Privacy Policy
Effective: October 17, 2026. Last updated: October 17, 2026.
For accounts created before October 17, 2026, this version applies from November 16, 2026. Until then the previous version applies: read it here.
We collect what we need to run your account, bill you and stop abuse. We do not sell or share your personal information, and we do not run ads. This policy covers PuckAPI, EndzoneAPI, DunkAPI, FastballAPI, StrikerAPI, AcesAPI, BirdieAPI, FighterAPI and sportsdatahq.com. Each Service has its own accounts and its own database.
1. Who is responsible
OWSH Unlimited LLC, a New York limited liability company based in Buffalo, New York, USA, controls your personal data. Privacy questions and requests: support@endzoneapi.com.
2. What we collect
- Account data: email, name, a hashed password, whether you verified your email, when you accepted our terms and which version, and your Stripe customer ID.
- API and tool calls: the tool and the arguments you sent, time, credits charged, result status and row count, league, request ID, IP address and user agent. We receive only what an app sends to our tools, never your conversations with it.
- Sign-in sessions: the session, its IP address, user agent and expiry, and failed sign-in and key attempts (time, IP, user agent and the first characters of the key, never the full key).
- Connected apps: which AI app you connected, what you allowed, when, and the tokens it uses.
- Payments: Stripe collects your card details. We receive your customer ID, plan, amount, date, card brand and last four digits, and status.
- Where you came from: a first-touch cookie with the referring site, first page, campaign tags and time, copied to your account at signup, and the name of the AI app if you came through a connect flow. Not set in the EU, EEA, UK or Switzerland, or if your browser sends Global Privacy Control.
- Website analytics: Google Analytics 4 counts pages, device and browser, approximate location and referrer. Not loaded in the EU, EEA, UK or Switzerland, or if your browser sends Global Privacy Control.
- Emails: a record of emails we send you and anything you send to support.
We do not collect health data, precise location, government IDs or data about children.
3. Why we use it, and our legal basis
| What we do | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Run your account, issue keys, authenticate you and your apps | Account, sessions, connected apps | Contract |
| Count and bill credits, take payments, send receipts, refunds | Account, call records, Stripe data | Contract; legal obligation for tax records |
| Service emails (verification, receipts, payment failed notices, low or used-up credits, first-call notice, security, terms changes) | Account, email log | Contract |
| Optional product emails (onboarding tips, credit follow-ups, refill notices, abandoned-checkout reminders, new-season and win-back notes) | Account | Legitimate interests; you can unsubscribe |
| Support and fixing problems | Account, call records, support emails | Contract; legitimate interests |
| Stopping abuse, fraud, key sharing and attacks | IP, user agent, failed attempts, call records | Legitimate interests |
| Learning which channels bring signups | First-touch cookie, attribution record | Legitimate interests, outside the EU, EEA, UK and Switzerland only |
| Measuring website use | Google Analytics | Legitimate interests, outside the EU, EEA, UK and Switzerland only |
| Following the law and enforcing our terms | Any of the above | Legal obligation; legitimate interests |
You can object to uses based on legitimate interests (section 9). We make no automated decisions with legal or similar effects about you, and we do not profile you.
4. Who we share it with
We do not sell your data. We share it only with these service providers, who act on our instructions:
| Provider | What they do | Data |
|---|---|---|
| Stripe | Payments, invoices, fraud checks | Payment and billing data, name, email |
| Resend | Sends our emails | Email, name, message content, delivery data |
| Vercel | Hosts the website | Requests, IP addresses, logs |
| Railway | Hosts the API | Requests, IP addresses, logs |
| Neon | Hosts our database | Account, call and billing data |
| Google Analytics | Website analytics | Cookie IDs, pages, device, approximate location (not in the EU, EEA, UK or Switzerland) |
We may also share data with our professional advisers, with a buyer of the business (who must follow this policy), or where the law or someone's safety requires it. We give no personal data to any league, team, player or sportsbook.
5. Moving data between countries
We are in the United States, and so are our providers' main systems. If you are in the EU, EEA, UK or Switzerland, your data goes to the U.S. under the EU-U.S. Data Privacy Framework for providers certified under it, and otherwise under the European Commission's Standard Contractual Clauses and the UK addendum in our providers' terms.
6. How long we keep it
| Data | How long |
|---|---|
| IP address and user agent (calls, sessions, failed attempts) | 90 days, then deleted |
| Call records without IP and user agent | While your account is open, plus 30 days |
| Account data and attribution record | While your account is open, plus 30 days |
| Billing and tax records | 7 years |
| First-touch cookie | 90 days in your browser |
| Support emails | While your account is open, plus 30 days |
When you ask us to delete your account, we delete or anonymize your account data within 30 days, except billing records. Our hosting, email and payment providers keep their own logs under their own retention periods.
7. Cookies
| Name | Purpose | How long | Needed? |
|---|---|---|---|
| Session cookie | Keeps you signed in | Up to 7 days, renewed while you use it | Yes |
sdhq_oc | Remembers which AI app sent you to sign in | 30 days | Yes, for the connect flow |
sdhq_ft | Saves where you first came from | 90 days | No; not set in the EU, EEA, UK or Switzerland, or with Global Privacy Control |
_ga, _ga_<ID> | Google Analytics visit counts | Up to 2 years | No; not set in the EU, EEA, UK or Switzerland, or with Global Privacy Control |
We use no advertising or retargeting cookies. You can also block cookies in your browser or use Google's opt-out add-on (tools.google.com/dlpage/gaoptout).
8. Email
- Service emails (verification, receipts, payment failed notices, low or used-up credit notices, the first-call notice, security notices, changes to our terms) are part of the Service while you have an account.
- Product emails are optional: the short onboarding series after signup (tips and ideas), a follow-up after your credits run out, a notice when your free credits refill, a reminder if you start checkout and do not finish, a note when a new season starts, and a win-back note if you have been away. Each has an unsubscribe link, and we stop sending as soon as you unsubscribe (and always within 10 business days).
We do not sell or rent our email list.
9. Your rights
You can ask us, free of charge, to give you a copy of your data, fix it, delete it, limit its use, object to uses based on legitimate interests, or send it to you in a machine-readable format. You can revoke keys and disconnect apps yourself on your keys page. Email support@endzoneapi.com from your account address and we reply within one month. In the EU or EEA you can complain to your data protection authority, in the UK to the Information Commissioner's Office, and in the U.S. to your state attorney general.
10. We do not sell or share your personal information
We do not sell your personal information or share it for cross-context behavioral advertising, and have not in the past 12 months. We treat a Global Privacy Control signal as a request to turn off analytics and attribution for you.
11. Security
We use HTTPS, store passwords and API keys only as hashes, and limit who can reach production data. No system is perfectly secure. If a breach affects your data, we tell you and the authorities as the law requires.
12. Children
The Service is for people 18 or older. We do not knowingly collect data from anyone under 18. If you think a minor gave us data, email us and we will delete it.
13. Changes
For material changes we email you or post a dashboard notice before they take effect, and update the date at the top.
14. Contact
OWSH Unlimited LLC, Buffalo, New York, USA. support@endzoneapi.com.
Ready to start?
Get a free key