This policy explains what personal information Runtime LLC ("Statpad", "we", "us") collects when you use Statpad, why we collect it, who we share it with and the choices you have. We have tried to describe what our systems actually do rather than everything a data company could do. If something here is unclear, email paul@statpad.dev.
- Who we are and what this covers
- What we collect
- How we use it
- Legal bases (EEA and UK)
- Who we share it with
- How long we keep it
- Security
- Your rights
- US state privacy rights
- International transfers
- Children
- Athletes and sports data
- Changes to this policy
- Contact
Who we are and what this covers
Statpad is a live sports data API for developers and businesses. Runtime LLC operates it and is the controller of the personal information described here. This policy covers:
- the marketing site at statpad.dev;
- the documentation at statpad.dev/docs;
- the customer portal at app.statpad.dev, where you sign up, manage API keys and billing, and see usage; and
- the REST and WebSocket API at api.statpad.dev.
It does not cover the sites and services of third parties you reach from Statpad, such as Stripe's hosted checkout or the sign-in pages of Google and GitHub, which have their own privacy policies. It also does not cover how you, as our customer, handle the personal information of your own users. If you build an app on the API, you are responsible for your own privacy notice to them.
What we collect
We collect only what we need to run the service. Here it is, grouped by where it comes from.
Account and sign-in
Sign-in to the portal is handled by Clerk, our authentication provider. You can sign in with a one-time code sent to your email address, or with your Google or GitHub account. We do not use passwords. Through Clerk we receive:
- your email address, which must be verified before you can use the portal;
- if you sign in with Google or GitHub, the basic profile information that provider shares, such as your name, username, email address and profile picture. We do not receive your Google or GitHub password, and we do not request access to your repositories, contacts or other account data;
- a Clerk user identifier, which links your sign-in to your Statpad account; and
- information Clerk processes to keep sessions secure, such as session cookies, device and browser details, and IP address. Clerk handles this as our service provider.
When you first sign in, we create a customer record that holds your name, email address and the date you joined, linked to your Clerk user identifier.
Profile details
During sign-up we ask for your full name and, optionally, what you are building (for example a bot, a scoreboard or a fantasy tool). Your name is stored with your Clerk account and on your customer record. Your answer about what you are building is stored with your Clerk account and is used to pick a relevant quickstart example for you. You can skip it.
Billing
Payments are handled by Stripe through Stripe Checkout and the Stripe billing portal. Your card details are entered on Stripe's pages and go directly to Stripe. They never reach our servers, and we cannot see your full card number or security code.
To set you up as a Stripe customer we send Stripe your name, email address and our internal account identifier. From Stripe we receive and store your Stripe customer identifier and the state of your subscription: plan, billing interval, status, current period dates, trial end date, any scheduled plan change and any scheduled cancellation. We also record the identifiers of the Stripe events we have processed so each is applied only once. Stripe holds your payment method, billing address if you provide one, invoices and payment history, and may use some of this for its own fraud prevention as described in its privacy policy.
API keys and API usage
When you create an API key, we store:
- a hash of the key and a short, non-secret prefix used to look it up. The full key is shown to you once, when you create it, and we cannot recover it afterwards;
- the name you give the key; and
- when the key was created, when it was last used (updated at most about once a minute) and when it was revoked, if it was.
When you call the API, we record:
- a count of the requests your account has used in the current billing period, and rate-limit counters, which we use to enforce your plan's allowance and to show your usage in the portal; and
- a short operational log line for each REST request, containing a request identifier, the HTTP method, the path (for example the league and game requested), the response status and how long it took. Our application logs do not record your API key, query string, IP address or user agent. When something fails, the log line may include your account identifier so we can investigate.
Requests to the API reach us through Cloudflare, which processes your IP address and request headers to route traffic and to protect the service from attacks and abuse.
WebSocket connections
While a WebSocket connection is open, we hold in memory which account it belongs to and which games or leagues it has subscribed to, and we lease connection and subscription capacity against your plan's limits. Our logs record aggregate counts, such as how many connections were open, opened and closed. When a connection or subscription has a problem, a log line may name the stream involved (for example a game) and an internal connection identifier, but not your account, key or IP address.
Support and other contact
If you email us at paul@statpad.dev, we receive your email address, your message and anything you attach, and we keep the conversation so we can help you and refer back to it.
