Privacy Policy

Last updated: July 12, 2026

Off2Races (“the app,” “we”) is a personal handicapping tool. This page explains what data the app touches, why, and who else sees it. There is no advertising, no data resale, and no analytics tracking beyond what's described below.

What we collect

• Account info. If you sign in with Google, we receive your name, email address, and profile picture from Google — nothing else. If you sign in by email link, we store only the email address. Authentication is handled by Supabase; we never see or store a password.
• Race cards you create. Track names, dates, horses, odds, form, and any other fields you enter or a scan fills in. This is the core data the app exists to store.
• Photos you scan. When you use the 📷 Scan feature, the photo is sent to a vision model to extract text (see “Third parties” below) and is not separately stored by us once the scan completes — only the extracted race data you choose to save persists.
• Predictions and results. Rankings the scoring engine produces, and any race results you record, so the app can show you how the engine is performing over time.
• Basic technical data. Standard server logs (IP address, timestamps) generated by our hosting provider for security and abuse prevention. We don't run ad trackers, fingerprinting scripts, or third-party analytics pixels.

Third parties involved

• Supabase — hosts our database and handles authentication. Your account and race data live in a Supabase project we control.
• Google — if you choose “Continue with Google,” Google handles that sign-in and shares basic profile info with us per your Google account settings.
• Vision providers (OpenRouter, Google Gemini, Anthropic Claude) — when you scan a race sheet, the photo is sent to one of these providers to read the text on it. We try free-tier models first and only fall back to a paid provider if the free tier fails or is too slow. Each provider processes the image under its own privacy policy and API terms; we do not control their retention practices for API requests.
• Vercel — hosts the application itself.

We do not sell your data, share it with data brokers, or use it for advertising.

Your control over your data

• The app works fully offline, without an account, for manual card entry and ranking.
• You can delete any card you've saved from within the app.
• To delete your account and all associated data, email scoty65@gmail.com and we'll remove it.

Security

Data is protected with row-level security in our database — you can only access your own cards, predictions, and results. Connections to the app are encrypted (HTTPS).

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page.

Contact

Questions about this policy or your data: scoty65@gmail.com