Privacy Policy

This policy explains what Unlimitable LLC ("Unlimitable", "we", "us") collects when you use unlimitable.app and our members area, alerts and tools (the "Service"), why we collect it, who we share it with, how long we keep it, and the choices you have.

The short version. We collect only what the Service needs to work.

• We do not sell your personal information, share it for targeted advertising, or use advertising cookies.
• We do not see your card details.
• Our analytics are cookieless. They load nothing when your browser sends Do Not Track or Global Privacy Control.
• You can download your saved bets at any time, and you can ask us to delete your data.

1. Who we are and what this covers

Unlimitable LLC, an Illinois limited liability company, runs the Service and is responsible for the personal information described here. Questions or requests go to [email protected].

This policy does not cover Whop. Whop runs our sign-in, checkout and billing. When you buy a membership or sign in, Whop collects information under its own privacy policy, including your name, email, payment details and billing address. The same goes for sportsbooks, prediction markets and other sites we link to.

2. What we collect, and why

a. When you sign in (from Whop)

You sign in with your Whop account. We ask Whop for two permissions: who you are (openid) and your email address (email).

• Whop user id. We use it to recognize you, to check with Whop that your membership is active, and to keep your saved bets, settings and Lab work attached to you.
• Email address. Whop may share it because we ask for the email permission. Today we do not store it in our database and we do not use it.
• Membership status. On each members request we ask Whop whether your membership is active. We remember the answer for 5 minutes, in a signed cookie (see section 4).
• Sign-in tokens. Whop's access token and refresh token are kept only in secure cookies on your device. Page scripts cannot read them (see section 4).

b. Membership and payment events (from Whop)

When a membership starts, ends or is paid, Whop sends us a signed notice (a webhook). From each notice we store:

• the kind of event and when it happened;
• your Whop user id;
• the Whop ids of the membership, plan and product;
• for payments, the amount, the currency and Whop's billing reason (for example, a first payment or a renewal); and
• the partner (affiliate) id, if Whop sends one.

We never store your name, email, phone number, card details or anything you wrote in a cancellation note. We use these records to know our revenue, to count members by plan, to support you with billing questions, to keep accounting and tax records, and to pay partner commissions correctly.

c. Your saved bets

When you save a bet from the board, we store:

• the facts of the board row: game, teams, start time, player, market, side and line;
• the book, the price you entered and your stake;
• when you saved it;
• our fair chance for that side at the moment you saved it;
• the bet's value at your price, before and after the book's per-bet fee at your stake; and
• after the game: the result, the grade, your profit or loss, and our closing price and closing line value.

You tell the board which state you are in, so it can work out the book's fees there. The state is used to compute the fee and is not stored with the bet.

If you are not signed in, bets you save stay on your device. The first time you sign in, they upload to your account if their games have not started.

We use this to show you Your record and Your week, to grade your bets, and to enforce the limits you set.

d. Your limits and settings

If you set them, we store your bankroll, your maximum stake per bet, your daily loss limit, any break you started and when it ends, and any loosened limit still waiting to take effect. We use these only to apply your limits when you save a bet, and to keep the board quiet when you have asked for a pause.

e. The Strategy Lab and the Parlay Lab

• Systems. We store each system you build: the name you type, its rules, the state it is priced in, its results, and the bets it matches going forward.
• The assistant. When you use the Lab's AI assistant, we store the conversation: what you type and what the assistant replies. Each turn is sent to Anthropic, the maker of the Claude model, so it can write the next reply (see section 5). We send Anthropic the conversation and our Lab data. We do not send your name, your email or your Whop id.
• Assistant logs. For each assistant request we also keep a log without your words: when it happened, whether it worked, and how many tokens it used. We use this to apply the daily limit and to track our costs.
• Chasing losses. If what you type reads like chasing losses (for example, a sum you want to win back), the assistant does not answer. You see a plain message and a helpline instead, and nothing is sent to Anthropic.

Please do not type personal details, account numbers or passwords into the assistant.

f. Push alerts (only if you turn them on)

If you turn on alerts on a device, your browser gives us a push address for that device from its push service (Google, Mozilla, Apple or Microsoft) and two encryption keys. We store those, your Whop user id, the state you chose on the board (alerts are per state), and the time of the last alert sent to that device. A member can have up to five devices. We use this only to send you alerts. Each alert is encrypted for your device before it is handed to the push service.

g. Usage counts

To see whether members come back, our server counts five moments:

• you loaded the board;
• you opened a price card;
• you ran a Lab system;
• you opened Your week; and
• you saved a bet.

