Privacy Policy

1. What Prizefighter Does

Prizefighter is a platform for combat sports athletes to showcase their careers, connect with fans, and monetize their brand. Fighters create public profile pages featuring fight records, highlights, social links, and revenue opportunities.

Fighter Profiles are public by default and are intended to be discoverable via search engines (Google, Bing, etc.) to help athletes grow their audience.

2. Information We Collect

A. Information you provide

Account creation:

• Name, email, username, password (encrypted), and Date of Birth (required for age verification and safety features)
• Biography, profile photo, weight class, gym affiliation, location

Profile content:

• Links to social media, highlights, merchandise, fan platforms
• Custom visual themes and fight statistics

Payments (if applicable):

• Billing details via Stripe. Prizefighter does not store full credit card numbers.

Communications:

• Support requests, feedback, and violation reports

B. Information collected automatically

Usage data:

• IP address, device type, browser, operating system, time spent on profiles

Link safety data:

• All URLs added to profiles are scanned. We collect metadata (URL, page title, public OpenGraph images) to detect phishing, malware, or prohibited content.

Cookies:

• We use cookies for login sessions and analytics. See Section 11.

C. Information from third parties

• Social integrations: If you connect Instagram, TikTok, or YouTube, we collect basic profile info and public engagement metrics with your permission.
• Public sports data: Publicly available athletic commissions, promotions, and open sports databases.
• Partners: Transaction data from affiliate networks if you use our monetization tools.

3. How We Use Your Information

Providing the service

• Creating profiles, processing payments, and hosting content

Legal basis: Performance of contract

Safety & security

• Age gating: We use your Date of Birth to enforce safety restrictions. Users under 18 are prevented from posting links to mature content platforms.
• Link scanning: Automated systems (including Google Safe Browsing and AI analysis) scan links for malware and prohibited content.
• AI disclosure: Data submitted to our AI safety partners (e.g., Google Gemini) is used strictly for content classification. We do not grant partners the right to use your personal data to train their public AI models.

Legal basis: Legitimate interests

Personalization

• Recommending features and analyzing usage trends

Legal basis: Legitimate interests

Legal compliance

• Tax reporting, responding to subpoenas, and reporting child safety concerns

Legal basis: Legal obligation

4. How We Share Information

What is public

By design, the following is visible to anyone on the internet:

• Your name, bio, and profile photo
• Your fight record and gym affiliation
• The links you add to your profile
• Your social media handles

Service providers

• Hosting: Vercel
• Database: Supabase (secure data storage)
• Payments: Stripe (PCI-compliant processing)
• Safety: Google Cloud (Safety APIs and AI analysis)
• Analytics: PostHog / Google Analytics (anonymized usage data)

Other sharing

• Business transfers: If Prizefighter is acquired, user data will be transferred to the new owner.
• Law enforcement: We disclose data if legally required or to prevent imminent physical harm.
• Child safety: We report all instances of CSAM to the NCMEC.

5. International Data Transfers

Prizefighter is based in the United States. If you use our service from the EU, UK, or other regions, your data is transferred to and processed in the US. We utilize Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) with our vendors to ensure your data remains protected.

6. Data Retention

7. Security

We use enterprise-grade security including:

• Encryption in transit (TLS) and at rest (AES-256)
• SSRF (Server-Side Request Forgery) protection for link fetching
• Role-based access controls

Your role: You are responsible for keeping your password secure. Prizefighter will never ask for your password via email.

8. Your Privacy Rights

Depending on your location (GDPR, UK, CCPA/CPRA), you have rights regarding your data:

• Access: Request a copy of your data
• Correction: Fix inaccurate info
• Deletion: Request we delete your account
• Portability: Get your data in a readable format

To exercise these rights: Email privacy@prizefighter.app. We verify all requests to prevent identity fraud.

9. California Residents (CCPA/CPRA)

• Sale of data: We do not sell personal information for money. However, using advertising cookies may be considered "sharing" under California law. You may opt out via our Cookie Banner or by using a Global Privacy Control (GPC) signal.
• Sensitive info: We do not use sensitive personal information (SPI) for inferring characteristics about you.

10. Children's Privacy

Minimum age: Prizefighter is available only to users 13 years of age and older.

Under 13

• We do not knowingly collect data from children under 13. If we discover an account belongs to a child under 13, we will delete it immediately to comply with COPPA.

Minors (13–17)

• Users between 13 and 17 are permitted to use Prizefighter but are subject to strict safety restrictions.
• Minors cannot post links to mature content platforms (e.g., OnlyFans). Attempting to bypass these age restrictions violates our Terms of Service.

Parents: Contact support@prizefighter.app if you believe a child under 13 has created an account.

11. Cookies

We use cookies for authentication (keeping you logged in) and analytics. You can control cookies via your browser settings, though disabling them may break login functionality.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in data practices, new features, or legal requirements. We will notify you of material changes by email or prominent notice. We encourage you to review this policy periodically.