Privacy Policy

Version and effective date

Version 2026-10-14.2. This policy takes effect on the date it is published, which is recorded with the approval that published it.

It describes the features, providers and deletion jobs in place on that date. When any of them change, the policy changes with them and the version changes too.

Who we are and scope

HiLulu, LLC, a Wyoming limited liability company, operates Tikata. This Privacy Policy explains how we collect, use and disclose information through Tikata and when you contact us. It also explains your choices. Questions and privacy requests go to support@tikata.io.

Tikata is intended for a United States audience. This policy covers Tikata, not independent services you visit through links. Some account or beta features may be unavailable to you; the sections describing them apply only when you use them.

Information you provide

Sign-in and accounts: when you request a sign-in link, we receive your email address. Authentication records include an account identifier and sign-in/session information. A beta sign-in request can create an authentication record even if you have no invitation and cannot enter the beta.

Following and betting breaks: without an account, Tikata saves followed-market keys, a betting-break setting and recent searches in your browser. When public account features are available and you sign in, followed-market keys and an active betting-break record can be stored with your account. The initial Following merge adds browser selections to the account rather than removing either list. An account break includes when it started.

Acceptance records: when you affirmatively accept account Terms, we record your account identifier, the Terms and Privacy Policy versions, acceptance time and the surface where acceptance occurred. A temporary browser record carries the versions and time across the email sign-in flow; it does not include your email.

Private beta: if you are admitted and use these features, we store your membership status, saved selections, Circle memberships and ownership, shared selections and reports you submit. Private beta activity is account-linked. Where a feedback or quote feature is enabled, it stores the feedback you submit and any separately approved quote, attribution and permission record.

Model notice: if you request the one-time model email, we store your email address, request source, consent-text version and the record needed to manage that request and its unsubscribe link. It is a separate record from an account, even if you use the same email address.

Tikata+ membership: when you buy Tikata+, we store your plan, price and membership status and their dates, the Stripe customer and subscription identifiers, the email address you paid with, and a record of what you agreed to at checkout: the plan and price shown, the versions of the terms and of the Terms and Privacy Policy you accepted, your confirmation that you are 21 or older, and when you agreed. We do not receive or store your full card number.

Support and privacy requests: we receive the content and contact information you send us, along with our correspondence and information reasonably needed to resolve or verify the request. Do not send passwords, payment-card details or unnecessary sensitive information.

Information collected during use

Public-site measurement records a limited set of interactions, such as opening research, viewing a result or using a supported account control. These event records use a random browser identifier that rotates about every 30 days. The public event payload does not include your email, account identifier, user access token, raw search text or stake amount, including when you are signed in.

That identifier still distinguishes activity from one browser for a period of time; we do not describe all technical data as unidentifiable. Private beta activity has a separate account-linked measurement path. Public event collection is suppressed while Tikata's betting break is active.

College football headshots are loaded directly from ESPN at a.espncdn.com, so your browser contacts ESPN and ESPN receives the ordinary request information, including your IP address. We send ESPN nothing about your account.

Our hosting and database providers receive technical request information, such as IP address, browser/user-agent information, requested paths and timestamps, to deliver and protect the service. This infrastructure information is distinct from the limited public-event payload described above.

When a sign-in or checkout form uses Cloudflare Turnstile, Cloudflare processes browser and network challenge information to help tell a legitimate visitor from automated abuse.

While a founding seat is held for you during checkout, we keep a hashed form of your IP address to stop one visitor holding many seats.

How we use information

We use information to deliver the website and research features; authenticate sign-ins; maintain settings and records you choose to save; manage authorized beta access and sharing; honor communication and betting-break choices; understand how the service is used; troubleshoot errors; detect misuse; answer support and privacy requests; and comply with applicable legal obligations.

A one-time model-notice request is used for that notice and administration of the request. It is not consent to unrelated or recurring marketing. Saving or following a selection does not, by itself, enroll you in push or email alerts.

We use acceptance and request-handling records to administer the service and document the choices made. Any new use materially different from the purposes described here requires review and appropriate notice or consent.

Browser storage and tracking choices

Tikata uses first-party browser storage for Following, recent searches, betting-break settings, its random measurement identifier and, when applicable, authentication sessions and pending acceptance. Authentication storage lets the same browser remain signed in; protecting access to your device and email is important.

