Privacy Policy

ColesAlgoPicks ("the site," "we") operates nascar.colesalgopicks.com (The NASCAR King) and related subdomains. This page describes what data we collect, why, and what your rights are.

Short version: we don't sell your data, we don't run ads, we don't share with third parties beyond what's needed to run the product. We collect the minimum required, and you can delete your account anytime.

What we collect

• Anonymous browsing: by default, nothing personal — we use your browser's localStorage for app state (watchlist, slips, tracker). That data lives on your device only.
• If you sign in with Discord (optional): we receive and store your Discord user ID, username, display name, and avatar URL — solely to identify you across devices and to determine your access. We use the identify scope (plus the read of your membership/role needed to grant access); no access to your messages, friends, or anything else.
• Account data: your synced app state, session tokens (hashed), and any profile fields you explicitly set.
• Server logs: standard Cloudflare HTTP logs (IP, user-agent, request URL, timestamp) used for abuse detection and uptime monitoring, retained briefly and then auto-deleted by Cloudflare.

What we don't collect

• No payment or card data. Subscriptions are processed by Winible as merchant of record — your card details go to Winible (and its payment processor), never to us. We never see or store your full card number.
• No third-party advertising trackers. No Google Analytics ad SDKs, no Facebook Pixel.
• No location data beyond what your IP implies for server logs.
• No background telemetry across other sites.

How we use it

• To deliver the product: cross-device sync, signed-in personalization, and granting/checking your paid access.
• To detect abuse: rate limiting, blocking malicious bots, investigating suspicious sign-in patterns.
• To improve the product: aggregate, non-identifying usage patterns — never individual behavior sold to anyone.

Who we share it with

Only the providers needed to run the service:

• Discord when you sign in — it validates your identity and access role via OAuth. Privacy policy: discord.com/privacy.
• Winible when you subscribe — as merchant of record it processes your payment and manages your subscription. Privacy policy: winible.com.
• Cloudflare hosts the site and processes every HTTP request. Privacy policy: cloudflare.com/privacypolicy.

Your rights

• Delete your account anytime — wipes your profile, sessions, and synced state. (Payment records held by Winible are subject to Winible's own policy.)
• Export your data — request a copy of everything we hold via our Discord.
• Stay anonymous — the public parts of the site work without sign-in.

Cookies

We set only first-party cookies needed to run the product. All of them are HttpOnly, Secure and SameSite=Lax. There are no third-party tracking cookies, and none of these are used for advertising, sold, or shared with anyone.

• cap_fv — set on your first visit, before and without any sign-in. It holds a randomly generated identifier and nothing else: no name, no email, no browsing history. Its only job is to count your one free page view per 24 hours before the paywall. It is set to expire after 400 days so the count survives a browser restart; clearing your cookies removes it and simply resets your free view.
• cap_grant — a short-lived (15-minute) signed token that lets you re-open the page your free view was spent on without spending another.
• A session cookie, set only if you sign in with Discord.
• A short-lived CSRF token, used during the Discord sign-in flow.

The same free-view limit is also enforced per network address, so that clearing cap_fv does not hand out unlimited views. We do not store your IP address to do it: we store a salted SHA-256 hash of it combined with the current date, which changes every day and cannot be turned back into an address.

Contact

Questions, data requests, or concerns: open a ticket in our Discord.

Changes to this policy

We'll update the "Last updated" stamp and post a notice if anything material changes. We won't retroactively reduce protections on data you've already shared.