Privacy Policy

Last updated: October 31, 2026

1. Introduction

Sidekick Intelligence LLC (doing business as "Chikoh") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Email address, name, password
  • Profile Information: Username, preferences, settings
  • League/Show Information: Fantasy league details, TV show preferences, watch party information. When you connect a league, we store other members only by team name and initials, and only for leagues you play in.
  • Payment Information: Billing details processed through Stripe (we do not store full payment card details). PayPal is not currently offered; if you paid with PayPal in the past, PayPal holds those payment details
  • Communications: Messages sent through our AI chat feature, files and screenshots you upload (for example a roster screenshot), and support messages
  • Alerts: Your phone number if you turn on SMS or WhatsApp alerts, and your Discord id if you connect Discord
  • Sign-in with Google or Apple: The name and email address that provider shares with us
  • Confirmations and choices: That you confirmed you are 18 or older (and 21 or older, if you did, for betting tools and paid pools), whether you turned on AI-suggested bets, which version of the Terms you accepted and when, and your cookie choice
  • Referrals: The referral code of the link you arrived from, if any

2.2 Automatically Collected Information

  • Usage Data: Requests to our servers (pages and features used) in server logs, and page-view and click totals that carry no identifier
  • Device Information: IP address, browser type, operating system, device identifiers
  • Location Data: Your country and, in the US, your state, as reported by Cloudflare from your IP address — used for prices and to check whether a tool is legal where you are
  • Cookies: The cookies described in section 9 and our Cookie Policy. We use no advertising, tracking or analytics cookies

2.3 Third-Party Platform Data

When you connect third-party fantasy sports platforms (ESPN, Yahoo, Sleeper, CBS, Fantrax, MFL, etc.), we may collect:

  • League rosters and standings
  • Player statistics and performance data
  • Transaction history
  • League settings and scoring rules

2.4 Platform Write Access Data (Yahoo Fantasy)

If you enable Platform Write Access for Yahoo Fantasy, we additionally collect and store:

  • Execution Logs: A detailed record of every action submitted to Yahoo on your behalf, including the action type, players involved, timestamps, and Yahoo API response status. These logs are retained for audit, rollback, and dispute resolution purposes.
  • Pre-Execution Roster State: A snapshot of your roster before each execution, enabling rollback functionality and verification.
  • Consent Records: Timestamped records of your per-action consent confirmations, stored for legal compliance.
  • OAuth Tokens: Your Yahoo OAuth access and refresh tokens, stored in our database behind access controls, used solely to authenticate write operations you have explicitly authorized. Tokens are deleted when you disconnect your Yahoo account or revoke write access.

2.5 MCP and Agent Access Data

When you access Chikoh through our MCP interface, API keys, or third-party AI platforms (Claude, ChatGPT, Gemini, etc.), we collect:

  • API Key Usage: Requests made, tools invoked, timestamps, and response metadata
  • Agent Identifiers: Agent ID headers, session identifiers, and platform source information
  • Query Content: The content of queries sent to our tools, used for response generation and quality improvement
  • Ticket Consumption: Records of ticket usage per tool invocation

2.6 Agentic Commerce Data

When you use Agentic Commerce features (execution billing, automated operations), we collect and retain:

  • Execution request details and parameters
  • Third-party passthrough cost records
  • Billing aggregation and settlement data
  • Consent records for execution billing authorization

2.7 Other Members of Your League

When you connect a league, we receive the other members of that league from the platform you connected (for example Yahoo or Sleeper). We keep only their team name and initials, only to show you your league and answer your questions about it, and we delete them with the league data of the member who connected it. If you are one of those members and want to ask about or object to this, write to [email protected].

2.8 What You Must Give Us

An email address is needed to create an account, and you must confirm you are 18 or older. Payment details are needed only for paid plans. Everything else — connecting a league, a phone number for alerts, uploads — is optional; without it, only the feature that uses it is unavailable.

2.9 Automated Decisions

Some decisions are made automatically, with no person involved: betting tools and paid pools are refused if you have not confirmed you are 21 or older or if Cloudflare reports a location where they are restricted (or no location at all), and features are opened or closed by your plan. You can ask us to review any such decision at [email protected].

