Privacy Policy

We collect account and profile details such as email, display name, password hash, Google account subject identifier where used, email-verification status, age and policy acceptance records, preferences and privacy choices.

When you use the product we collect saved-slip and committed-bet records, bankroll ledger and usage information, support requests, email preferences, timestamps, IP address, device/browser details, security events and audit records. We do not ask for bookmaker credentials or directly access bookmaker balances.

We collect information directly from you when you register, change settings, record activity or contact support, and automatically from the service and security infrastructure when you use the site.

We use this information to create and secure accounts, verify identity, provide current picks to eligible members, enforce limits, maintain user state, settle logged picks, operate optional leaderboards, answer support requests, detect abuse, meet legal obligations and improve service reliability.

Marketing consent is separate and optional. Promotional sending is disabled during the current beta.

We use Supabase for hosted authentication and application data, Google for optional sign-in, Cloudflare for delivery and security, and Resend for transactional email and support forwarding. The current Supabase project stores application data in India. Google, Cloudflare and Resend may process information in the United States and other countries in which they operate.

We disclose only information reasonably needed for each service and do not sell personal information.

Account data is retained while the account is active. A deletion request revokes access immediately and is scheduled for completion within 30 days, subject to information that must be retained for security, dispute resolution or legal obligations. Security and audit records are generally retained for up to 12 months, support records for up to 24 months, and rotating backups for up to 30 days.

Settled product records may be kept in de-identified or aggregated form so the public performance record remains accurate.

You can update profile and preference information in your account, request a JSON export, or request deletion. You may also email us to request access or correction. We will verify the request before releasing or changing account information.

If you have a privacy concern, contact [email protected]. We will acknowledge and investigate it and aim to respond within 30 days. If you are not satisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner.

We use hashed passwords and tokens, encrypted transport, short-lived revocable sessions, access controls, audit logging, rate limits, secret separation and restricted administrative credentials. No online service can guarantee absolute security; suspected incidents are handled under our breach-response process.

We use essential secure session and OAuth-state cookies. Account preferences and saved slips are stored against your server-side account; limited presentation choices such as the selected sport filter or collapsed navigation may be kept in local or session storage on your device.

We do not currently use advertising cookies or non-essential analytics, so no cookie-consent banner is shown.

We will publish material changes here and require renewed acceptance where appropriate.

• 2026-07-17: initial factual free-beta policy.