You can clear Tikata's stored website data through your browser settings. This removes browser-local settings and can sign you out. It does not itself delete server-held records, and visiting again may create a new random measurement identifier. Unfollowing an item or ending a break changes the corresponding setting through the controls available to you.

Tikata sets no cookies and carries no advertising or third-party analytics SDK and no retargeting pixel. The measurement described above runs through our own event collection and Supabase. That does not mean providers receive no technical information: loading any page involves the request information described above.

We do not currently detect Global Privacy Control, Do Not Track or similar browser signals. We would rather say so than imply a control we have not built. Because we run no advertising or cross-context tracking, there is at present nothing for such a signal to switch off.

Who receives information

Service providers receive information needed to operate Tikata. Supabase provides authentication, databases and related infrastructure for account and research records, notices and usage events. Supabase also serves public market data and images; requests for them carry technical request information. Vercel hosts and delivers the website and its functions.

Resend delivers sign-in links, Tikata+ membership email (join links, purchase confirmations, and renewal and price-change notices) and Member Voice bug-report email; it receives the recipient email address and the message. Google Workspace receives and stores email sent to support@tikata.io, which includes whatever you put in a support request, a privacy request or a legal notice.

Cloudflare runs the Turnstile bot check on the sign-in and checkout forms and receives the browser and network challenge information that check needs. Stripe takes payment for Tikata+ and receives your payment details; Tikata never receives or stores your full card number.

If you use a private sharing feature, its permitted members receive the content you choose to share and the attribution shown by that feature. They may retain copies outside Tikata. Sharing feedback privately does not authorize publication as a testimonial.

We may disclose information when reasonably necessary to comply with a binding legal obligation or valid legal process, protect people's safety, investigate misuse, or establish, exercise or defend legal rights. A corporate transaction involving Tikata may involve a transfer of information subject to applicable law and appropriate protections; this does not authorize using information inconsistently with applicable privacy obligations.

When you leave Tikata through a third-party link, the destination receives the information ordinarily involved in a direct visit and any information you choose to provide there. That destination's own policy applies. Tikata's current reviewed outbound links suppress the referring page; they do not send a Tikata account or place a transaction for you.

Sale targeted advertising and sensitive information

Tikata does not sell your personal information, and does not share it for cross-context behavioral advertising or targeted advertising. We run no advertising, no ad SDK and no retargeting pixel.

That statement describes the configuration Tikata runs and the provider purposes listed above. It is not a legal certification under any particular state definition.

Tikata never asks for your sportsbook credentials, and the research features described here need no payment details at all. Paying for Tikata+ is handled by Stripe, which receives your card details directly; Tikata does not receive or store your full card number. If you send sensitive information in a support request, we will handle it for the request and applicable legal obligations; avoid sending information we do not need.

A betting break is a setting you choose on your account, and Tikata treats it as exactly that. It is not a health or clinical record and we do not read it as one. We make no blanket claim that nothing we hold counts as sensitive under the law where you live.

Retention

We retain information for the purposes described in this policy, considering the feature you use, whether it remains needed to provide that feature, security needs, applicable recordkeeping requirements and legal obligations. Different categories and provider systems have different retention periods.

Public usage-event records older than 90 days are subject to a daily deletion job. Browser-local data remains until you remove it or the feature expires or replaces it; the random measurement identifier rotates about every 30 days. Clearing your browser does not remove records already sent to our systems.

Scheduled deletion runs every day. Authentication rows for people who asked to sign in without an invitation are removed after 30 days. Beta analytics and public usage events are removed after 90 days. A model-notice record is removed 7 days after the notice is sent, or 12 months after the request if no notice was sent, whichever comes first.

Five deletion jobs run every day, covering authentication rows for people who asked to sign in without an invitation, beta analytics events, growth events, model-notice requests, and Tikata+ billing and checkout records 7 years after the last payment. Anything not covered by one of those five is kept until you delete your account or ask us to remove it.

Deleting active records does not mean all backup or security-log copies disappear immediately. Public research receipts and corrections may remain as a research record where they do not identify you.