3. How We Use Your Information

We use your information to:

  • Provide and maintain the Service
  • Generate AI-powered recommendations and insights
  • Process payments and manage subscriptions
  • Communicate with you about the Service
  • Improve and personalize your experience
  • Detect and prevent fraud or abuse
  • Comply with legal obligations
  • Send marketing communications (with your consent)
  • Enforce our Terms of Service and other policies
  • Respond to legal requests and prevent harm

Why we may do each (EU/UK legal basis): your account, the Service, AI answers, league sync, payments and refunds — to perform our contract with you; tax and accounting records, age and location checks for betting tools and paid pools, and answering legal requests — legal obligation; security, fraud and abuse prevention, rate limits, server logs and anonymous page totals — our legitimate interest in running a safe, working service; marketing email, SMS/WhatsApp alerts, optional cookies and AI-suggested bets — your consent, which you can withdraw at any time.

4. AI and Machine Learning

We use artificial intelligence and machine learning to provide personalized recommendations and insights.

  • Chikoh builds its own projection models from sports data: statistics, play-by-play and prediction-market prices.
  • We may use de-identified, aggregated data to improve our models and services. We don't use your identifiable chats, league or roster data to train AI models without your permission.

AI model providers

To answer a question, we send your message and the league context needed to answer it (league and team names, rosters, and other members as team name and initials only) to an AI model provider. Here is what each provider's published terms say about keeping or training on that data; where each one is located is on our subprocessors page.

  • Anthropic, PBC: Its commercial terms say it does not train models on API inputs and outputs; it deletes them within 30 days, longer only to enforce its usage policy or where the law requires.
  • OpenAI, L.L.C.: Its API data policy says API inputs are not used to train its models; abuse-monitoring logs, which can include prompts and responses, are kept for up to 30 days.
  • OpenRouter, Inc.: Every request we send asks OpenRouter to route only to model providers that do not collect (store or train on) request data; if none is available the request fails instead.
  • Perplexity AI, Inc.: Its API documentation says the Sonar API keeps no request content (zero data retention) and does not use it for training.
  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.): Its published terms and privacy policy allow it to use inputs to improve and train its services, and it stores data in China.
  • Moonshot AI (Beijing Moonshot AI Technology Co., Ltd.): Its published platform terms do not say that API inputs are excluded from training; it processes data in China.
  • Alibaba Cloud (Qwen models, DashScope international service): Its Model Studio terms say it does not use customer data for model training; they do not state how long requests are kept.

5. Information Sharing and Disclosure

We do not sell your personal information and do not share it for cross-context behavioral advertising. We may share your information with:

  • Service Providers: Companies that help us operate the Service (hosting, network, database, email, messaging, AI models and payment processing). Each one, what it receives and where it is located is listed on our subprocessors page
  • Authentication Providers: Supabase for account management and authentication
  • Payment Processors: Stripe for payment processing. PayPal is not currently offered; we contact PayPal only to handle refunds and cancellations of past PayPal payments
  • AI Providers: the AI model providers listed in section 4, to generate answers to your requests
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls on internal systems
  • Secure data storage with Supabase (EU region) with Row Level Security
  • API keys we issue are stored only as hashes; AI provider keys you bring are kept in an encrypted vault; platform sign-in tokens are kept in our database behind access controls
  • Automated error alerting and a scan that blocks credentials from our code

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

  • Notify affected users via email within 72 hours of confirming the breach
  • Notify relevant supervisory authorities as required by applicable law (including GDPR's 72-hour notification requirement)
  • Provide details about the nature of the breach, the types of data affected, and the measures taken to address it
  • Offer guidance on steps you can take to protect yourself

8. Your Rights and Choices

You have the right to:

  • Access: Request a copy of your personal information
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your account and data
  • Opt-Out: Unsubscribe from marketing communications
  • Data Portability: Request your data in a portable format (JSON or CSV)
  • Withdraw Consent: Withdraw consent for data processing where applicable
  • Restrict Processing: Request that we limit how we use your data
  • Object to Processing: Object to processing based on legitimate interests

You can download a copy of your data (a JSON file) and delete your account yourself, in Settings, at any time — no request to us is needed. For any other right, or if you cannot sign in, contact us at [email protected]. We will respond to verified requests within 30 days (or 45 days for complex requests, with notice).

