Privacy Policy

ColesAlgoPicks ("the site," "we") operates cfb.colesalgopicks.com (The College King) and related subdomains. This page describes what data we collect, why, and what your rights are.

Short version: we don't sell your data, we don't run ads, we don't share with third parties beyond what's needed to run the product. We collect the minimum required, and you can delete your account anytime.

What we collect

• Anonymous browsing: by default, nothing personal — we use your browser's localStorage for app state (watchlist, slips, tracker). That data lives on your device only.
• If you sign in with Discord (optional): we receive and store your Discord user ID, username, display name, and avatar URL — solely to identify you across devices and to determine your access. We use the identify scope (plus the read of your membership/role needed to grant access); no access to your messages, friends, or anything else.
• Account data: your synced app state, session tokens (hashed), and any profile fields you explicitly set.
• Server logs: standard Cloudflare HTTP logs (IP, user-agent, request URL, timestamp) used for abuse detection and uptime monitoring, retained briefly and then auto-deleted by Cloudflare.

What we don't collect

• No payment or card data. Subscriptions are processed by Winible as merchant of record — your card details go to Winible (and its payment processor), never to us. We never see or store your full card number.
• No third-party advertising trackers. No Google Analytics ad SDKs, no Facebook Pixel.
• No location data beyond what your IP implies for server logs.
• No background telemetry across other sites.

How we use it

• To deliver the product: cross-device sync, signed-in personalization, and granting/checking your paid access.
• To detect abuse: rate limiting, blocking malicious bots, investigating suspicious sign-in patterns.
• To improve the product: aggregate, non-identifying usage patterns — never individual behavior sold to anyone.

Who we share it with

Only the providers needed to run the service:

• Discord when you sign in — it validates your identity and access role via OAuth. Privacy policy: discord.com/privacy.
• Winible when you subscribe — as merchant of record it processes your payment and manages your subscription. Privacy policy: winible.com.
• Cloudflare hosts the site and processes every HTTP request. Privacy policy: cloudflare.com/privacypolicy.

Your rights

• Delete your account anytime — wipes your profile, sessions, and synced state. (Payment records held by Winible are subject to Winible's own policy.)
• Export your data — request a copy of everything we hold via our Discord.
• Stay anonymous — the public parts of the site work without sign-in.

Cookies

We set only first-party cookies needed to run the product — a session cookie (HttpOnly, Secure) set only if you sign in, and a short-lived CSRF token used during the Discord sign-in flow. No third-party tracking cookies.

Contact

Questions, data requests, or concerns: open a ticket in our Discord.

Changes to this policy

We'll update the "Last updated" stamp and post a notice if anything material changes. We won't retroactively reduce protections on data you've already shared.