Privacy Policy

1. What SaltyTrack Is

SaltyTrack is an open-source match tracker and prediction tool for SaltyBet. It consists of a Chrome extension that displays fighter stats on saltybet.com and a companion website at saltytrack.com that provides leaderboards, matchup analysis, and accuracy dashboards.

SaltyTrack is not affiliated with, endorsed by, or connected to SaltyBet or the SaltyBoy API. These are independent services; SaltyTrack simply reads publicly available match data from the SaltyBoy API.

All betting on SaltyBet uses fictional currency with no real-world value. No real money is wagered, exchanged, or at stake at any time. Dollar signs ($) shown in SaltyTrack are used purely for display purposes and represent SaltyBet's in-game play money.

2. What We Collect

2a. Data the Extension Reads from saltybet.com

The extension reads fighter character names displayed on saltybet.com. These are fictional in-game character names, not real people. No other page content is read. No SaltyBet credentials, balances, bet amounts, or chat messages are accessed.

2b. Data the Extension Sends to the Server

The extension sends the following requests to the SaltyTrack cloud API (api.saltytrack.com):

• Matchup lookup — the two fighter names are sent as URL query parameters so the server can return their historical statistics.
• Recent results — a read-only, paginated request with no user data; returns the latest match outcomes.
• Health check — a periodic request (every 2 minutes when connected, every 10 seconds when disconnected) with no user data, used to display the server status indicator.
• Anonymous usage events — the extension sends anonymous interaction events (e.g. session starts, panel opens, link clicks) to the server in batches every 60 seconds. Each install generates a random ID (not tied to any account) for counting unique users. Events contain no fighter names or personal data. Raw events are retained for 30 days, then aggregated into anonymous daily counts.

No personal data (IP addresses, usernames, identifiers, or browsing history) is included in these requests by the extension. The server receives standard HTTP metadata (IP address, user-agent) as part of normal web traffic — see section 2e below.

2c. Data Stored on Your Device

The extension stores the following data locally:

• Chrome sync storage — your server preference (cloud or local URL) and the AI insights on/off toggle. If you are signed into Chrome, these two settings sync across your browsers.
• Chrome local storage — a diagnostic log of endpoint trust warnings (up to 50 entries with timestamps, kept on-device only, never sent to any server).
• Page localStorage on saltybet.com — your overlay drag position ({x, y} coordinates) so the overlay stays where you placed it between page loads.

None of this stored data contains personal information.

2d. AI-Powered Summaries

When AI Insights is enabled (the default), the SaltyTrack server — not the extension — sends fighter names and aggregated match statistics (win/loss records, ELO ratings, head-to-head history) to the OpenAI API to generate a short matchup summary. No personal data is included in these requests — only publicly available fictional character statistics. Summaries are cached server-side for up to 24 hours to reduce API calls.

You can disable AI summaries at any time using the toggle in the extension settings page. When disabled, no data is sent to OpenAI.

2e. Server-Side Operational Logs

Like any web server, the SaltyTrack API server receives your IP address and user-agent string as part of standard HTTP requests. These are used for:

• Rate limiting — to prevent abuse and ensure fair access for all users.
• Abuse detection — IP addresses are masked (last octet removed) and hashed (SHA-256, non-reversible) in application logs. Full IPs are never stored in the database.
• Web server access logs — standard Gunicorn access logs include source IP, request path, and status code. These logs are ephemeral and managed by the hosting platform (Render.com).

IP addresses are not stored in the SaltyTrack database, not sent to OpenAI or any other third party, and not used for tracking, profiling, or advertising.

2f. Website Analytics & Ads

The saltytrack.com website (not the extension) uses Google Analytics (GA4) for basic usage analytics and Google AdSense for advertising. These third-party services may set their own cookies as described in Google's Privacy Policy. The Chrome extension does not use Google Analytics, does not set cookies, and does not contain advertising.