The marketing site and docs
statpad.dev is a static site. It uses no analytics, no advertising or tracking cookies, and no third-party scripts. The only thing it stores in your browser is your light or dark theme choice, kept in local storage if you use the theme switch, and it never leaves your device. Like any web server, Cloudflare, which serves the site, processes your IP address and request details to deliver pages and protect against abuse.
The documentation under /docs is hosted by Fern and served through our domain. Fern may use its own cookies or analytics to operate and measure the documentation, under its own terms with us.
Cookies and browser storage in the portal
The portal at app.statpad.dev uses cookies set by Clerk that are strictly necessary to keep you signed in. It also stores small pieces of state in your browser: in session storage, a note that lets you return to the right step after Stripe Checkout, and in local storage, your light or dark theme choice and the pairing of an old and a new API key while you rotate keys, which never contains a key secret. The portal does not use analytics or advertising cookies.
How we use it
We use personal information to:
- create and secure your account, and sign you in;
- issue, verify and revoke API keys, and serve the data you request;
- enforce plan limits, count usage and show it to you;
- process payments, start and end trials, and apply upgrades, downgrades, renewals and cancellations;
- send transactional email about your account, such as a reminder before a trial converts to a paid plan;
- answer support requests;
- keep the service reliable, investigate errors and outages, and plan capacity;
- detect and prevent fraud, abuse and violations of our Terms of Service, such as shared keys or repeated trials;
- improve the product, using usage figures in aggregate; and
- comply with law, including tax and accounting obligations, and protect our rights and those of others.
We do not use your information for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Legal bases (EEA and UK)
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:
- Contract. Most processing is needed to provide the service you signed up for: your account, keys, API access, usage metering, billing and account emails.
- Legitimate interests. We have a legitimate interest in securing the service, preventing fraud and abuse, keeping operational logs, improving the product, answering questions sent to us, and publishing sports information (see Athletes and sports data). We balance these interests against your rights and keep the data involved to a minimum.
- Legal obligation. We keep billing and tax records and respond to lawful requests where the law requires it.
- Consent. Where we rely on consent, such as the optional answer about what you are building, you can withdraw it at any time without affecting processing that happened before.
Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with the service providers that help us run Statpad, under contracts that limit their use of it to providing services to us:
| Service | Purpose | Location |
|---|---|---|
| Cloudflare | DNS, TLS, content delivery, firewall and DDoS protection, the secure tunnel to our servers, hosting of statpad.dev and app.statpad.dev, and sending transactional email | United States, with a global network |
| Amazon Web Services | Servers that run the API, operational logs and metrics, and backups | United States (Ohio) |
| PlanetScale | Managed Postgres database that holds account, key, usage and subscription records | United States (Virginia, on AWS) |
| Clerk | Sign-in, email verification codes, social sign-in and session management | United States |
| Stripe | Payments, subscriptions, invoices and the billing portal | United States |
| Fern | Hosting the documentation | United States |
If you choose to sign in with Google or GitHub, that provider knows you used it to sign in to Statpad. It acts under its own privacy policy, not as our service provider.
We may also disclose personal information:
- if the law requires it, or in response to a valid legal request such as a court order or subpoena;
- to protect the rights, property or safety of Statpad, our customers or the public, including to investigate fraud or abuse;
- to a buyer or successor if we are involved in a merger, acquisition, financing or sale of assets, in which case the information stays subject to this policy's protections until you are told otherwise; and
- with your permission or at your direction.
We send transactional email only: messages about your account, your keys, your trial, your subscription and your usage. For example, if you start a trial we email you three days before it converts to a paid plan, and we may tell you when your usage nears or reaches your plan's allowance. Sign-in codes are sent by Clerk, and receipts and payment notices by Stripe. We do not send marketing email. If that ever changes, we will ask first and every message will have an unsubscribe link.
How long we keep it
We keep personal information only as long as we need it for the purposes above:
- Account, profile and API key records are kept while your account exists. Cancelling a subscription does not delete your account. When you ask us to delete it, we delete or anonymize these records, except where we must keep something for the reasons below.
- Usage counters cover only the current billing period and expire automatically about a day after the period ends. Copies may remain in our backups for up to 30 days.
- Subscription and billing records are kept for as long as tax, accounting and other legal obligations require, which is typically up to seven years after the transaction. Stripe keeps its own records under its policies.
- Operational logs are kept on our servers for about a week and in our log service for 14 days, then deleted.
- Backups of our servers are kept for up to 30 days and are overwritten on a rolling basis, so deleted data can persist in backups until they expire. Our database provider's backups expire on its own schedule.
