Privacy Policy

ColesAlgoPicks ("the site," "we") operates racing.colesalgopicks.com (The Paddock King) and related subdomains. This page describes what data we collect, why, and what your rights are.

Short version: we don't sell your data, we don't run ads, we don't share with third parties beyond what's needed to run the product. We collect the minimum required, and you can delete your account anytime.

What we collect

• Anonymous browsing: by default, nothing personal — we use your browser's localStorage for app state (watchlist, slips, tracker). That data lives on your device only.
• If you sign in with Discord (optional): we receive and store your Discord user ID, username, display name, and avatar URL — solely to identify you across devices and to determine your access. We use the identify scope (plus the read of your membership/role needed to grant access); no access to your messages, friends, or anything else.
• Account data: your synced app state, session tokens (hashed), and any profile fields you explicitly set.
• Server logs: standard Cloudflare HTTP logs (IP, user-agent, request URL, timestamp) used for abuse detection and uptime monitoring, retained briefly and then auto-deleted by Cloudflare.

What we don't collect

• No payment or card data. Subscriptions are processed by Winible as merchant of record — your card details go to Winible (and its payment processor), never to us. We never see or store your full card number.
• No third-party advertising trackers. No Google Analytics ad SDKs, no Facebook Pixel.
• No location data beyond what your IP implies for server logs.
• No background telemetry across other sites.

How we use it

• To deliver the product: cross-device sync, signed-in personalization, and granting/checking your paid access.
• To detect abuse: rate limiting, blocking malicious bots, investigating suspicious sign-in patterns.
• To improve the product: aggregate, non-identifying usage patterns — never individual behavior sold to anyone.

Who we share it with

Only the providers needed to run the service:

• Discord when you sign in — it validates your identity and access role via OAuth. Privacy policy: discord.com/privacy.
• Winible when you subscribe — as merchant of record it processes your payment and manages your subscription. Privacy policy: winible.com.
• Cloudflare hosts the site and processes every HTTP request. Privacy policy: cloudflare.com/privacypolicy.

Your rights

• Delete your account anytime — wipes your profile, sessions, and synced state. (Payment records held by Winible are subject to Winible's own policy.)
• Export your data — request a copy of everything we hold via our Discord.
• Stay anonymous — the public parts of the site work without sign-in.

Third-party requests

Our pages load their typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser therefore makes a request to Google to fetch them, which discloses your IP address and user-agent to Google in the same way as loading any image from another domain. Google states that Google Fonts sets no cookies and does not use these requests for advertising. We set no advertising or analytics tags of any kind: no Google Analytics, no Facebook Pixel, no ad SDKs. Apart from Google Fonts, the only other outbound request a page makes is to Discord, and only when you choose to sign in.

Cookies

We set only first-party cookies needed to run the product. There are three:

• A free-view cookie (cap_fv) — set on anonymous visitors, with no sign-in, the first time you open a members page. It is a random identifier with no name, email or account attached, and it exists so we can give you one free article every 24 hours without asking you to register. It is HttpOnly, Secure, SameSite=Lax and first-party, and it persists for up to 400 days.
• A session cookie (HttpOnly, Secure) — set only if you sign in with Discord.
• A short-lived CSRF token — used only during the Discord sign-in flow.

No third-party tracking cookies. Clearing your cookies clears all three; note that the free-view allowance is also counted per IP address, so clearing the cookie alone will not reset it.

Contact

Questions, data requests, or concerns: open a ticket in our Discord.

Changes to this policy

We'll update the "Last updated" stamp and post a notice if anything material changes. We won't retroactively reduce protections on data you've already shared.