Privacy Policy

1. Overview

This Privacy Policy explains what information Slate collects, how it is used, and the choices you have. Slate is designed to collect the minimum information needed to operate a secure, invitation-based research platform.

2. Information We Collect

• Account information. Name (as provided by you or your inviter), email address, role, and account status. Administrator sign-in uses Replit's identity service, which shares a user identifier and profile basics; invited reviewer accounts store a salted, one-way password hash — never the password itself.
• Session data. A signed session cookie containing your account identifier and a session revision number. Sessions are required for the Service to function.
• Audit records. For platform integrity, sign-ins, sign-outs, page and report views, exports, and administrative actions are recorded in an append-only audit log with timestamps and account identity.
• Legal acceptance records. The version and timestamp of each legal document you accept, together with your account identifier and, where available, IP address.
• Technical data. Standard web-server information such as IP address and browser type may appear in operational logs.

3. What We Do Not Collect

Slate does not collect payment card details (no paid tiers exist yet; any future payments would be processed by a dedicated payment processor, not stored by Slate), does not run third-party advertising or tracking networks, and does not sell personal information.

4. Cookies

Slate uses a single first-party session cookie strictly necessary for authentication. No advertising or cross-site tracking cookies are used.

5. How Information Is Used

• Operating, securing, and auditing the Service (authentication, role enforcement, revocation, tamper-evident logs).
• Communicating with you about your account (e.g., invitations, password resets, approval notifications).
• Recording legally required acceptances and acknowledgements.
• Aggregate, non-identifying service statistics.

6. Sharing

Personal information is not sold or rented. It is shared only with infrastructure providers necessary to run the Service (hosting, database, identity, and — for sports data — providers who receive no personal information about you), or when required by law.

7. Retention

Account information is kept while your account exists. Audit and legal-acceptance records are retained after account deletion because they are integrity and compliance records; they are the only records retained. Operational logs rotate on a short schedule.

8. Account Deletion and Your Rights

You may request access to, correction of, or deletion of your account information by contacting support@slate.bet or your administrator. Deletion removes the account and profile; append-only audit and acceptance records are preserved as described above. Depending on your jurisdiction, you may have additional statutory rights, which we will honor as required by law.

9. Security

Access is role-based and enforced server-side; reviewer accounts are read-only; passwords are stored as scrypt hashes; sessions can be revoked immediately by an administrator; and audit tables are append-only at the database level. No method of transmission or storage is completely secure, but the Service is engineered so that integrity failures are loud rather than silent.

10. Children

The Service is not directed to, and may not be used by, anyone under the age required by their jurisdiction, and in no case anyone under 18.

11. Changes

Material changes to this policy will be indicated by a new version identifier and, where appropriate, re-acceptance will be requested. Acceptance is recorded with version and timestamp.

12. Contact

Privacy questions: support@slate.bet.