Privacy at Kelly

• Your IP address. Kelly uses it to apply its free limits. The counters that hold it expire when each window ends, within the day. An IPv6 address is counted by its network, not the full address.
• A bot check. When you sign up or ask for a sign-in code, Cloudflare Turnstile checks that you're a person. Cloudflare sees your IP address, browser details and the page you're on, and tells Kelly only whether the check passed.
• Server logs. Each request is logged with an ID, the page or call, the result, how long it took and the address it came from. Logs are used to fix faults and stop abuse, and are kept for up to 30 days.
• Calls from AI apps. When an AI app such as Claude calls Kelly MCP for you without an account, the call often comes from the app's own servers. Kelly then counts the calls against the app, not against an address.
• Your questions. Kelly keeps every question it answers, in your words, with its answer and the earlier questions of the chat it came in. Kelly reads them to check and improve its answers, and they're never shown to anyone else.

• Your email address. Your sign-in provider gives it to Kelly when you sign in with an email code, a passkey, Google or Apple. Kelly uses it to identify your account and send you account notices.
• Your confirmation that you're 21 or older, with when you gave it and the wording you agreed to.
• Your sign-ins. For each signed-in browser, when it started, when it was last used and the browser's own description of itself, so your account page can list your sessions and you can end any you don't recognise.
• If you join the waitlist before Kelly opens to everyone, your email address, so Kelly can tell you when you can sign in.

Kelly doesn't keep your name, photo or password. WorkOS runs sign-in for Kelly and holds what sign-in needs.

Each of these is yours alone, shown only to you, and kept until you delete it or your account.

• Chats. Your questions and Kelly's answers, with the steps Kelly took, their titles and the projects you put them in. If you share a chat, anyone with the link can read it up to the point you shared; shared pages aren't indexed by search engines.
• Bets, bankroll and taxes. Bets you log or import, your bankroll and its deposits and withdrawals, W-2G forms you record and your tax profile (filing status, rates and state).
• Books and promos. The sportsbooks you use, your notes on them and the promos you hold.
• Leagues. Fantasy leagues you connect: the league, its teams, rosters, standings and scoring as the platform shows them.
• Alerts and their channels. Alerts you set, each time one goes off, and where you want them sent: email, push notifications in your browser or phone, Telegram, Discord, Slack or a web address of your own.
• Memories, if you turn memory on. Short notes you ask Kelly to remember, used in your later answers on askkelly.ai. Memory is off until you turn it on.
• Background tasks. Questions you ask Kelly to answer later, on a schedule or when an alert goes off, and each answer they write.
• Preferences. Your odds format, sports, state, answer settings and the AI model you choose.

Notes, labels and other words you type are never written to Kelly's logs.

• Kelly shows a new key once, then keeps only a one-way fingerprint of it, its last four characters, its name, what it may do, and when it was created, last used, rotated or revoked. A key sent in a web address is refused and marked for you to replace.
• When you connect an AI app or agent, Kelly records what you allowed, when, and which app took it up. Your account page lists them, and you can remove any of them.

• Stripe takes your payment. Kelly never sees your card number. Kelly keeps your plan, its status and billing period, and Stripe's reference for you.
• Kelly counts the credits your account uses, to show you your usage and to bill usage beyond your plan's allowance.

• If you tell Kelly you're under 21, ask for help with gambling, or say something that shows you might need it, Kelly stops showing betting content. To do that, it records a flag: its kind (age or gambling harm) and a level. It never records your words.
• A gambling-harm flag lasts only for that session, unless you choose to keep it. Flags are used only to protect you: never for analytics, experiments or marketing.

• Working out numbers. Kelly can work out figures with a short program, such as your ROI by sport from a file you attached. The program and the data it needs run in a sandbox at Vercel with no internet access, made for that one run and deleted after it. Kelly keeps only the result, as part of the answer.
• Reading public pages. To read a page that draws its text with scripts, Kelly opens its public address in a browser in a sandbox at Vercel. Only the address goes in and only the page comes out. The browser signs in to nothing and is deleted after the page.

• You can sign in to one of your own sportsbooks, or to ESPN or Sleeper, in a browser in a sandbox at Vercel. You type your password on the site's own page. Kelly never sees or keeps your password.
• Kelly keeps that browser's sign-in (its cookies and similar data for that one site) encrypted, until you remove it on your account page. With it, Kelly reads your pages when you ask, such as your open bets, and makes the league moves you confirm or your autopilot settings allow. Kelly never places, changes or cashes out a bet.

• Bet sync brings in your bets and balances from a sportsbook account without you logging each one. You link the account on SharpSports' own page, and SharpSports holds that sign-in; Kelly never sees it.
• Kelly gives SharpSports a random handle for you, never your name, email or account ID, and keeps the linked accounts, their status and balances, and the bets they bring in, as part of your bet log. Removing a linked account also removes SharpSports' access to it.

The extension lets Kelly work in your own browser, signed in as you, when you ask. It works only on the sites you allow in it, and only does what its switches allow.

• Reading a page. When you ask, Kelly reads a page on a site you allowed, such as your open bets. The page's text passes through Kelly's servers for that answer, is held for at most a minute and isn't logged. Kelly keeps the lines it used, as the answer's sources.
• Bet slips. When you ask Kelly to place a bet, the extension opens your book's page, adds the bet, types your stake and checks the price. It stops there: you press Place yourself. While the slip waits for you (up to 12 minutes) Kelly keeps the bet and a one-time code; when the book shows the bet as placed, Kelly logs it in your bet log once. If you don't place it, nothing is logged.
• Sign-up forms. When you ask Kelly to sign you up at a sportsbook, the extension types the details you saved in it (name, email, phone, date of birth, home address) and the promo code into the book's form. You type your password and Social Security digits and press Create account yourself. Your saved details stay in your browser, in the extension's own storage, and never reach Kelly's servers. While the form waits (up to 32 minutes) Kelly keeps which book it is and a one-time code; when the book shows your new account, Kelly adds it to your books.
• League moves. After you confirm a move in Kelly, the extension makes it on ESPN or Sleeper from your browser, or shows it on the platform's page for you to save.
• Kelly beside the page. The side panel shows askkelly.ai beside the page you're on. It is the same site, with the same sign-in; when you ask about the page from the extension, only your question is passed to it.
• Your league beside league pages. Off until you turn it on, one fantasy platform at a time (in the side panel when you first visit, or in the extension's settings). While it's on and the side panel is open, the extension looks at the address of the tab you're on. The address is checked in your browser and goes nowhere unless it's a league page on a platform you turned on. Then the panel shows that league in Kelly, and the address is passed to askkelly.ai after the # sign, which browsers don't send to servers, so Kelly's servers don't see the pages you visit. When the side panel is closed, a small "Open Kelly beside this" button appears on that platform's league pages; for it, Chrome asks you to allow the platform's pages, and the button too looks only at the page's address.
• Focus mode. In the version of the extension Kelly gives its testers (not the Chrome Web Store one), off until you turn it on, one fantasy platform at a time in the extension's settings, and Chrome asks you to allow that platform's pages. On those pages the extension looks for the platform's betting, prediction-market and promo sections and hides them, with a note on the page that counts them and shows them again. It does this in your browser and sends nothing about those pages to Kelly or anyone else.
• Capture my leagues. Off until you agree, one fantasy platform at a time (ESPN, Yahoo, CBS or Fantrax), in the extension's settings, and Chrome asks you to allow that platform's pages. While it's on and a league page of a league you connected in Kelly is open in one of your tabs, the extension reads that league from the platform in your browser, signed in as you: its settings, every team's roster, matchups, transactions and the trade offers the platform shows you, including offers it doesn't make public. Only the platform's league data reaches Kelly. Your cookies, passwords and the page itself stay in your browser. Kelly keeps it with your league for your answers and uses it, with no team or manager named, to improve its own league models. Kelly records when you agreed and when you turned it off. Turning it off stops it at once; removing the league deletes your copy.
• What the extension keeps in your browser: its connection code, the sites you allowed, its switches (including which platforms you turned on for league pages, Focus mode and league capture), your saved sign-up details, a list of what it did recently and what is waiting on you. None of it leaves your browser except the connection code, which identifies it to Kelly.
• What Kelly keeps: a name for each connected browser, when it was connected and when it last checked in. The connection code is kept only as a one-way fingerprint. You can disconnect it in the extension or on your account page at any time.