Legal
Privacy Policy
Last updated August 17, 2026
In plain terms
We use your email to send the sign-in link and to attach your pass to your account. Analytics and session recording run with consent where it is required, and you can decline them at any time. We do not sell your personal information. Full policy below. This summary does not replace it.
1. What we collect
Information you give us
- Email address — required to create an account. It is how we send your sign-in link and how your pass is identified.
- Purchase records — which pass you bought, the amount, and when it expires. We do not receive or store your card number, CVC, or expiry date; those go directly to Stripe.
Information collected automatically
- Usage analytics — pages viewed, which model you select, checkout steps reached. Collected via Google Analytics 4 through Google Tag Manager, and only where analytics storage is permitted (see section 3).
- Session recordings and heatmaps — we use Microsoft Clarity, which records interactions such as mouse movement, scrolling, and clicks to produce a replay of a session. This is used to find usability problems. Clarity masks text input by default.
- Server and network logs — IP address, browser type, and requested URL, recorded by our host and by Cloudflare, which sits in front of the site to serve it and protect against abuse.
Please note the session recording. Screen-recording analytics is more invasive than page-count analytics, so we would rather name it plainly here than bury it. Declining analytics cookies stops it.
2. Why we collect it
| Purpose | Data used |
|---|---|
| Give you access to a pass you paid for | Email, purchase record |
| Send sign-in links | |
| Process payment | Handled by Stripe |
| Understand which features get used | Analytics events, session recordings |
| Keep the service up and resist abuse | Server and Cloudflare logs |
We do not sell personal information, share it with data brokers, or run advertising. Every advertising signal in our tag configuration is disabled and stays disabled regardless of what you choose.
3. Cookies, storage, and your choice
Where consent is required — the EEA, the UK, and Switzerland — analytics is off by default until you accept. Elsewhere it is on by default and the banner lets you turn it off. Your choice is remembered for twelve months, and you can change it any time via Cookie settings in the footer.
| Name | Type | Purpose |
|---|---|---|
| nrfi-consent | Local storage | Remembers your analytics choice |
| nrfi-theme | Local storage | Remembers your chosen board theme |
| nrfi-sb | Local storage | Keeps you signed in |
| sb_token | Cookie | Sends your session to our server so it knows you have a pass |
| nrfi_pass | Cookie | Legacy pass token for purchases not tied to an account |
| _ga, _ga_* | Cookie | Google Analytics, only if analytics is permitted |
The first four are strictly necessary — without them you cannot stay signed in or keep a pass. Declining analytics does not disable them, and does not change anything about how the board works.
4. Who processes your data
| Provider | Role | What they receive |
|---|---|---|
| Supabase | Accounts and pass records | Email, pass status |
| Stripe | Payments | Card details, email, amount |
| Resend | Sends sign-in emails | Email address |
| Google (GA4 / Tag Manager) | Analytics | Usage events, IP |
| Microsoft (Clarity) | Session recording | Interaction data, IP |
| Cloudflare | Delivery and protection | IP, request metadata |
| Google Fonts | Typefaces | IP when fonts load |
We also read public game data from the MLB Stats API. No information about you is sent to MLB.
5. Links to third-party markets
The board may link out to third-party prediction markets and sportsbooks so you can compare a model’s number against a market price. Following such a link takes you to a service we do not operate, are not affiliated with, and receive no compensation from. Once you leave, their privacy policy governs — not this one.
6. How long we keep it
- Account and purchase records — for as long as your account exists, and afterwards only as long as needed for tax and accounting obligations.
- Analytics — per Google Analytics retention settings.
- Session recordings — per Microsoft Clarity retention, currently around 30 days.
- Server logs — a short rolling window for security and debugging.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. Email [email protected] and we will action it. To delete your account and its purchase history, ask and we will do it — note that this ends any pass still running, and expired passes cannot be restored afterwards.
You can withdraw analytics consent at any time via Cookie settings in the footer.
8. Children
NRFI Edge is intended for adults aged 21 and over. We do not knowingly collect information from children. If you believe a minor has created an account, contact us and we will remove it.
9. Security
The site is served over HTTPS. Passwords are not used at all — we send a one-time sign-in link instead, so there is no password to leak. Payment card data never reaches our servers. No system is perfectly secure, and we cannot guarantee absolute security.
10. Changes
If we change what we collect or who processes it, we will update this page and the “last updated” date above.
11. Contact
Privacy questions: [email protected].