Each count is stored per day, per member (your Whop user id) or, for anyone not signed in as a member, as "visitor". These counts include no IP address, device, page address or browser data. When we read them to measure retention, members appear without their ids.

h. Product analytics (PostHog, cookieless)

We use PostHog to understand which pages and features people use. We set it up to collect as little as possible.

• No storage on your device. It sets no cookies and uses no local or session storage. There is no session recording, no heatmaps, no automatic capture of clicks or typing, and no surveys.
• Only a fixed list of events, for example a page opened, a Join button clicked, or a sign-in started, finished or failed. Each event carries only the properties on our list.
• Each event can carry:
  • the event's name and its listed properties (such as which page, which plan, why a sign-in failed, a book or market key, a count of legs, or the length of a search, never its words);
  • the sport you chose;
  • a device size bucket (phone, tablet, laptop or desktop);
  • the page's address without its query or fragment;
  • the referring website's address, without its path or search terms;
  • your browser and its version, your operating system and device type;
  • your browser's language, your timezone, and your screen and window sizes;
  • your browser's user agent; and
  • the analytics library's name and version.
• What we remove before anything is sent:
  • search words from a search engine's referrer;
  • the page title;
  • campaign tags and click ids;
  • "first touch" data; and
  • any person profile.
• Your IP address. Events go through our own site first and then to PostHog with your IP address. PostHog uses it, with your user agent and our site, to make a one-day visitor count: a hash with a salt that PostHog changes every day and then deletes. The same person on two different days counts as two visitors. PostHog may also derive an approximate location (country, region, city) from the IP address.
• We never send PostHog your name, email, Whop user id, saved bets or anything you type.
• Membership counts. When Whop tells us a membership started or ended, our server also sends PostHog that event, with the plan and Whop product id only, under one fixed id that is not you.
• Do Not Track and Global Privacy Control. If your browser sends either signal, analytics does not load and nothing is sent.

i. Protecting the free price check

To stop abuse of the free price check, we count requests by IP address (for IPv6, by its first 64 bits). Each count lives in a short sliding window and is deleted about a minute after your last request.

j. Hosting and security logs

Our site and servers run on Cloudflare. Like any web host, Cloudflare processes each request's IP address, browser user agent, the address requested and the time, to deliver the Service and protect it from attacks. It does this under its own policies. We do not turn on stored request logs for our functions today. If we do, they are kept for 7 days at most.

k. Information kept on your device

The site stores your preferences in your browser's local storage, on your device. They are sent to us only as described in this policy. They include:

• your theme;
• your odds format;
• the state you chose;
• your sportsbooks, and which venues you want to see;
• your usual stake;
• your bet slip and parlay tray;
• a Lab draft;
• which alerts you have seen; and
• if you are signed out, the bets you saved.

The state you chose is sent with a price card request, a bet save (to work out fees, not stored with the bet), a Lab system, and an alerts sign-up. You can clear this storage at any time in your browser settings.

l. When you contact us

If you email us, we keep your email address, your message and our reply, to answer you and keep a record.

m. Partners

Whop runs our partner program and tracks referrals. We see what Whop shows us about partners and the members they referred. Whop's own terms and policy cover the information partners give Whop.

3. What we never collect

• No government ids, Social Security numbers, bank account or card numbers. Whop handles payments and we never see your card.
• No sportsbook or prediction market logins, passwords or API keys.
• No precise location. We never ask for GPS. We know only the state you choose.
• No contacts, photos, microphone or camera.
• No biometric data.
• No advertising identifiers, advertising cookies, third-party ad pixels or session recordings.

4. Cookies and similar technology

We use only the cookies that sign-in needs. They are strictly necessary, so the Service cannot work without them. Every one is HttpOnly (page scripts cannot read it), Secure (sent only over HTTPS) and SameSite=Lax.

Signing out clears them and tells Whop to cancel the refresh token.

What we don't use. We use no advertising or tracking cookies, and our analytics uses no cookies. The browser storage described in section 2k holds only your own settings. Whop's checkout and sign-in pages are on Whop's site and set Whop's own cookies under Whop's policy.

