Privacy Policy — Turf Signal

Short version: We collect your name and email to create your account. We use your email only to send a one-time verification code. We don't sell your data, don't store passwords, and don't track your betting activity. You can request deletion of your data at any time by emailing no-reply@turfsignal.live.

1. Who We Are

Turf Signal (turfsignal.live) is an AI-powered Indian thoroughbred horse racing research and analysis platform, operated . This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services.

For any privacy-related queries: no-reply@turfsignal.live

2. Information We Collect

Data	What We Collect	Why
Account Info	Full name, email address	To create and identify your account
Age Confirmation	Checkbox confirmation that you are 18 years or older	Legal compliance — service is restricted to adults
Verification Code	A one-time 6-digit code sent to your email	To verify your email address during signup and login
Session State	Auth status and preferences stored in your browser's localStorage	To keep you logged in between visits
Usage Data	Pages visited, tabs accessed, timestamps (server logs via Netlify)	To maintain and improve the service
Payment Info (when launched)	Name, email (processed by Razorpay — we never store card or bank details)	To process subscription payments

What We Do NOT Collect

Passwords — we use OTP-only authentication; no passwords are ever stored
Betting activity, wagering amounts, or gambling history
Sensitive personal data: race, religion, health, biometric, or financial data beyond what Razorpay processes
Data from third-party social networks

3. How We Use Your Information

To create and manage your account
To send email verification codes during signup and login (via Resend)
To deliver research and analysis content to verified members
To send service-related communications (account updates, policy changes)
To respond to support and data-related requests
To process subscription payments when the paid tier launches (via Razorpay)
To improve the platform based on aggregated, anonymised usage patterns

We do not use your data for advertising, profiling, or any purpose not listed above.

4. localStorage Disclosure

We store your authentication state (logged-in status, verified flag) in your browser's localStorage. This data remains on your device and is not transmitted to our servers except during active authentication. You can clear this at any time by logging out or clearing your browser data — doing so will log you out of the platform.

5. Third-Party Services

Service	Purpose	Data Shared
Resend	Transactional email delivery (verification codes)	Name, email address
Netlify	Website hosting and serverless functions	IP address, page views (server logs)
Upstash Redis	Ephemeral storage of verification codes and user verified status	Email address, verified status
Razorpay (when launched)	Payment processing and subscription management	Name, email — card/bank details handled entirely by Razorpay (PCI-DSS compliant)

We do not sell, rent, or trade your personal information to any third party. We do not share data with advertisers, data brokers, or marketing platforms.

6. Data Retention

Verification codes: Automatically expire within 10 minutes of generation
Account data (name, email, verified status): Retained for the duration of your account, and up to 30 days after a deletion request
Server logs (Netlify): Retained per Netlify's standard log retention policy
Payment records (when applicable): Retained as required by Indian tax law (Income Tax Act — currently 6 years)
localStorage data: Stored on your device until you log out or clear browser data

7. Your Rights

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), you have the following rights:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your account and personal data — we will comply within 30 days, except where retention is required by law
Withdraw Consent: Withdraw consent at any time, which will result in account termination
Portability: Request a copy of your data in a commonly used format

To exercise any of these rights, email no-reply@turfsignal.live. We will respond within 30 days.

8. Data Deletion Request

To delete your account and all associated data:

Email no-reply@turfsignal.live with subject line: "Data Deletion Request"
Include the email address associated with your account
We will confirm deletion within 30 days

Upon deletion, your name, email, and verified status will be removed from our systems. Anonymised, aggregated usage data not linked to you may be retained for platform improvement.

9. Data Security

All data transmitted between your browser and our servers is encrypted via HTTPS (TLS)
Verification codes are time-limited (10 minutes) and single-use
No passwords are stored — OTP-only authentication
User data in Upstash Redis is stored in a secured cloud environment with access controls
Payment data is handled entirely by Razorpay (PCI-DSS compliant) — we never see or store card or bank details

No method of electronic storage or transmission is 100% secure. While we implement reasonable safeguards, we cannot guarantee absolute security.

10. Children's Privacy

The Service is strictly for individuals aged 18 and above. We do not knowingly collect personal information from anyone under 18. If we become aware that an account belongs to a minor, we will immediately terminate the account and delete all associated data. Contact no-reply@turfsignal.live if you believe a minor has registered.

11. Cookies and Local Storage

We do not use tracking cookies or advertising cookies. We use localStorage to maintain your login session — this is essential for the platform to function and does not involve cross-site tracking. We do not use Google Analytics or any third-party analytics at this time. If we introduce analytics in the future, this policy will be updated with clear advance notice.

12. Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection (DPDP) Act, 2023 has been enacted but its implementing rules are not yet fully notified. We are monitoring its rollout and will update our practices and this policy to comply fully as the rules come into force.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered users at least 14 days before they take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the Service after a policy update constitutes acceptance of the revised policy.

14. Grievance Officer

In accordance with the Information Technology Act, 2000 and the SPDI Rules, 2011, the Grievance Officer for Turf Signal is:

Grievance Officer: SK
Platform: Turf Signal (turfsignal.live)
Email: no-reply@turfsignal.live

The Grievance Officer will address complaints or concerns regarding the processing of personal information within 30 days of receiving a written complaint.

15. Contact

Email: no-reply@turfsignal.live
Website: turfsignal.live