MintSlips

Privacy Policy

Last updated: October 12, 2026

1. Effective Date

This Privacy Policy is effective as of July 27, 2026 and was last updated on the date shown at the top of this page (October 12, 2026: rewritten for the MintSlips API and MCP server — added API keys, usage records, MCP sign-in connections, webhooks, the API waitlist, Stripe as our payment processor, Google sign-in, and the outside requests the picks page makes; Whop now appears only for memberships bought through it before that date; September 25, 2026: membership tied to the email you pay with, no license keys; September 19, 2026: removed references to a possible iOS application and added cross-references to the End User License Agreement and the Return and Refund Policy; August 16, 2026: added Section 5a on artificial intelligence and added Anthropic to the provider list).

2. Who We Are and Scope

MintSlips is operated by MintSlips LLC, a Massachusetts limited liability company.

Postal address: 82 Wendell Ave., STE 100, Pittsfield, MA 01201
Email: mintslips1@gmail.com

This Policy covers the MintSlips website at mintslips.com (including the picks board, the results record, and the developer documentation), the MintSlips REST API and MCP server at api.mintslips.com, our webhooks and data stream, and our email programs. There is no MintSlips mobile or desktop application, and this Policy will be updated before any is offered. It does not cover Stripe, Google, your sportsbook or trading venue, the MCP client or AI assistant you connect, or any other third party, each of which has its own privacy policy.

3. Personal Information We Collect

Your account and email lists:

• Email address — when you create an account, join the free email list, or join the API waitlist, stored with the date and time you signed up. If you confirm a second address and link it to your account, we store that address too.
• Account password — we store a salted one-way hash of your password (PBKDF2), never the password itself. When you choose a password, our server checks it against known breached passwords using the Have I Been Pwned "Pwned Passwords" service: only the first five characters of a SHA-1 hash of the password are sent, never the password or your email.
• Account record — when the account was created, whether and when you verified your email address, and which sign-in methods it uses.
• Google sign-in — if you sign in with Google, we receive from Google your email address, Google's identifier for your account, whether Google has verified the address, and your name if Google shares it, and we store the email, identifier, and name with your account.
• Sessions — when you sign in we create a random session token. Our server stores it with your email and when it was created and last used; your browser keeps it in local storage. A session ends after 7 days without use, and after 30 days at most.

If you use the API or MCP server:

• API keys — a SHA-256 hash of each key (never the key itself), its first 12 characters for display, the plan at creation, and when it was created, last used, and revoked.
• Usage counts — the number of calls each key (or each account's MCP sign-in connection) makes per UTC day, used to enforce plan limits and shown to you.
• Request metrics — one data point per API or MCP request: the key id (or a pseudonymous account id for MCP sign-in connections), the endpoint name, your plan, whether it came over REST or MCP, and the response status. These metrics do not include your IP address or your email.
• MCP sign-in connections — if you connect an MCP client by signing in (OAuth), the authorization records needed to keep that connection working, including your account email and the client's registered name and redirect address.
• Webhooks (Pro) — the endpoint URL you register, the event types you choose, a signing secret stored only in hashed and encrypted form, and a record of delivery attempts.

Collected automatically:

• IP address — used as a rate-limiting key on sign-in, registration, signup, and unauthenticated API routes, through Cloudflare's rate-limiting service in one-minute windows. Our sign-in security logs record the IP address and browser user-agent with events such as sign-in, registration, new sessions, and Google account linking. We do not store IP addresses in our databases, build profiles from them, or log browsing history.
• Standard request logs kept by our hosting providers (Section 8).

When you pay (Stripe): Stripe collects your payment details and any billing address it needs. We receive from Stripe your email address, your Stripe customer and subscription identifiers, your plan, the subscription's status, and the end of the current billing period, and we store those with your account.

Memberships bought through Whop before October 12, 2026: Whop, as merchant of record, tells us by signed webhook your email address, membership ID, plan ID, and membership status. Whop's seller dashboard also shows us your name, your location at the country, state, and city level, your total spend and join date, and any dispute, refund, or review history. Of that set, our own systems store only your email address, membership ID, plan ID, membership status, and timestamps.

Local storage on your device (the picks and developer pages) — not cookies:

• mintslips.session — your session token while you are signed in;
• mintslips.email — the email address you signed in with;
• mintslips.subscribed — the address you entered in the email signup form, so the page remembers you signed up; and
• mintslips.balance — the bankroll amount you type into the picks page to size units. It stays in your browser and is never sent to us.

What we do not collect, at all: payment card numbers or any card details; bank account information; date of birth; government-issued ID; Social Security or tax identification numbers; sportsbook or exchange credentials; your betting or trading history, positions, or account balances at any venue; precise geolocation; phone numbers; and biometric data. We do not store your street address. Stripe holds payment data as our payment processor, and MintSlips never receives your card details.

