CHEQ

Privacy Policy

Effective: October 11, 2026

This Privacy Policy explains what data the CHEQ mobile and web application ("CHEQ", "the app", "we", "us") collects, how we use it, who we share it with, and the choices you have. CHEQ is operated by JMH Capital Group LLC (iOS app) and JMH Entertainment Inc. (Android app). Where this policy says "we" or "us," it means whichever of the two publishes the version of the app you use. Both use the same backend and the same practices described here.

1. Information we collect

Account information

If you create an account, we collect your email address, a username you choose, optionally your first and last name, and a password (stored only as a salted PBKDF2 hash — we never see your plaintext password). You can optionally select favorite teams for NBA, MLB, NHL, and NFL.

Profile photo (optional)

You can add a profile photo. If you do, the image is stored with your account and shown in the app, including to other users where your profile appears (for example in chat). It is deleted when you delete your account, and you can replace it at any time.

Device push token

When you enable notifications, your device generates a push token (an Expo push token on iOS and a Firebase Cloud Messaging token on Android). We store this token so we can deliver alerts when a player you track scores or when a parlay leg resolves. The token does not identify you personally.

Activity you create in the app

• Watchlist entries — players, stats, and thresholds you choose to track.
• Parlays — multi-leg bets you save, their legs, and live status (we track resolution to send notifications and update your view).
• Chat messages — messages you post in per-game chat rooms are public to other users in that room and stored with your username and account tier (Free or Pro).
• Usage logs — limited counters (for example, "watchlist add" events per day) used to enforce free-tier limits. These are tied to your account or device token.
• Promo code redemptions — if you redeem a code, we record that the code was used and update your account tier.

Screenshots you upload

If you use the "Import from Screenshot" feature inside Parlays (Pro), the screenshot image is sent through our backend to Anthropic's Claude API for parsing into structured parlay legs. We use the image only for that request and do not save it; what Anthropic does with it is subject to Anthropic's data handling policies (see "Third parties" below).

Advertising and attribution data

CHEQ advertises on Meta platforms (Facebook and Instagram). To measure whether those ads work, we include the Meta SDK, which sends a limited set of data to Meta Platforms, Inc.: certain in-app events: signing up, starting a free trial, and subscribing (including the plan and price). We have turned off the Meta SDK's automatic event logging, so it does not report installs or app opens on its own. This happens only with your consent: on iOS, if you grant permission at the App Tracking Transparency prompt; on Android, after you tap Allow in the in-app sheet described below. On iOS the data may also include your device's advertising identifier — but only if you grant permission when the app shows the App Tracking Transparency prompt. If you decline that prompt, no advertising identifier is shared, and every feature of CHEQ works exactly the same. On Android, the app asks once, in a sheet titled "Help more fans find CHEQ" (buttons "Allow" and "Not now"), shown after you track your first player. Until you tap Allow, the Meta SDK is never initialized, sends no events, and does not read your Android advertising ID. You can withdraw at any time in Account, Notification Settings, Privacy, by switching off "Share ad measurement with Meta"; turning it off stops events and advertising-ID collection immediately. You can also reset your Android advertising ID in your device settings. We never send your email, username, watchlist, parlays, or chat messages to Meta.

Product analytics

We use PostHog (hosted in the United States), acting as our service provider, to understand how the app is used. It receives your account ID and events such as which screens you open, which sports and stats you view, and whether you open an alert, plus your tier (Free or Pro) and favorite sport. It does not receive your email, password, or chat messages.

Crash and error reports

We use Sentry, acting as our service provider, to receive crash and error reports. A report contains technical details such as your device model, operating system, app version, and the steps in the app leading up to the error. We configure it not to send personal information or screenshots.

Email

We send account emails, such as password-reset codes, through Resend. Resend receives your email address and the message.

Purchases

Subscriptions are sold and billed by Apple (App Store, iOS) or Google (Google Play, Android). We never see your card details. We receive confirmation of your subscription status from the store, and we keep a record of your purchase and subscription history (such as purchase confirmations and renewals from the App Store and, once Android billing is live, Google Play) to give you access and handle support. See "Data retention" for what happens to it when you delete your account.

The website (cheqsports.com)

The website sets no cookies and uses no third-party analytics or advertising trackers. What it does handle:

• Server logs. Vercel, which hosts the site, records your IP address, browser type and the pages requested in standard server logs for security and operations. When a page is rendered, our own backend also receives your IP address so it can limit abusive request rates; it is not stored for any other purpose.
• Browser storage. If you sign in on the web, your sign-in token is kept in your browser's local storage until you sign out, together with a random identifier for that browser so your account can list it as a device. A one-session flag remembers that the intro animation has played. Nothing in browser storage is read by any third party.
• Offer pages. Pages that promote an offer code (for example /lastnight) count views and taps as daily totals, along with the name of the referring website. No cookies, IP addresses or identifiers are stored; a flag in your browser keeps you from being counted twice.
• Images. Team logos and player photos load from the leagues' and ESPN's image servers, which see your IP address as they would for any image on the web. Fonts are served from our own site.

