up to a year, or until you sign out or clear it, whichever comes first. On the website, X's pixel is a script loaded from X, and it can set cookies of its own. X's privacy policy covers those. Local storage holds small settings such as your state choice and any tickets you starred. Clearing it does not sign you out or remove your tickets, both of which live on our server against your email.

Sharing

We share data only with the services that do a job for us. Stripe handles a card purchase on the web. Apple and RevenueCat handle a purchase in the iPhone app (see "Purchases in the iPhone app" below). Resend delivers our email, so it sees your address and the message. Cloudflare carries traffic between your device and our server and counts page views with its Web Analytics. That sees your IP address, your browser and the page you opened, and sets no cookies. Novig, an exchange whose prices we show on some tickets, sees your IP address and browser when you open one of its tickets. X receives what is listed under "Measuring our X ads". If Parlotto later earns a referral fee when you open an account with a sportsbook, the link you tap will say so, and the only thing that travels with it is a code identifying Parlotto, never anything identifying you.

Retention

Saved tickets stay until you remove them. A ticket you remove is deleted, not archived. Application logs record what happened and are not on a fixed deletion schedule today. The IP address saved with a sign-in code is deleted a day after the code expires. An address that asks for a sign-in code and never finishes signing in is deleted after a day. Activity counts are kept for about a year. An encrypted backup of the accounts database is taken nightly and kept for 30 days, so a deleted account can remain in a backup for up to 30 days before it is gone everywhere.

Your choices

Remove any ticket from My Tickets at any time.
Sign out at any time. It clears the cookie on that device without deleting your account, your tickets, or your email. Signing in again with the same address brings all of it back.
Delete your account, your email, and every ticket on it, entirely and permanently, any time. In the iPhone app, use Delete account at the foot of My Tickets. On the website, use the Contact support link at the bottom of the page once you are signed in. See "Deleting your account" below for exactly what that does.

Age and where this applies

Parlotto is for adults of legal sports betting age in their state, which is 21 in most states and 18 in some. It is not directed at anyone under 18, and we do not knowingly keep information about anyone under 18. Whether you may bet, and where, is a matter between you and the licensed sportsbook.

Security

Traffic to Parlotto is encrypted (HTTPS). The identity cookie is signed with a secret held only on our server. We keep the minimum, so there is little to lose.

Changes

If this policy changes, the date at the top changes with it, and a change that affects what we collect will be announced on the board before it takes effect.

What we measure

Parlotto keeps its own count of a few things that happen in the app: which tabs are opened, which sportsbook a ticket is loaded into, when the Pass is offered and bought, when a ticket is tracked. Each count is tied to your account id, or to a random visitor id before you sign in, and it is used only to decide what to build next.

Measuring our X ads

We advertise on X, and on the website we measure those ads with one report sent from our server. No X script loads in your browser. The iPhone app sends X nothing. We use the report only to measure Parlotto's own X ads. We do not sell it. What X does with it is covered by X's privacy policy.

A report we send X from our server. When you first sign in with a new address, we send X a SHA-256 hash of your email address (not the address itself), your IP address, your browser's user agent (a line of text that names your browser and device), and the address of the page you were on if your browser sends it. When you track a ticket, we send the same, plus the entry amount and the ticket's id. Later sign-ins and looking at the board are not reported.

Deleting your account

In the iPhone app, Delete account at the foot of My Tickets does it at once. On the website, use Contact support at the bottom of the page once you are signed in and we do it for you. Either way it cancels a Pass bought on the web, then removes your tickets, alert subscriptions, activity counts and the account itself, permanently, and asks RevenueCat to delete the purchase record it holds for you. A Pass bought in the iPhone app is billed by Apple and cannot be cancelled by us: cancel it in Settings > Apple Account > Subscriptions, or Apple keeps charging you after the account is gone. Stripe and Apple keep the payment records the law requires them to keep; we keep none. What we already sent X from the website stays with X, and we cannot delete it from there.

Purchases in the iPhone app

Purchases in the iPhone app are processed by Apple. RevenueCat, the subscription service we use to confirm them, receives your account id and the purchase receipt Apple issues, along with what any app service sees, such as an IP address and a device identifier. It receives no name, email or card details from us. We use it only to know whether your Pass is active, and it is not used for advertising or tracking.

Contact

Questions about this policy: [email protected].