- Support emails are kept for as long as they are useful for helping you, and generally no longer than three years after the conversation ends.
- Sign-in data held by Clerk is kept while your account exists and deleted when we delete your account.
We may keep information longer if we need it to resolve a dispute, enforce our terms or meet a legal requirement.
Security
We take reasonable technical and organizational measures to protect personal information, including:
- storing API keys only as one-way hashes, so a database leak would not expose usable keys;
- never handling card data, which goes directly to Stripe;
- passwordless sign-in through Clerk, with verified email addresses;
- encrypting traffic in transit with TLS, and reaching our servers only through a secure tunnel, with no open inbound ports;
- restricting internal access to the people who need it, behind strong authentication, and keeping internal tools read-only where possible; and
- keeping secrets, keys, tokens and email addresses out of our application logs.
No system is perfectly secure, and we cannot guarantee the security of information sent over the internet. You are responsible for keeping your API keys secret, which means keeping them on your server and out of public code. If you think a key has been exposed, revoke it in the portal and create a new one. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.
Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct information that is inaccurate or incomplete;
- delete your information;
- port information you gave us, in a structured, machine-readable format;
- object to or ask us to restrict processing based on our legitimate interests; and
- withdraw consent where we rely on it.
You can see your keys, usage and subscription in the portal, revoke keys there, and update your payment details in the Stripe billing portal linked from it. For anything else, including correcting your name or email address and deleting your account, email paul@statpad.dev from the address on your account. Account deletion is handled by request today: we cancel any active subscription, revoke your keys, delete your sign-in account with Clerk and delete or anonymize your records as described in How long we keep it.
We will respond within the time the law allows, usually within 30 days, and we may need to verify your identity first, typically by confirming the request from your account email. We will not charge you for a reasonable request. If you are in the EEA or UK, you also have the right to complain to your local data protection authority, though we would appreciate the chance to address your concern first.
US state privacy rights
If you live in California or another US state with a comprehensive privacy law, this section applies to you in addition to the rest of this policy. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes described above:
- Identifiers, such as your name, email address, account and Clerk identifiers, Stripe customer identifier and API key prefixes;
- Customer records and commercial information, such as your plan, subscription and trial history, and the optional answer about what you are building;
- Internet or other network activity, such as API usage counts, request logs, key last-used times, and session and device information processed by Clerk and Cloudflare.
We disclose these categories only to the service providers listed in Who we share it with, for the business purposes described in this policy. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16. We do not collect sensitive personal information for the purpose of inferring characteristics about you. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, though we do neither.
You can ask to know what we collect, use and disclose, and to access, correct or delete it, using the contact details in Your rights. You may use an authorized agent, who must show us your signed permission, and we may still ask you to verify your identity directly. If we deny your request, you may appeal by replying to our decision, and we will explain the result of the appeal in writing. We will not discriminate against you for exercising these rights.
International transfers
Statpad is run from the United States, and our service providers store and process data in the United States. If you use Statpad from outside the United States, your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the UK addendum to them, or a provider's certification under the EU-US Data Privacy Framework.
Children
Statpad is a tool for developers and businesses. It is not directed to children, and accounts are for adults only. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email paul@statpad.dev and we will delete it.
Athletes and sports data
The data Statpad publishes through the API is sports information: schedules, scores, play-by-play, statistics, rosters, injury and roster status, transactions and depth charts. Some of it is about identifiable people, mostly athletes and sometimes coaches or officials. It can include names, team, position and jersey number, statistics and biographical details such as date of birth, birthplace, height, weight, college and draft history, along with injury designations as publicly reported.
We compile this information from third-party and publicly available sources about professional and college sports. It is not an official league feed, and Statpad is not affiliated with or endorsed by any league, team or players' association. We publish it because it is already public and is of legitimate interest to fans, the media and the developers who build on Statpad, and we do not combine it with information about athletes' private lives.
If you are an athlete or represent one and believe information we publish about you is inaccurate, or you want to exercise a privacy right over it, email paul@statpad.dev. We will look into it, correct errors, and respond to requests as the law requires. Because our customers receive the data through the API, we cannot recall copies they already hold, but corrections reach them in later updates.
Changes to this policy
We may update this policy as Statpad changes or the law requires. We will post the new version here and update the date at the top. If a change materially affects how we handle your personal information, we will tell you before it takes effect, by email or in the portal. Continuing to use Statpad after a change takes effect means the updated policy applies to you.
Contact
For privacy questions, requests or anything else, email Runtime LLC at paul@statpad.dev.