5. Who we share information with

We do not sell personal information. We do not share it for cross-context behavioral advertising or targeted advertising. We share it only with the service providers who run the Service for us, as needed for their job:

Anthropic. Under its commercial terms, Anthropic does not train its models on what we send. It deletes API inputs and outputs within 30 days, unless content is flagged under its usage policy or the law requires longer retention.

Our data suppliers (The Odds API, licensed league data providers, official injury reports) receive no information about you.

Beyond these providers, we may disclose information:

• to comply with law, a subpoena or a court order;
• to protect the rights, safety and security of our members, us or others, or to investigate fraud or abuse; and
• as part of a merger, acquisition, financing or sale of our business, in which case this policy, or one at least as protective, will continue to apply to your information.

6. How long we keep it

When you ask us to delete your data, we delete it sooner (section 8), except what the law requires us to keep, such as payment records.

7. How we protect it

• Sign-in tokens are only in secure, HttpOnly cookies. Sign-in uses Whop's OAuth with PKCE, and our session values are signed so they cannot be forged.
• Encryption in transit. All traffic uses HTTPS. Alerts are encrypted for each device.
• Access. Our databases are reachable only by our own functions and our data jobs, using secret tokens.
• No payment data. We hold no card data and no sportsbook credentials.

No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.

8. Your rights and choices

Wherever you live in the US, you can ask us to:

• access the personal information we hold about you, and get a copy;
• correct it if it is wrong;
• delete it; and
• get a portable copy. Your saved bets download any time from Your record as a CSV file.

How to ask. Email [email protected] from the email on your Whop account, or tell us your Whop username. To protect you, we confirm the request is yours. We may ask you to sign in with Whop or reply from that email. You can use an authorized agent; we will ask for proof that you gave them permission.

When we answer. We will answer within 45 days. If we need more time, we will tell you why, and take at most another 45 days.

If we say no. If we decline your request, we will explain why. You can appeal by replying to that email with "Appeal" in the subject line. We will answer the appeal within 45 days. If you are still not satisfied, you can contact your state attorney general.

We do not:

• sell your personal information;
• share it for targeted or cross-context behavioral advertising; or
• use it for profiling that produces legal or similarly significant effects.

So there is nothing to opt out of. If that ever changes, we will update this policy first and give you a way to opt out.

No discrimination. We will not charge you more or treat you differently for using these rights.

Other choices:

• Alerts. Turn them off in the board's Alerts panel or in your browser's settings.
• Analytics. Turn on Global Privacy Control or Do Not Track in your browser, and analytics will not load.
• Device storage. Clear your browser's site data for unlimitable.app.

California residents. You have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to opt out of its sale or sharing (we do neither). In the last 12 months we collected:

• identifiers (Whop user id, IP address, push address);
• commercial information (membership plan and payments, saved bets);
• internet activity (the analytics and usage data above); and
• general location (the state you choose).

We collected them for the purposes in section 2, from you, from Whop and from your browser, and disclosed them only to the providers in section 5. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you.

Nevada residents. We do not sell covered information. You can still email us to opt out of any future sale.

9. Do Not Track and Global Privacy Control

We honor both signals. When your browser sends Do Not Track or Global Privacy Control, our analytics does not load and sends nothing. We treat Global Privacy Control as a request to opt out of sale and sharing; we already do neither. Sign-in still works, because it needs only the strictly necessary cookies in section 4.

10. Children and young people

The Service is only for adults 21 and older. It is not directed to children. We do not knowingly collect personal information from children under 13, or from anyone under 21. If we learn that we have, we will delete it and close the account. If you believe a child or anyone under 21 is using the Service, tell us at [email protected].

11. United States only

The Service is offered only in the United States. We store and process information in the United States. Our providers may process it in other countries where they operate; Cloudflare's network, for example, is global. If you use the Service from outside the US, your information will be handled under this policy and US law.

12. Changes to this policy

When we change this policy, we will update the date at the top. If a change is material, we will tell you before it takes effect, by a notice on the site or in the members area and, where we can, through Whop. If a change would let us use your information in a materially different way from what we said when we collected it, we will ask for your consent first where the law requires it.

13. Contact

Unlimitable LLC, [email protected]