Privacy Policy

1. Who we are

v1Labs LLC, doing business as Neutral Zone Labs (“NZL”, “we”), is the controller of personal data described in this policy. Contact:

2. What we collect

• Account data. Email address, and an authentication identifier from our sign-in provider. If you sign in with Google, we receive your email address and basic profile information from Google, not your Google password.
• Billing data. Credit purchases and the running record of credits added and spent. Card details are collected and held by Stripe; we receive only a customer reference and the outcome of a payment.
• Product data. The simulations you run: the game, the situation, any assumptions you set, and the questions you asked.
• How you arrived. If you reach us through a link that carries campaign information, we record it when you create an account, so we can tell which campaigns bring people here. This is one first-party cookie and it never leaves our own site. See section 7.
• Download records. The time, type, and size of each data export you request, associated with your account.
• Technical data. Ordinary server logs generated when you use the site, including IP address, browser type, and pages requested.

We do not collect special-category data, and we do not ask for it. Please do not send it to us.

3. Why we use it

• To provide the service, authenticate you, show you what you are entitled to, and deliver the data. Legal basis: performance of a contract.
• To take payment and keep your credit balance. Legal basis: performance of a contract.
• To enforce our terms. We monitor per-account download volume to detect redistribution and resale, which our terms prohibit. Legal basis: legitimate interests, protecting a product whose entire value is that it is not freely available. We consider this proportionate because it uses volume and timing only, not the content of what you do with the data.
• To keep the service secure and working, diagnose faults, prevent abuse. Legal basis: legitimate interests.
• To contact you about service changes, billing, and, only with your consent, anything promotional.

4. What we do not do

• We do not sell your personal data.
• We do not share it with advertisers or data brokers.
• We do not use it to build behavioral profiles for advertising, and we do not track you across other websites.
• We do not report your activity to any sportsbook, exchange, league, or employer, except where compelled by law.

5. Processors we rely on

We use third parties to run the service. Each acts on our instructions under a data processing agreement.

• Firebase Authentication (Google), sign-in and identity.
• Stripe, payments.
• Vercel, application hosting and file storage.
• Neon, database hosting.

These providers may process data outside your country, including in the United States. Where required, transfers rely on Standard Contractual Clauses or another approved mechanism.

6. Where our data comes from

The figures on this site are built from licensed and public sources. These are suppliers we read FROM, not processors: no personal data about you reaches any of them, and none of them acts on our instructions with respect to you. They are listed because you are entitled to know what the numbers are made of.

• The Odds API, sportsbook prices, under a licence permitting use inside a user-facing application. We do not redistribute their data as a standalone feed.
• Kalshi, prices from the exchange’s public market data.
• ESPN, live game state during a game: score, clock and situation.
• nflverse, historical play-by-play, rosters and schedules, which the simulation is fitted on.

7. Cookies

We use two, both set by us and read only by us.

• A session cookie to keep you signed in. It is necessary for the service to work and cannot be disabled while you are logged in.
• An arrival cookie recording how you first reached the site, such as the campaign a link belonged to. If you create an account we copy it onto that account and it is covered by your deletion rights. If you never create one, it stays in your browser and reaches us only if you sign up, and clearing your cookies removes it. We do not set it at all for visitors in the EEA or the UK, or for anyone whose browser sends a Global Privacy Control signal.

We use no third-party cookies, no advertising or analytics cookies from anyone else, and nothing that follows you to other websites.

8. Retention

• Account and credit data: while your account is open, then up to 12 months.
• Billing records: as long as tax and accounting law requires, typically six to seven years.
• Download records: 24 months. Detecting resale requires seeing patterns over a season, and a shorter window would defeat the purpose.
• Server logs: 90 days.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict processing; and to withdraw consent. If you are in the EEA or UK, you may complain to your supervisory authority. If you are in California, you may exercise rights under the CCPA/CPRA, including the right to know and to delete, and note that we do not sell or share personal information as those terms are defined there.

You can delete your own account from your account page, without asking us. It removes your email address, your sign-in, and the campaign identifier described in section 7, and you will not be able to sign in again. For anything else, contact us at the address above. We will respond within the period the applicable law requires. We will not discriminate against you for asking.

Note that deleting your account does not delete billing records we are legally required to keep, nor download records still within their retention window where we rely on them to enforce our terms.

10. Security

We use encryption in transit, restrict internal access, and delegate credential and card handling to specialist providers. No system is perfectly secure, and we do not claim otherwise. If a breach affects your data and the law requires notification, we will notify you and the relevant authority within the required timeframe.

11. Children

The service is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes

We may update this policy. Material changes will be notified in the product or by email before taking effect. The date at the top always reflects the current version.