Privacy Policy

Your privacy matters to us. Here's how Windfall collects, uses, and protects your information.

Last Updated: September 1, 2026

WINDFALL SPORTS, LLC

PRIVACY POLICY

Effective Date: September 1, 2026

This Privacy Policy explains how Windfall Sports, LLC, a Utah limited liability company, together with its affiliates (“Windfall,” “we,” “us,” and “our”), collects, uses, and discloses information about you when you visit www.windfallsports.com (the “Site”), use the Windfall mobile application (the “App”), or participate in our free-to-play, skill-based daily and weekly fantasy sports contests and related features (together, the “Services”). Windfall is a free-to-play fantasy sports game only. It involves no purchases, no entry fees, and no cash or other prizes of monetary value, and we do not operate a sportsbook, casino, or other gambling service. Capitalized terms not defined here have the meaning given in our Terms & Conditions (the “Terms”).

By using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services. If you are a California resident, see Section 11 for additional disclosures. If you reside in another U.S. state with a consumer privacy law, see Section 10 for your rights.

1. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time in our discretion. If a change is material, we will provide notice as required by law, such as by email, in-app notice, or by posting on the Site. For non-material changes, we will post the revised policy with an updated Effective Date. Your continued use of the Services after a change takes effect means you accept the revised Privacy Policy. You are responsible for keeping your contact information current and for reviewing this Privacy Policy periodically.

2. Personal Information We Collect

“Personal Information” means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with you or your household, as defined by applicable privacy laws. We collect Personal Information directly from you, automatically through your use of the Services, and from third parties.

The information we collect depends on how you use the Services. We collect the information described below to create and secure your Account, operate Contests, communicate with you, support analytics and advertising, and comply with law. Because the Services are free and involve no purchases, entry fees, or cash prizes, we do not collect payment card, bank account, or tax identification information, and we do not perform financial or government-ID identity verification.

2.1 Information You Provide to Us

We collect Personal Information you provide when you create an Account, set up your profile, enter Contests, contact us, or otherwise use the Services, including:

  • Identifiers and account information: name, username and password, email address, phone number, postal address, date of birth, and state of residence;
  • Contest and gameplay information: your entries, lineups, standings, achievements, and related gameplay records; and
  • Communications: the content of messages, chats, emails, calls, survey responses, and feedback you send us, which we may record and retain to provide support and for the purposes described below.

2.2 Information We Collect Automatically

When you use the Services, we and our service providers automatically collect certain information, including: device and connection information (IP address, device and advertising identifiers, hardware model, operating system, browser type); usage information (pages and screens viewed, clickstream, referring and exit pages, dates and times of access, and interactions with the Services); and approximate location derived from your IP address, used for security, fraud prevention, and to tailor the Services. See Section 4 for cookies and similar technologies.

2.3 Information We Receive from Third Parties

We may receive Personal Information about you from third parties, including analytics and advertising providers; fraud-prevention and security vendors; social media platforms when you interact with our content or connect an account; and other commercially or publicly available sources. We may combine this information with information we already have about you to prevent fraud and to provide, personalize, and improve the Services.

3. How We Use Personal Information

We use Personal Information for the following business and commercial purposes:

  • to create and administer your Account and provide the Services;
  • to operate Contests, record entries and results, and maintain your Windfall Points balances and standings;
  • to detect, investigate, and prevent fraud, cheating, multi-accounting, and other prohibited or unlawful activity, and to enforce our Terms;
  • to provide customer support and respond to your communications;
  • to comply with applicable legal and regulatory obligations and respond to lawful requests;
  • to operate, analyze, personalize, and improve the Services and develop new features;
  • to send you administrative, transactional, and (where permitted) marketing communications; and
  • for any other purpose disclosed at the time of collection or with your consent.

We may create and use aggregated or de-identified information, which is not subject to this Privacy Policy, for any lawful purpose.