What we do not collect

• We do not collect your contacts, location, or microphone data.
• We use only the analytics, crash-reporting, and advertising-measurement services named in this policy.
• We do not sell your personal data for money.

2. How we use your information

• To provide the core service — scores, box scores, watchlist tracking, parlay tracking, and push notifications.
• To authenticate you and remember your preferences (theme, favorite teams).
• To enforce free-tier usage limits and apply Pro entitlements.
• To deliver push notifications you have opted into.
• To respond to support requests and investigate bugs or abuse.

3. Third parties

We rely on the following service providers. Each one only receives the data necessary for its function:

• Apple Push Notification Service (via Expo Push): delivers notifications to your device. Receives your push token and the notification payload.
• PostHog: product analytics (account ID, in-app events, tier, favorite sport). Subject to PostHog's privacy policy.
• Sentry: crash and error reports (device model, OS, app version, in-app steps before an error). Subject to Sentry's privacy policy.
• Resend: sends account emails such as password-reset codes. Receives your email address and the message.
• Apple (App Store) and Google (Google Play): sell and bill subscriptions on iOS and Android respectively. We receive your subscription status; they handle payment details.
• Anthropic (Claude API): processes parlay screenshots you upload, returning parsed leg data. We do not save the image. Subject to Anthropic's privacy policy.
• Meta Platforms, Inc. (Facebook / Instagram): receives in-app event data (sign-up, free trial, subscription) — and, only with your permission on iOS (or, on Android, only after you agree in the app), your device advertising identifier — so we can measure and attribute the performance of our advertising. Subject to Meta's privacy policy.
• Railway: hosts our backend servers and database in the United States.
• Vercel: hosts the CHEQ web application and this page.
• Sportradar: supplies live and historical game, player, and statistical data across the sports CHEQ covers (NBA, MLB, NHL, NFL, soccer, and tennis). We do not send any of your data to Sportradar.
• ESPN and official league data endpoints: supply supplementary public game data, team logos, and player images. We do not send any of your data to them.
• Google (Firebase Cloud Messaging): delivers push notifications to Android devices. Receives your push token and the notification payload.

4. Data retention

We retain your account data for as long as your account is active. Watchlist entries for single games are deleted automatically once the game is final. Season-long watches, parlays, chat messages, and account data persist until you request deletion. Usage logs are retained for limit enforcement and may be summarized over time. Deleted data can persist in our encrypted backups: we keep nightly backups as 14 daily copies plus 12 weekly copies, so deleted data can remain in them for up to about 3 months before it ages out, and it is not used for anything else in that time. Analytics and crash data held by PostHog and Sentry, and event data held by Meta, are kept under those companies' own retention periods (see "Deleting your data" below).

5. Your rights

You can request to access, correct, or delete your personal data at any time by emailing support@cheqsports.com. We will respond within 30 days. If you are in a jurisdiction with specific data rights (such as the EU under GDPR or California under CCPA), those rights apply.

To delete your account and its data, use Account → Delete Account in the app, or follow the instructions on our account deletion page if you no longer have CHEQ installed.

Deleting your data. Deleting your account removes your data from our own systems, including your profile photo (see our account deletion page), except for the encrypted backups described in Section 4 and any Apple or Google transaction identifiers we need for financial records. Our delete function does not yet remove the analytics, crash, or advertising-measurement records that PostHog, Sentry, and Meta hold under your account ID or device. Those are kept and then deleted under each provider's retention schedule. We do not send them your email, name, or chat content. To ask us to request deletion from a provider, email support@cheqsports.com.

California residents — Do Not Sell or Share My Personal Information

California's CCPA/CPRA treats sharing device or event data with an advertising partner for cross-context behavioral advertising as a "sale" or "share," even when no money changes hands. The advertising measurement described in Section 1 can fall under that definition. You can opt out of it at any time:

• On Android: tap "Not now" on the in-app sheet, or later switch off "Share ad measurement with Meta" in Account, Notification Settings, Privacy. This stops events and advertising-ID collection immediately. You can also reset your Android advertising ID in your device settings.
• On iOS: decline the App Tracking Transparency prompt, or turn off tracking later in iOS Settings → Privacy & Security → Tracking. This stops any advertising identifier from being shared with Meta.
• Any device: email support@cheqsports.com with the subject line "Do Not Sell or Share" and the email on your account, and we will suppress advertising-measurement sharing for you.

We do not sell your personal information for money, and we never share your email, username, or the content you create in the app — watchlists, parlays, or chat — with any advertising partner.

6. Security

Passwords are stored only as salted PBKDF2 hashes. Communication between the app and our servers is encrypted with HTTPS. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

7. Children

CHEQ is not directed to children under 13 and we do not knowingly collect data from children under 13. The app contains content related to sports betting and is intended for users 18 and older, in line with our Terms of Service. If you believe a child has provided us with personal data, please contact us so we can delete it.

8. International users

CHEQ is operated from the United States. If you access the app from outside the US, your information will be transferred to and processed in the US.

9. Changes to this policy

We may update this policy from time to time. Material changes will be noted by updating the "Last updated" date at the top. Continued use of the app after a change constitutes acceptance of the revised policy.

10. Contact