2g. Match Data (public, collected by server)

Separately from the extension, the SaltyTrack server collects publicly available match results from the SaltyBoy API (fighter names, outcomes, tiers, bet totals). This data describes in-game characters and is not personally identifiable.

3. How We Use Your Data

• Fighter names — used solely to look up match statistics and generate predictions. Not used for any other purpose.
• Extension settings — used to remember your server preference and feature toggles. Not sent to any server.
• IP addresses — used only for rate limiting and abuse prevention. Not stored permanently or shared.

4. Who We Share Data With

Recipient	What They Receive	Why
OpenAI	Fighter names + aggregated stats (win rates, ELO, H2H)	Generate AI matchup summaries (can be disabled)
Render.com	Standard HTTP metadata (IP, request path)	Infrastructure hosting; managed by their retention policy
Google Analytics (website only)	Anonymized page views, browser type	Understand website usage
Google AdSense (website only)	Ad-serving data per Google's policies	Advertising on the website
Ko-fi	Nothing from SaltyTrack; user-initiated only	Optional tip jar

We do not sell, rent, or trade any data to third parties. We do not use data for advertising, creditworthiness, or profiling.

5. What We Do NOT Collect

• Your SaltyBet username or password
• Your SaltyBet balance, bets placed, or bet amounts
• Your browsing history on any site (including saltybet.com pages visited)
• Your name, email, age, or any personal identifiers
• Keystrokes, clicks, scroll position, or mouse movements
• Cookies (the extension sets none)

6. How Long We Keep Data

Data	Retention
Extension settings (sync + local storage)	Until you uninstall the extension or clear Chrome storage
Overlay position (localStorage)	Until you clear saltybet.com site data
AI summary cache (server-side)	24 hours, then automatically deleted
Match statistics (server database)	Indefinitely (public data, not tied to any user)
Web server access logs	Managed by Render.com; typically days to weeks
Application abuse logs (masked IPs)	In-memory only; cleared on server restart

7. How to Delete Your Data

• Extension settings — uninstall the extension, or go to chrome://extensions → SaltyTrack → Details → "Clear storage".
• Overlay position — clear site data for saltybet.com in Chrome settings, or open DevTools → Application → Local Storage → delete saltytrack-position.
• Server data — the server stores no data tied to your identity. Match statistics are public and not user-specific. If you run a local instance, delete the SQLite file to remove all data.

8. Security

• All extension-to-server communication uses HTTPS (TLS encryption in transit).
• The background service worker validates that only /api/* paths are proxied — arbitrary URLs cannot be fetched.
• Only two server endpoints are permitted: the official cloud API and localhost. Custom remote URLs are blocked.
• Local server permissions are requested at runtime and revoked when no longer needed.
• Server-side: IP addresses are masked and hashed before logging. Rate limiting and circuit breakers protect against abuse.
• The OpenAI API key is stored server-side only and never exposed to the extension or browser.

9. Extension Permissions Explained

Permission	Required?	What It Does
Content script on saltybet.com	Yes	Reads fighter names from the page and displays the stats overlay
Host: api.saltytrack.com/api/*	Yes	Sends fighter names to look up match statistics, recent results, and health status
Host: 127.0.0.1 / localhost	Optional (runtime)	Connects to a self-hosted local server; revoked when you switch back to cloud
Storage	Yes	Saves your server preference, AI toggle, diagnostic log, and overlay position

10. Local Mode

If you choose "Local Server" in the extension settings, all API requests go to your own computer. No data is sent to saltytrack.com, OpenAI, or any external server. Match data collection from the SaltyBoy API is handled by your local server independently. The local SQLite database is stored in your project directory and is never uploaded.

11. Children's Privacy

SaltyTrack is not directed at children under 13. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with a revised "Last updated" date. Continued use of SaltyTrack after changes constitutes acceptance of the new policy.

13. Contact

If you have questions about this policy, please open an issue on the SaltyTrack GitHub repository.