whales.fyi

Privacy Policy

Last updated: August 2026

1. Introduction

whales.fyi (“we”, “us”, or “our”) is a calculator for working out which in-game deals are worth buying. It is run by one person. This policy explains what we collect, how we use it, and how to get rid of it.

The short version: there are no ads, no analytics, and no trackers. We do not sell your data, and we do not use your sheets to train machine-learning models. The only information we hold is what the app needs to sign you in and save your work. Even our fonts are served from our own servers, so loading a page does not tell anyone else you were here.

2. Using whales.fyi without an account

You can use the whole calculator without signing in. When you do, your work never leaves your browser — the items, deals and points you enter stay in memory and the optimizer runs on your own device. Nothing is sent to us, and refreshing the page clears it. Signing in is what makes your work persist.

3. Information we collect

If you sign in, we collect the following:

• Account information. We use Google or Discord to sign you in, and receive your name, email address, whether that email is verified, your profile picture URL, and your account identifier at that provider. We never see your password, and we do not read your messages, contacts, or anything else from those accounts.
• Authentication and session data. The tokens your sign-in provider issues, so you stay signed in, plus a session record holding a session token, its expiry, your IP address and your browser's user-agent string.
• Your content. The sheets you create — their names, the order you arrange their tabs in, your items, your deals with their costs, outputs, use limits and dates, the points you assign, and per-sheet settings such as your chosen theme. This is the data the service exists to store.
• Subscription information. If you subscribe: your plan, its status, the current period end, and customer and subscription identifiers from our payment provider.

What we do not collect

• No analytics, advertising, tracking pixels or third-party cookies.
• No card numbers or bank details — our payment provider handles those, and we never see them.
• No location data beyond the coarse origin implied by an IP address.
• Nothing else from your device.

4. How we use your information

We use what we collect only to run the service:

• To sign you in and keep you signed in (necessary for our contract with you).
• To store your sheets and sync them across your devices (necessary for our contract with you).
• To take payment and unlock paid features (necessary for our contract with you).
• To keep the service secure and diagnose faults (our legitimate interest in a working, un-abused service).
• To reply to you when you get in touch (our legitimate interest in answering you).

That is the complete list. We do not profile you, and we do not build an advertising picture of you.

5. Third-party services

A few providers help us run whales.fyi, and process data on our instructions only:

• Google and Discord — sign-in. They tell us who you are; we tell them nothing about your sheets.
• Render — application hosting and server logs.
• Neon — database hosting.
• Cloudflare — DNS and network delivery.
• Lemon Squeezy — payments. They are the merchant of record and handle your card details entirely; we only receive your subscription status.

We may also disclose information if we are legally required to, or where it is necessary to protect our rights or someone's safety. If the service is ever transferred to a new owner, your data may transfer with it, and we will say so here first.

6. Cookies and local storage

We use cookies only to sign you in. There are two: a short-lived one set during the sign-in handshake, which guards against request forgery and expires after five minutes, and your session cookie once you are signed in. Both are strictly necessary, so there is no consent banner to click through — there are no analytics or advertising cookies to consent to.

Your browser's local storage also holds a copy of each sheet you have opened while signed in, so the app paints instantly, switches between sheets without waiting on the network, and can queue changes you make while offline. Alongside it we keep one small yes/no note — whether this browser has been shown the get-started tour — so it does not open on every visit. Both live on your device only; they are never sent to us, and clearing your browser data removes them.

7. Data retention

• Account and content: for as long as your account exists.
• Sessions: until they expire or you sign out.
• Server logs: a short rolling window kept by our hosting provider.
• Billing records: kept by our payment provider for as long as tax and accounting law requires, independently of your account.

When you delete your account, your sheets, items, deals and sessions go with it.

8. Data security

Traffic is encrypted with HTTPS, the app sets a strict Content Security Policy, and session tokens are stored hashed. No method of transmission over the internet is completely secure and we cannot guarantee absolute security — so we keep the amount of data we hold deliberately small, which is the most effective protection there is.

9. Children's privacy

whales.fyi is not directed at children under 13, or under 16 in the EEA and UK. We do not knowingly collect their information. If you believe a child has given us data, contact us and we will remove it.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• request correction of anything inaccurate;
• request deletion of your data;
• object to or restrict how we process it;
• receive your data in a portable form.

Some of these you can exercise yourself, right now: delete sheets or your whole account from within the app, and, on a Premium plan, export any sheet from its tab menu to get your content as a JSON file. If you are not on Premium and want a copy of your data, email support@whales.fyi and we will send it to you free of charge — a paid plan is a convenience, never a condition of getting your own data. For anything else, email the same address and we will respond within 30 days. We will not charge you or treat you differently for asking.

If you are in the EEA or UK you may also complain to your local data protection authority. If you are in California, you have rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information — we do neither, so there is nothing to opt out of.

11. Where your data is held

Our servers and database are in the United States. If you use whales.fyi from elsewhere, your data is transferred there. Where required, our providers rely on the European Commission's Standard Contractual Clauses for those transfers.

12. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date, and for significant changes we will notify signed-in users in the app.

13. Contact

For privacy-related questions or requests, contact us at support@whales.fyi.