4. Cookies and Tracking Technologies

We and our service providers may use cookies, pixel tags, mobile advertising identifiers, software development kits (SDKs), and similar technologies to operate and secure the Services, remember your preferences, authenticate logins, measure performance, analyze usage, and (subject to Section 6) deliver and measure advertising. Some of these technologies are provided by third-party analytics and advertising partners that may collect information about your activity over time and across other websites and apps. You can manage cookies through your browser settings and limit ad tracking through your device settings; disabling these may impair certain features. We describe how we respond to browser privacy signals in Section 13.

5. How We Disclose Personal Information

We disclose Personal Information as follows:

  • Service providers and vendors: companies that perform services on our behalf, such as hosting and cloud storage, analytics, advertising and measurement, customer support, and communications, which are permitted to use the information only to provide services to us;
  • Other users: limited profile information (such as your username) and contest participation may be visible to other users through leaderboards and social features, according to your settings;
  • Government and legal requests: we may disclose information to comply with applicable law, legal process, subpoenas, or governmental requests;
  • Legal and safety: to enforce our Terms, protect our rights, property, and safety and those of our users and others, and detect and prevent fraud or security issues;
  • Corporate transactions: in connection with a merger, acquisition, financing, sale of assets, or similar transaction, in which Personal Information may be transferred as a business asset;
  • Affiliates: with our corporate affiliates, who are required to honor this Privacy Policy; and
  • With your consent or at your direction.

We do not sell your Personal Information for money. Depending on your state, certain disclosures for targeted advertising may be considered a “sale” or “sharing” under applicable law; see Section 6 for your opt-out rights.

6. Targeted Advertising and Your Opt-Out Rights

We and our advertising partners may use cookies and similar technologies to deliver advertising that is tailored to your interests on the Services and on other sites and apps. Under some state laws, this activity may be considered a “sale” or “sharing” of Personal Information for cross-context behavioral or targeted advertising. You have the right to opt out. You may opt out by using the “Do Not Sell or Share My Personal Information” link on the Site, by adjusting your account settings, or by contacting us as described in Section 14. Where required by law, we honor the Global Privacy Control (GPC) and similar opt-out preference signals enabled in your browser. We do not knowingly sell or share the Personal Information of individuals under 18.

7. Analytics and Advertising Partners

We may work with third-party analytics and advertising partners that use cookies, mobile advertising identifiers, and software development kits (SDKs) integrated into the Services. Analytics partners help us understand how users interact with the Services so we can measure performance and improve features. Advertising partners help us deliver and measure advertising, including interest-based advertising shown on the Services and on other sites and apps, and may collect device identifiers, IP address, and information about your activity over time and across services. These partners may act as our service providers or, in some cases, as independent controllers under their own privacy policies. We do not direct advertising to users we know to be under 18. You can control this activity as described in Sections 4 and 6, including by resetting or limiting your device’s advertising identifier and by using the “Do Not Sell or Share My Personal Information” control and recognized opt-out preference signals.

8. Data Retention and Security

We retain Personal Information for as long as needed to provide the Services and for legitimate business and legal purposes, including operating your Account, enforcing our Terms, resolving disputes, and complying with legal obligations and retention schedules. When Personal Information is no longer needed, we delete, de-identify, or archive it in accordance with our retention practices, and we honor deletion requests subject to legal exceptions. We use reasonable administrative, technical, and physical safeguards designed to protect Personal Information, including access controls, encryption of data in transit, and monitoring, but no system is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your Personal Information, we will notify you and regulators as required by applicable law.

9. Children

The Services are not directed to, and may not be used by, anyone under 18 years of age, and we do not knowingly collect Personal Information from anyone under 18. If we learn that we have collected Personal Information from a person under 18, we will delete it, unless we are required to retain it by law. If you believe a person under 18 has provided us Personal Information, contact us at support@windfallsports.com.

10. Your Choices and Privacy Rights

10.1 Marketing and Communications

You may opt out of marketing emails using the unsubscribe link in those emails or by contacting us. If you provide a mobile number and consent to text messages, you may opt out of marketing texts at any time by replying STOP; message and data rates may apply. We may still send you transactional and service-related messages, such as account, security, and billing notices. You may review and update certain Account information through your Account settings.