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Keep you signed in and keep the Service secure
  • Remember your cookie choice and settings you change
  • Run the legal checks some tools need (age and location)

We count page views and button clicks only as totals with no identifier and no cookie. We do not use advertising, tracking or analytics cookies. Optional cookies are used only with your consent, which you can change at any time from Cookie Settings at the bottom of every page; we treat a Global Privacy Control signal as a refusal of marketing cookies. The full list is in our Cookie Policy.

10. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry-standard interpretation of DNT. However, you can control tracking through your browser's cookie settings and opt-out mechanisms described in this policy.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Children's Privacy

You must be 18 or older to use Chikoh. Betting-related tools and paid pools require you to be 21 or older. The Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe we have collected information from someone under 18, please contact us at [email protected] and we will delete it promptly.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy, including:

  • Our servers are operated by Hetzner Online GmbH in Germany, behind Cloudflare, and our database is operated by Supabase in the EU (Frankfurt)
  • Some of the companies that process data for us are outside the EEA, including in the United States, Singapore and China; see the subprocessors page
  • Standard Contractual Clauses (SCCs) for transfers outside the EU/EEA where applicable

14. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. Specific retention periods:

  • Account data: Retained while your account is active. When you delete your account in Settings, your account and the data linked to it (profile, leagues and rosters, chats, uploaded files, connected-platform logins, consent records) are deleted immediately. Copies in our database provider's backups are removed when those backups expire, within 7 days
  • Transaction records: Our payment processors (Stripe, and PayPal for any past PayPal payment) keep their own records of your payments under their own retention rules. Our copies are deleted with your account, and your Stripe customer record is deleted at the same time
  • Execution logs (Platform Write Access): Kept while your account exists, for audit, rollback and disputes; deleted with your account
  • AI chats: Kept while your account exists so you can see your history; deleted with your account
  • Other members of your league: Deleted with the league data of the member who connected the league
  • Terms acceptance, age confirmations and consent records: Kept while your account exists, as proof of what you agreed to; deleted with your account
  • Page-view and click totals: Daily counts with no identifier, deleted after 90 days
  • Rate-limit counters: Short-lived counters keyed to your account or IP address that expire on their own

When you delete your account, we delete your personal information as described above. Server logs that may contain your account id expire on their own as they are rotated.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: Request disclosure of what personal information we collect, use, disclose, and sell
  • Right to Delete: Request deletion of your personal information
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
  • Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to what is necessary for the Service

What we collected in the last 12 months: identifiers (email, name, account id, IP address, phone number if you gave one); customer records (billing details held by Stripe); commercial information (your plans and purchases); internet activity (requests to our servers and your use of the Service); approximate location (country and US state); your content (chats, uploads, connected leagues). Sources: you, the platforms you connect, and your device. Purposes: those in section 3. Retention: section 14. We do not sell or share (for cross-context behavioral advertising) any of it, and we have no actual knowledge of selling or sharing data of anyone under 16.

Sensitive personal information: your account login and any platform login you connect. We use it only to provide the Service.

To exercise your California privacy rights, contact us at [email protected] or submit a request through your account settings. We verify a request by confirming it comes from the email address on the account. You may use an authorized agent, who must show your written permission; we may still ask you to confirm your identity. If we decline your request, you may appeal by replying to our answer, and we will respond within 45 days. Residents of other US states with privacy laws may use the same routes, including the appeal.

16. European and UK Privacy Rights (GDPR and UK GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR) or the UK GDPR, including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with your local data protection supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

The legal basis for each purpose is listed at the end of section 3.

For detailed information about your GDPR rights, see our GDPR Rights page. For data processing terms, see our Data Processing Agreement.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before changes take effect. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy. The "Last Updated" date at the top of this page reflects the most recent revision.

18. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: