1. The short version
We ask for one thing: your email address. We use it to send you the game-day card. We do not sell your email address, and we do not rent or trade our list.
We do run the Meta (Facebook) advertising pixel on this site, which tells Meta that you visited and whether you signed up. Under California law that counts as “sharing” your data for advertising. Section 9 explains how to stop it.
2. What we collect
What you give us
| Data | When | Why |
|---|---|---|
| Email address | When you fill in an opt-in form | To send you the game-day card and service messages |
| Which form you used, and which page it was on | Same moment | To know what parts of the site actually work |
| The time you submitted | Same moment | Record of when consent was given |
| Payment details | Only if you subscribe | Handled entirely by our payment processor — we never see or store your card number |
| Anything you write to us | If you email us | To answer you |
What is collected automatically
- Server logs kept by our host: IP address, browser and device type, the page requested, and the time. Standard for any website, and used for security and diagnosing faults.
- Advertising identifiers set by the Meta Pixel — see section 4.
We do not ask for or want your date of birth, your address, your government ID, your betting account details, or your wagering history. Please do not send them to us.
3. Why we use it
- To deliver what you asked for — the game-day card and your trial or subscription.
- To run the business — taking payment, answering support, preventing fraud and abuse.
- To improve the product — understanding which pages and forms people actually use.
- To advertise — measuring which ads bring people who sign up, and reaching similar people.
- To meet legal obligations — tax and accounting records, and responding to lawful requests.
If you are in the UK or EEA, our lawful bases are: consent for marketing email and advertising cookies; contract for delivering a service you signed up for; legitimate interests for security, fraud prevention and basic product analytics; and legal obligation where the law requires us to keep records.
4. Cookies, the Meta Pixel and analytics
We keep this deliberately small. We do not use pop-up consent walls, and we do not run a dozen trackers.
Meta Pixel
This site runs the Meta (Facebook) pixel, ID [META_PIXEL_ID]. It records that a browser loaded one of our pages and, if you complete an opt-in form, that a signup happened and which section of the page it came from. It is how we tell whether our advertising works.
The pixel sets and reads cookies in your browser and sends data to Meta, which uses it under its own privacy policy. You can limit this in your Meta ad settings, by blocking third-party cookies in your browser, or with a tracking blocker.
Fonts
Our pages load typefaces from Google Fonts. That request tells Google your IP address and which page requested the font. We do not use Google Fonts to track you and we receive nothing back from it.
Analytics
[ANALYTICS — no analytics product is installed on this site today. If Google Analytics or anything similar goes in, describe it here and add it to the table in section 5 before it ships. Delete this note once done.]
What we do not do
We do not use session recording or heatmaps, we do not fingerprint your device, and we do not buy data about you from anyone.
6. Email and unsubscribing
When you opt in, you get the game-day card and occasional messages about the product. Every one of those emails has a working unsubscribe link at the bottom — one click, no questions, no retention offer.
If you take a paid subscription, we may still need to send you essential service messages — a receipt, a billing failure, a change to these policies. Those are not marketing and you cannot unsubscribe from them while you have an account.
7. How long we keep it
- Your email address: while you are subscribed, and for up to 24 months after you unsubscribe or go inactive, so we can honour your unsubscribe and not re-add you by mistake. Ask us and we will delete it sooner.
- Form submission records: up to 24 months.
- Server logs: as long as our host retains them, typically a matter of weeks.
- Payment and tax records: as long as tax law requires, normally 7 years.
8. Your rights
Wherever you live, you can ask us to:
- Tell you what personal data we hold about you;
- Send you a copy of it;
- Correct anything wrong;
- Delete it; or
- Stop using it for marketing.
Email [CONTACT EMAIL] and we will answer within 30 days. We will not charge you, and we will not treat you differently for asking.
If you are in the UK or EEA you also have the right to object to processing, to restrict it, to data portability, to withdraw consent at any time, and to complain to your data protection authority — in the UK, the ICO.
9. California: sale and sharing
If you are a California resident, the CCPA as amended by the CPRA gives you the rights in section 8 plus the right to opt out of the “sale” or “sharing” of your personal information.
We do not sell personal information for money. However, running the Meta Pixel counts as “sharing” for cross-context behavioural advertising under California law. The categories involved are identifiers and internet activity.
To opt out, do any of these:
- Email [CONTACT EMAIL] with the subject line “Do Not Share”.
- Turn on Global Privacy Control in your browser. [GPC — we must actually honour this signal in code before claiming it. Wire it up or delete this line.]
- Block third-party cookies or use a tracking blocker.
We have not sold or shared the personal information of anyone we know to be under 16.
10. Age
Fourth & Data is for adults aged 21 and over. It is not directed at children and we do not knowingly collect data from anyone under 18. If we find out we have, we delete it. If you believe a minor has given us their details, email us and we will remove them.
College football is played by students, many of whom are under 21. Nothing on this site is directed at them, and we do not knowingly market to anyone below the legal wagering age.
11. Security
The site is served over HTTPS, access to subscriber data is limited to the people who need it, and payment details never touch our systems. No service can promise perfect security, and we are not going to pretend otherwise — but if a breach ever affects your data, we will tell you and the relevant regulator as the law requires.
12. Where your data is handled
We operate from the United States, and our service providers are mostly US-based. If you are outside the US, using the site means your data is transferred to and processed there, under legal protections that differ from your own. Where required, our providers rely on Standard Contractual Clauses or an equivalent safeguard for those transfers.
13. Changes to this policy
If we change this policy we update the date at the top. If the change is significant — a new category of data, or a new purpose — we will email subscribers before it takes effect.
14. Contact
[LEGAL ENTITY NAME]
[BUSINESS ADDRESS]
[CONTACT EMAIL]
For the rules that govern using the service, see the Terms of Service.