Privacy Policy

Chalked Fantasy Inc. Effective Date: March 1, 2026 Last Updated: April 1, 2026

1. Introduction

Chalked Fantasy Inc. ("Chalked," "we," "us," or "our") operates the Chalked mobile application and related services (collectively, the "Platform"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Platform.

By creating an account or using Chalked, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Platform.

Chalked is a fantasy sports competition platform. No real-money wagering takes place on the Platform.

2. Information We Collect

2.1 Information You Provide

When you create an account and use Chalked, you may provide:

Account Information: Email address, username, display name, and password.
Profile Information: Biography, avatar image, and social media handles (Twitter, Instagram, YouTube).
Age Verification: Date of birth to confirm you meet the minimum age requirement of 18 years.
Location Information: State or region of residence, provided during onboarding.

2.2 Information Collected Automatically

When you use the Platform, we automatically collect:

Device Information: Device type, operating system, app version, device manufacturer, and screen dimensions.
Usage Data: Pages and screens viewed, actions taken within the app (such as parlays submitted, leagues joined, and challenges completed), session duration, and feature interactions.
Push Notification Tokens: Device tokens used to deliver push notifications, stored securely and used solely for notification delivery.
Log Data: IP address, access times, and error logs for troubleshooting and security purposes.

2.3 Information from Third-Party Services

We use the following third-party services that may collect information:

PostHog: Product analytics including screen views, user interactions, device information, and session data. PostHog processes data in accordance with its own privacy policy.
Supabase: Authentication, database, and real-time services. Supabase processes data in accordance with its own privacy policy.
Expo (EAS): Build and update distribution services. Expo processes data in accordance with its own privacy policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

Provide and Operate the Platform: Create and manage your account, process parlay submissions, calculate league scores, settle results, and deliver the core fantasy competition experience.
Communicate with You: Send push notifications about parlay settlements, league activity, and platform updates. Send email communications related to your account, such as verification emails.
Improve the Platform: Analyze usage patterns and feature adoption to improve functionality, fix bugs, and develop new features.
Ensure Safety and Security: Detect and prevent fraud, abuse, and unauthorized access. Enforce our Terms of Service.
Age and Eligibility Verification: Verify that users meet the minimum age requirement of 18 years.
Analytics and Reporting: Generate aggregated, anonymized statistics about platform usage (such as daily active users, parlay volume, and user demographics) for internal analysis and reporting to investors and business partners. These reports never contain individually identifiable information.

4. How We Share Your Information

4.1 We Do Not Sell Your Personal Information

Chalked does not sell, rent, or trade your personal information to third parties. We have not sold personal information in the preceding 12 months.

4.2 Sharing with Service Providers

We share information with third-party service providers that help us operate the Platform, including:

PostHog for product analytics.
Supabase for database, authentication, and real-time services.
Expo for app build and distribution.
The Odds API for sports odds and game data (no personal user data is shared with this provider).

These providers are contractually obligated to use your information only to provide services to us and in accordance with this Privacy Policy.

4.3 Aggregated and Anonymized Data

We may share aggregated, anonymized data that cannot reasonably be used to identify you. This includes platform-level statistics such as total users, daily active users, average session duration, parlay submission volume, and demographic breakdowns. This data may be shared with investors, partners, advertisers, and in public communications.

4.4 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Platform. Specifically:

Account and profile information is retained until you delete your account.
Parlay and competition data (submissions, results, scores, league history) is retained as part of your performance record for the lifetime of your account.
Usage analytics data is retained for up to 24 months from the date of collection.
Push notification tokens are retained until you disable notifications or delete your account.

After account deletion, we may retain anonymized, aggregated data that cannot be used to identify you.

6. Your Rights and Choices

6.1 All Users

Regardless of your location, you have the right to:

Access your data: View the personal information we hold about you through your profile and account settings.
Update your data: Edit your profile information, display name, bio, and social links at any time through the app.
Delete your account: Request deletion of your account and associated personal information by contacting us at privacy@chalkedfantasy.com.
Opt out of push notifications: Disable push notifications through your device settings or the app's notification preferences.
Opt out of analytics: Contact us to request exclusion from analytics tracking.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know: You may request a detailed description of the categories and specific pieces of personal information we have collected about you in the past 12 months.
Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Opt-Out of Sale: We do not sell personal information. No opt-out is necessary.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise these rights, contact us at privacy@chalkedfantasy.com. We will respond to verifiable requests within 45 days.

6.3 European Economic Area, United Kingdom, and Switzerland Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing: We process your personal data based on: (a) your consent (e.g., when you create an account); (b) the performance of a contract (providing the Platform services); (c) our legitimate interests (analytics, security, and improving the Platform); and (d) compliance with legal obligations.
Right of Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may request correction of inaccurate personal data.
Right to Erasure: You may request deletion of your personal data, subject to certain legal exceptions.
Right to Restrict Processing: You may request that we restrict processing of your personal data in certain circumstances.
Right to Data Portability: You may request a copy of your personal data in a structured, machine-readable format.
Right to Object: You may object to processing based on our legitimate interests.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

To exercise these rights, contact us at privacy@chalkedfantasy.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Data Transfers: Your data may be transferred to and processed in the United States. By using the Platform, you consent to the transfer of your information to the United States. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy and applicable law.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS/HTTPS).
Secure authentication via Supabase Auth with email verification.
Row Level Security (RLS) policies on all database tables ensuring users can only access their own data.
Access controls limiting employee and contractor access to personal data on a need-to-know basis.
Regular security reviews of our codebase and infrastructure.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Children's Privacy

Chalked is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe we have collected information from someone under 18, please contact us at privacy@chalkedfantasy.com.

9. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or content that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the Platform.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy within the app and updating the "Last Updated" date at the top of this page. For significant changes, we may also notify you by email or through a prominent notice in the app. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Chalked Fantasy Inc. Email: privacy@chalkedfantasy.com Website: www.chalkedfantasy.com

For GDPR-related inquiries, you may also contact our designated privacy contact at the email address above.

12. Summary of Data Practices

| Data Type | Collected | Purpose | Shared With Third Parties | Retention | |-----------|-----------|---------|--------------------------|-----------| | Email address | Yes | Account creation, communication | Supabase (auth provider) | Until account deletion | | Name / Username | Yes | Profile display, leaderboards | No | Until account deletion | | Date of birth | Yes | Age verification (18+) | No | Until account deletion | | State / Region | Yes | Eligibility, demographics | No | Until account deletion | | Social links | Yes | Profile display | No | Until account deletion | | Device info | Yes | Analytics, bug fixing | PostHog (analytics) | 24 months | | Usage data | Yes | Analytics, product improvement | PostHog (analytics) | 24 months | | Push tokens | Yes | Notification delivery | Expo (push service) | Until disabled or account deletion | | Parlay / competition data | Yes | Core platform functionality | No | Until account deletion | | Aggregated statistics | Derived | Business reporting | Investors, partners (anonymized only) | Indefinite |