MINIMAL ACCOUNT DATA.
This policy explains how The MMA Predictor uses account, authentication, subscription, referral and affiliate data.
WHAT WE STORE
After you finish onboarding, we store an internal user ID, the email address you verified, display name, consent timestamps, display preferences, email preference, plan and subscription status. For paid members, we also store the Stripe customer and subscription references needed to manage access. If you submit a data-correction report, we store the affected page, issue type, report text and any optional contact email you provide. Referral use may add a pseudonymous touchpoint, attribution, aggregate activity and an immutable money ledger. Affiliate applications add the business contact and audience information you submit. Referrer and affiliate dashboards never reveal a referred person’s identity.
WHAT WE DO NOT STORE
We never log or retain plaintext passwords. When MMA Predictor email-and-password sign-in is active, Better Auth processes passwords server-side solely for hashing or verification, and D1 stores only a one-way credential hash, revocable session identifiers and minimized security metadata. Raw network addresses and full browser user-agent strings are replaced with pseudonymous or coarse values before those authentication records are written. Full payment-card details are entered on and retained by Stripe.
HOW IT IS USED
- Provide your persistent account and preferences.
- Determine feature access from subscription status confirmed by Stripe.
- Start and manage Core or Pro subscriptions when you choose a paid plan.
- Maintain security and respond to account requests.
- Review and resolve reports about database accuracy.
- Attribute eligible referrals, prevent abuse, reconcile rewards and produce affiliate payout records.
- Measure aggregate page and product usage through Google Analytics only when analytics permission has been granted.
AUTHENTICATION & EMAIL
The active sign-in service handles authentication and session security. For MMA Predictor email-and-password accounts, Better Auth handles password hashing, email verification, sessions and secure recovery tokens, while Resend delivers verification, password-reset and email-change service messages. Creating an account does not provide marketing consent; that choice remains separate and optional.
YOUR CHOICES
You can update your display name and email preference inside Account. Marketing consent is separate from account, referral and affiliate service messages and can be changed without affecting eligibility. You can also delete your MMA Predictor account after any paid subscription has ended. Deletion revokes active sessions and removes the associated identity record; financial and referral records that must be retained are pseudonymised rather than silently rewritten.