Deleting an account or a separate request

Where an account-removal control is available, you can use it after reviewing the confirmation, or contact support@tikata.io for help. The removal action deletes the authentication account and associated records covered by the account-deletion flow. A pending beta invitation can be canceled by removal.

If you own a private Circle, deleting your account also deletes the Circle and contributions and reports in it, including contributions from other members. Your own shares in other Circles are also removed through account deletion. Other members are not asked first. Review the counts and warnings before confirming.

A one-time model-notice request is stored separately and is not deleted merely because you delete an account. Use its unsubscribe link where provided, or ask support@tikata.io to remove that separate request. Tell us which request you want removed. Browser-local copies on other devices and copies other people made may need separate action.

Deleting your account also deletes the consent records attached to it, with one exception for Tikata+ purchases: we keep your billing records (the Stripe identifiers, amounts and dates) and your checkout agreement record for 7 years after your last payment, unlinked from your account, because we need them for tax, refunds and payment disputes, and then delete them. Deleting your account also cancels any Tikata+ subscription, so no further charge is made. Copies can remain for a limited period in backups and security logs after that. We do not promise that every copy disappears at once, and we do not keep a copy longer than the purposes described here require.

Your privacy requests and rights

You can contact support@tikata.io to ask about your information, request access, correction or deletion, or raise a privacy concern. Describe the request and how you have used Tikata so we can identify the relevant records. We may need information proportionate to the request to verify your identity or an authorized agent's authority. Please do not send identity documents unless we explain why they are needed and provide an appropriate way to send them.

Depending on your state of residence, the laws that apply to Tikata and applicable exceptions, you may have rights to confirm processing, access information, obtain a portable copy, correct inaccuracies, delete information, opt out of sale or certain advertising or profiling, or limit certain uses of sensitive information. Where applicable, you may use an authorized agent and appeal a denied request. We will not unlawfully discriminate against you for exercising a privacy right.

For an appeal where available, reply to our decision or email support@tikata.io with the subject "Privacy appeal" and explain what you want reconsidered. We will explain the applicable outcome and complaint route. Nothing in this policy limits your right to complain to your state privacy authority or attorney general.

We handle every privacy request the same way, wherever you live, rather than asking you to work out which law applies to you. Email support@tikata.io. We reply as promptly as applicable law requires, and we will tell you if we need more time and why. If we refuse a request, we explain why and how to ask us to reconsider.

Children security and processing locations

Tikata is for adults 21 and over, not children. If you believe a child has provided personal information, contact support@tikata.io so we can investigate and take appropriate action.

Tikata is for adults 21 and over. We do not knowingly collect information from anyone under 21. Stating an age requirement is not the same as verifying age, and we do not claim to verify it.

We use technical and organizational measures intended to protect information, including access controls for account records. No internet service or storage system can guarantee complete security. Contact us if you suspect an account-security problem.

Our providers operate infrastructure in more than one location, and information may be processed outside the state or country you are in. We do not claim that everything is stored only in the United States, and we hold no international transfer certification.

Changes and contact

We will identify the version and effective date when we update this policy and provide additional notice or obtain consent where required for a material change. The policy in effect should describe the features and information practices actually in use.

For privacy questions and requests, contact HiLulu, LLC at support@tikata.io.

Service providers

• Supabase: Authentication and the database that stores accounts, following and research records.
• Vercel: Hosting and delivery of the website.
• Resend: Sending sign-in links, Tikata+ membership email (join links, purchase confirmations, and renewal and price-change notices) and Member Voice bug-report email.
• Google Workspace: Receiving and storing email sent to support@tikata.io, including support and privacy requests and formal legal notices.
• OpenAI: Drafting story prose from pick and statistical facts. It receives no information about you: the request carries the template, the franchise, a facts hash and the sporting facts themselves.
• Cloudflare: Bot check on the sign-in and checkout forms, through Turnstile. Cloudflare receives browser and network challenge information used to tell a person from automated abuse.
• Stripe: Taking payment for Tikata+. Stripe receives your payment details and the information needed to bill and refund a membership. Tikata never receives or stores your full card number.
• Apple: Sign in with Apple, for members who choose it: an account identifier and an email address (an Apple relay address with Hide My Email), and a name only if the member shares it.
• Google: Google sign-in, for members who choose it: an account identifier, an email address, a name and a profile picture link.