10.2 State Privacy Rights

Depending on your state of residence you may have the right to:

  • confirm whether we process your Personal Information and access a copy of it;
  • correct inaccurate Personal Information;
  • delete Personal Information we maintain about you, subject to legal exceptions;
  • obtain a portable copy of certain Personal Information;
  • opt out of targeted advertising and the “sale” or “sharing” of your Personal Information (see Section 6);
  • opt out of certain profiling and limit the use of sensitive Personal Information; and
  • appeal a denial of a privacy request, where applicable.

We will not discriminate against you for exercising these rights. To submit a request, contact us as described in Section 14. We will verify your identity before responding, typically by confirming information associated with your Account, and will respond within the time required by applicable law. You may use an authorized agent to submit a request on your behalf, subject to verification that the agent is authorized.

11. Additional Notice for California Residents

This section provides additional disclosures required by the California Consumer Privacy Act, as amended (the “CCPA”), for California residents. The categories of Personal Information we collect, the sources, the parties to whom we disclose it, and the purposes are summarized below and described throughout this Privacy Policy.

| Category of Personal Information | Sources | Disclosed To | Business / Commercial Purpose | | --- | --- | --- | --- | | Identifiers (name, username, email, phone, address, IP, device and online identifiers) | You; automatically; third parties | Service providers; vendors; advertising partners | Provide the Services; verify identity; support; fraud prevention; advertising | | Customer records (Cal. Civ. Code § 1798.80) (payment/financial info, ID and tax info) | You; third parties | Service providers; payment processors | Process transactions; verify identity; tax and legal compliance | | Protected classifications (age, date of birth) | You; third parties | Service providers | Eligibility and age verification; legal compliance | | Commercial information (purchases, entries, winnings, redemptions) | Automatically; you | Service providers; vendors | Provide the Services; analytics; fraud prevention | | Internet / network activity (usage, interactions, clickstream) | Automatically; third parties | Service providers; analytics; advertising partners | Operate and improve the Services; advertising; fraud prevention | | Geolocation (incl. precise location) | Automatically | Service providers | Verify permitted location; fraud prevention; legal compliance | | Sensitive PI (government ID and tax ID numbers, account credentials, precise geolocation; biometric data if used) | You; automatically; third parties | Service providers; verification vendors | Identity and age verification; security; legal compliance | | Inferences | Derived | Service providers | Personalize and improve the Services |

California residents have the right to know/access, correct, and delete Personal Information, and to opt out of the sale or sharing of Personal Information, as described in Sections 6 and 10. We use and disclose sensitive Personal Information only for purposes permitted by the CCPA. Under California's “Shine the Light” law (Cal. Civ. Code § 1798.83), we offer California residents a cost-free way to opt out of disclosures of Personal Information to third parties for their direct marketing purposes (see Section 6), and therefore are not required to maintain or disclose a separate list. You may use an authorized agent and may appeal a denied request as described in Section 10.

12. Third-Party Links and Services

The Services may link to or integrate with third-party websites, applications, and services that we do not control, including social media platforms, analytics providers, and advertisers. We are not responsible for the content or the privacy and data practices of those third parties, and this Privacy Policy does not apply to them. Their terms and privacy policies govern your interactions with them, and we encourage you to review them.

13. Do Not Track and Browser Signals

Some browsers offer a “Do Not Track” (DNT) setting. Because there is no common industry standard for DNT, we do not respond to DNT signals. However, where required by law, we recognize and process the Global Privacy Control and similar opt-out preference signals as described in Section 6.

14. U.S.-Only Services; Data Location; Contact Us

The Services are intended for users located in the United States, and Personal Information is stored and processed in the United States. We do not direct the Services to, or knowingly offer them in, other countries.

If you have questions about this Privacy Policy or wish to exercise a privacy right, contact us at support@windfallsports.com. For general support, contact support@windfallsports.com.