1. Introduction

SweepState ("we," "our," or "us") operates sweepstate.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site.

We are committed to protecting your privacy and handling your data in an open and transparent manner. This policy names the specific services we use to run the Site and tells you exactly what each one collects.

2. Information We Collect

2.1 Information You Provide

• Contact Information: Name and email address when you subscribe to our newsletter or contact us
• User Reviews: Information you submit when writing casino reviews, including your experience and ratings
• Communications: Records of correspondence when you contact our support team

2.2 Automatically Collected Information

• Device Information: Browser type, operating system, device type, and screen resolution
• Usage Data: Pages visited, time spent on pages, click patterns, and navigation paths
• IP Address: We collect your IP address when you use the Site. We use it to derive your approximate location at the state level so we can show relevant casino availability, and to detect fraud and apply rate limits. For affiliate click tracking we store a salted one-way hash of your IP address, not the raw address. When you submit the newsletter or contact form, we store the submitting IP address with that record.
• Referral Data: How you arrived at our Site (search engine, direct link, etc.)

2.3 Cookies and Tracking Technologies

We use cookies, browser local storage, session storage, and similar technologies to remember your choices, measure how the Site is used, show availability relevant to your state, and attribute affiliate referrals. Section 3 names the services behind this, and section 4 lists the specific keys we set. You can manage these through our cookie settings and your browser controls.

3. Analytics and Tracking Services We Use

We use the third-party services below to measure traffic, find usability problems, monitor errors, and attribute affiliate referrals. The analytics and recording services load only after you grant analytics consent, and a Global Privacy Control signal opts you out of them (see section 8). Each provider processes data under its own privacy policy.

• Google Analytics 4 (Google): Measures page views, sessions, and on-site events. We run it in Google Consent Mode and route events through our own server endpoint at /api/analytics/collect rather than sending them straight to Google from your browser.
• Microsoft Clarity (Microsoft): Session recording and heatmaps. Clarity records a play-back of how you move, scroll, and click on a page so we can find usability problems. This session recording loads only with analytics consent and is off when you opt out.
• Sentry: Application error and performance monitoring. Sentry captures error reports and technical diagnostics when something on the Site breaks. Session replay is turned off.
• Vercel Analytics and Vercel Speed Insights (Vercel): Privacy-friendly traffic measurement and page-speed field data from our hosting provider.
• Upstash Redis (Upstash): Stores affiliate click records for commission attribution and fraud detection. These records hold a salted one-way hash of your IP address, not the raw address, and expire automatically after 90 days.
• Supabase: Our database. It stores the information you submit, such as newsletter sign-ups, contact messages, and user reviews, along with the affiliate click metadata above.

4. Cookies and Local Storage We Set

The keys below are the cookies, local-storage, and session-storage values the Site sets in your browser. Browser storage keys are readable only by sweepstate.com.

• cookie-consent-preferences (local storage): Stores your cookie choices and the version of the consent notice you saw.
• fp_consent (cookie): Records whether you allowed device-characteristic hashing for fraud prevention and rate limiting.
• ss-visitor-state (cookie): Your US state code, derived from your IP address, used to show availability relevant to your state.
• ga4_client_id (local storage): A Google Analytics client identifier used when the Google Analytics cookie is not available.
• ga4_session_id (session storage): A Google Analytics session identifier for the current browser session.
• analytics_user_id (local storage): An optional analytics identifier, set only if one has been assigned.
• affiliate_clicks (local storage): A short in-browser history of your recent affiliate clicks, kept for in-session reporting.
• affiliate_session (session storage): An affiliate session identifier for the current browser session.

5. How We Use Your Information

We use collected information to:

• Provide and maintain our services
• Show casinos available in your state
• Send newsletters and updates (with your consent)
• Respond to your inquiries and support requests
• Measure traffic and improve the Site
• Detect and prevent fraud or abuse and apply rate limits
• Comply with legal obligations

6. Information Sharing

We do not sell your personal information. We may share information with:

• Service Providers: Companies that operate parts of the Site on our behalf, including hosting and analytics (Vercel), product analytics (Google and Microsoft), error monitoring (Sentry), and our database and click-storage providers (Supabase and Upstash)
• Affiliate Partners: When you click on casino links, basic referral data is shared with the casino
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with any merger, sale, or acquisition

7. Your Rights and Choices

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Opt-out: Unsubscribe from marketing communications at any time
• Cookie Control: Manage analytics and marketing cookies through our cookie settings and your browser
• Global Privacy Control: Send a GPC signal, which we honor as an opt-out of marketing and analytics (see section 8)

California Residents (CCPA)

California residents have additional rights under the CCPA, including the right to know what personal information is collected, the right to delete, and the right to opt-out of the sale or sharing of personal information. We do not sell personal information, and we treat a Global Privacy Control signal as a valid opt-out of sharing for marketing and analytics.

8. Global Privacy Control and Do Not Track

We honor Global Privacy Control (GPC). If your browser or a browser extension sends a GPC signal (through navigator.globalPrivacyControl or the Sec-GPC request header), we treat it as an opt-out of the marketing and analytics categories. With GPC active, Google Analytics 4, Microsoft Clarity, and Vercel Analytics do not load, and our analytics server endpoint discards events that arrive with a GPC signal.

There is no single industry standard for how websites must respond to a browser Do Not Track (DNT) setting, so we do not rely on DNT alone. We treat a Global Privacy Control signal as a valid opt-out as described above.

9. Data Security

We use industry-standard security measures including:

• SSL/TLS encryption for data in transit
• Secure hosting infrastructure
• Regular security audits and updates
• Limited access to personal data on a need-to-know basis

While we work to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Specific retention periods include:

• Google Analytics data is retained for up to 26 months
• Affiliate click records in Upstash Redis expire automatically after 90 days
• Newsletter and contact records, including the IP address stored with them, are kept for as long as needed for the purpose collected or as required by law
• Cookie and storage values persist for the lifetimes set by your browser and our settings (for example, the consent cookie lasts up to one year)

11. Third-Party Links

Our Site contains links to third-party websites, including sweepstakes casinos. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing any personal information.

12. Children's Privacy

Our Site is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Site after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• Email: privacy@sweepstate.com
• Website: Contact Form