Your privacy.

Who is responsible

The data controller is LegLock, run by Nicklas, Kløvervej 44, 6000 Kolding, Denmark. Email nicklas@leglock.app.

What we collect, and why

• Signing in. You sign in with Whop. Whop tells us your Whop user ID, and we ask Whop whether your VIP membership is active. Your browser keeps only that user ID and a member yes/no, in a signed cookie. We don't store your name or email from sign-in. Why: to give you the membership you signed up for (contract).
• Payments. Whop handles checkout, payments, tax and receipts as its own data controller, under its own privacy policy. As the seller, we can see in Whop your username, email, plan and payment status. Why: to run your membership and keep the records the law requires (contract and legal duty).
• Emails you send us. Mail to our leglock.app addresses is forwarded to our Gmail inbox. Why: to answer you (legitimate interest, or contract when it is about your membership).
• The withdrawal form. Your name, the email you use on Whop, any order details you give, the time and a reference number are emailed to us when you confirm. Why: to carry out your withdrawal and prove that we did (legal duty).
• Server logs. Cloudflare, which hosts the site, processes your IP address and basic request details to deliver and protect it. To stop abuse we count requests per IP address in memory for about a minute. Why: security (legitimate interest).
• Visitor counts. We use Cloudflare Web Analytics, which is cookieless: it counts page views without cookies and without identifying you.

Cookies and browser storage

We only use what the site needs to work, so there is no cookie banner.

• ll_s: your signed sign-in session (Whop user ID and member yes/no). HttpOnly, lasts up to 24 hours.
• ll_m: tells the page whether to show the member view. Lasts up to 24 hours.
• ll_a: a short check that protects the sign-in step. Lasts 10 minutes, during sign-in only.
• ll-fmt, ll-stake and ll-seen (local storage): your odds format, the stake you typed into the returns calculator, and which slips you have already seen. They stay in your browser and are never sent to us.

Who helps us

• Cloudflare: hosting, security, email forwarding and visitor counts.
• Google: our Gmail inbox.
• Whop: sign-in, payments and membership (as its own controller).

These are US companies. Transfers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

What we never do

We never sell your data. No ads, no tracking across other sites, and no marketing emails.

How long we keep it

• Sign-in cookies: up to 24 hours.
• Emails and withdrawal records: as long as needed to help you, and up to 5 years where bookkeeping or legal claims require it.
• Server logs: Cloudflare's short standard retention.

Your rights

You can ask to see, correct or delete your data, to limit or object to how we use it, and to get a copy of it. Email nicklas@leglock.app. You can also complain to the Danish data protection authority, Datatilsynet.

LegLock is for adults only. We don't knowingly collect data from anyone under 18.