4. How We Collect It

Directly from you — when you create an account, type your email into a signup or waitlist form, create an API key, register a webhook, connect an MCP client, or write to us for support. From Google — when you choose to sign in with Google. From Stripe — by signed webhook and by our requests to Stripe when a subscription starts, changes, or ends. From Whop — by signed webhook and through Whop's seller dashboard, for earlier memberships only. Automatically — your IP address and user-agent are read from the network request, and usage counts and request metrics are recorded as you call the API.

5. How We Use It

We use personal information only to:

• create and secure your account, verify your email address, and sign you in;
• issue, authenticate, and revoke API keys and MCP connections, and decide which plan and features your account is entitled to;
• enforce rate limits and daily limits, and show you your own usage;
• deliver webhooks and the data stream to the endpoints you choose;
• send the daily picks email to the free list, and one email to the API waitlist when access opens;
• manage subscriptions and billing with Stripe (and, for earlier memberships, Whop);
• operate and secure the Services — abuse prevention, fraud and chargeback investigation, and debugging;
• send service and transactional notices, such as verification and sign-in links, receipts, renewal and price-change notices, security notices, and changes to these documents;
• respond to your support, refund, or privacy requests; and
• comply with law and enforce our Terms of Service.

We do not do behavioral advertising. We do not profile you. We do not make automated decisions about you that produce legal or similarly significant effects. We do not use your information to set a personalized price.

5a. Artificial Intelligence

Our picks, prices, and comparisons are generated by automated statistical models and software — that is the product, and it processes sports-market data, not data about you. No model we run makes any decision about you as a person; the only automated processing of your personal information is the mechanical kind described in this Policy (entitlement checks, rate and daily limits, list management).

We do not use your personal information to train any artificial intelligence or machine-learning model — ours or anyone else's — and we do not permit any provider to do so. Our email lists, account records, and API usage records are never contributed to, sold to, or shared with any AI training dataset.

We use AI-assisted software tools to build and operate the service (writing and reviewing code, operating our systems, and drafting site and email copy, which we review before it is published). In the course of operating our systems under our direction, such a tool can incidentally process service records that include personal information — the same records described in Section 3, handled under provider terms that prohibit using that data to train their models. These tools are listed in Section 8 like every other provider.

Your own AI tools. If you connect an MCP client or AI assistant to MintSlips, the data it fetches from us, and anything you tell it, is handled by that client's provider under your arrangement with them, not by this Policy.

6. Cookies, Tracking, and Local Storage

MintSlips sets no cookies. Our pages load no analytics, no advertising pixels, no session-replay tools, no tag managers, and no social widgets. Nothing on this site records your mouse movements, keystrokes, or scroll behavior.

Two features of the picks page make requests to outside services, and each one receives your IP address and browser information, as any web server does:

• Google sign-in. While you are signed out, the picks page loads Google's sign-in script so you can choose "Sign in with Google." Google handles that script, and any cookies it uses, under Google's own privacy policy.

Every other request our pages make goes to our own servers. The browser local-storage keys we use are listed in Section 3. You can remove them at any time by signing out or by clearing site data for this domain in your browser settings.

7. Do Not Track

Some browsers send a "Do Not Track" (DNT) or Global Privacy Control signal. MintSlips does not track users across third-party websites or over time, and does not sell or share personal information for advertising, so there is nothing for a DNT or Global Privacy Control signal to change, and we do not respond to it differently.

8. Who We Share It With

We use a small number of service providers, and only for the purposes listed:

• Cloudflare — runs our servers and APIs (Cloudflare Workers) and stores account, email-list, API key, usage, webhook, and subscription records (Cloudflare KV, D1, Durable Objects, and Queues); request metrics (Analytics Engine); rate limiting; DNS; and standard request logs.
• Vercel — static hosting of this website, including standard server request logs.
• Resend — delivery of our email.
• Stripe — checkout, subscription billing, payment processing, and the billing portal.
• Google — sign-in, only if you choose to sign in with Google.
• Have I Been Pwned — the breached-password check described in Section 3 (a five-character hash prefix only).
• Anthropic — AI-assisted engineering and operations tooling (Section 5a). Data processed through it is not used to train Anthropic's models under its commercial terms.
• Whop — billing and membership management for memberships bought through Whop before October 12, 2026.

We do not sell your personal information. We do not share it for cross-context behavioral advertising. Our email lists are never rented, sold, traded, or made available to any other sender.

Data you ask us to send — such as webhook events to an endpoint you register — goes where you direct it.

We may disclose information if required by law, subpoena, or other valid legal process, or where we believe in good faith that disclosure is necessary to protect our rights, investigate fraud, or protect someone's safety. If MintSlips is ever acquired or merged, or its assets sold, personal information may transfer as part of that transaction; the successor will remain bound by this Policy or will give you notice before materially changing it.

9. Email and How to Opt Out

Every marketing email we send carries a working unsubscribe link and our physical postal address. One click unsubscribes you.

Our commitments:

• The unsubscribe link keeps working for at least 30 days after the email is sent.
• We process opt-outs within 10 business days, and in practice faster.
• Opt-outs are honored indefinitely. We keep a record of the unsubscribed address for exactly that reason, and we do not re-add it unless you sign up again yourself and confirm the address.
• Unsubscribed addresses are never sold or transferred to anyone.
• Our sender names and subject lines are accurate and never deceptive.

Transactional and account notices — verification and sign-in links, receipts, renewal and price-change notices, security notices, and changes to these documents — continue while you have an account or an active paid plan even if you opt out of marketing email, because they are part of the service.

You can also opt out by writing to mintslips1@gmail.com from the address you want removed, or by mail to 82 Wendell Ave., STE 100, Pittsfield, MA 01201.

10. Your Choices and Rights

Because of our size, no comprehensive state privacy statute currently requires us to offer access, correction, or deletion rights, and we do not claim compliance with a law that does not apply to us. We offer these rights anyway, to everyone, regardless of where you live:

• Access — ask for a copy of the account, API, and membership records we hold about you.
• Correction — ask us to fix anything inaccurate.
• Deletion — ask us to delete your account and records. We will do so unless we are required to keep something for tax, accounting, fraud, or legal reasons, and we will tell you if that applies. Deleting your account does not cancel a paid subscription; cancel it first (Terms, Section 13).
• API keys — revoke any key yourself at any time on the developer page, or ask us to disconnect an MCP sign-in connection.
• Unsubscribe — see Section 9.

California and other state privacy laws. If the California Consumer Privacy Act or another state privacy law applies to your information, you have the rights that law gives you — including to know what we collect, to access, correct, and delete it, and to opt out of its sale or sharing for targeted advertising (we do neither) — and we will not discriminate against you for using them. The only sensitive personal information we hold is your account sign-in credential (a password hash), which we use only to sign you in. You may use an authorized agent; we may ask the agent for proof of authority and ask you to confirm your identity. If we decline a request, you can appeal by replying to our decision, and we will answer the appeal within the time the applicable law requires.

Send any of these requests to mintslips1@gmail.com from the email address on the account. We will acknowledge within 5 business days and complete the request within 30 days. We may need to confirm you control the address before acting, and we will never charge you for a request or treat you differently for making one.

If we materially change this Policy, we will follow the process in Section 15; we do not maintain a separate review-and-change process beyond it.

11. How Long We Keep It

• Account records (email, password hash or Google identifier, verification status, linked addresses) — until you ask us to delete your account.
• Free-list and API waitlist addresses — until you unsubscribe or ask for deletion. Unsubscribe records are kept indefinitely so the opt-out keeps working.
• Sessions — 7 days without use, 30 days at most, then they expire automatically.
• Verification, sign-in, and password-reset links — single use; they expire automatically within 24 hours (password-reset links within 1 hour).
• API key records and daily usage counts — for as long as your account exists, including for revoked keys, for security and billing records.
• Request metrics — for a limited period, under Cloudflare's retention for that service.
• Webhooks — until you delete the webhook; its delivery records are deleted with it.
• MCP sign-in connections — until they expire or are revoked.
• Subscription and membership records (email, plan, status, billing identifiers, period end) — while your plan is active plus 24 months, to handle support, disputes, and tax and accounting obligations, then deleted.
• Server and security logs — short-lived, under our hosting providers' log retention.
• Support correspondence — up to 24 months.

Records held by Cloudflare, Vercel, Resend, Stripe, Google, and Whop are retained under those providers' own policies.

12. Security

Concretely: all traffic to the site and the API is served over TLS; passwords are stored only as salted PBKDF2 hashes; API keys are shown once and stored only as SHA-256 hashes; webhook signing secrets are stored hashed and encrypted; administrative and publishing endpoints are token-gated and never exposed to the browser; sign-in and link-confirmation links are single-use tokens that expire within 24 hours; sessions expire; we hold no card data; API secrets and keys are kept outside the code repository and out of version control; member pages are served at unguessable links and are excluded from search indexing; and the site and API are rate-limited against abuse.

That said, no method of transmission over the internet or of electronic storage is 100% secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and any regulator as required by applicable law.

13. Children

MintSlips is not directed to and is not intended for anyone under 21 years old. We do not knowingly collect personal information from minors. If we learn that we have collected information from someone under 21, we will delete it promptly. A parent or guardian who believes we hold a minor's information should write to mintslips1@gmail.com and we will delete it on verification.

14. Geographic Scope

MintSlips is intended for users located in the United States. Our systems store and process personal information in the United States. The Services are not offered to, and are not directed at, individuals located in the European Economic Area, the United Kingdom, or Switzerland; we do not market there, we price only in U.S. dollars, and we do not target those regions. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

15. Changes to This Policy

If we change this Policy, we will post the revised version here with a new "Last updated" date at the top of the page. For material changes we will email account holders and subscribers before the change takes effect. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy. We review this Policy at least annually.

16. Contact

MintSlips LLC
A Massachusetts limited liability company
82 Wendell Ave., STE 100, Pittsfield, MA 01201
mintslips1@gmail.com

See also our Terms of Service, End User License Agreement, and Return and Refund Policy, the API documentation, or go to today's board.