Privacy policy.

Short version: optional usage measurement starts only after you allow it.

1. What I collect

• Account data — if you sign up, I store your optional name, email, and hashed password. Google sign-in supplies your name, email, and profile picture.
• Tracker data — saved bets and bet legs, offer progress, bookmaker balances, deposits, withdrawals, and free-bet credits. I store these records against your account so that you can use them on another device.
• Conversations — if you message me from the site: your email address, your name if you give one, everything either of us writes, and the page you were on when you started. You don’t need an account to message me, so for most people this is the only thing I hold.
• Optional usage data — only after you allow it, Vercel Analytics and Speed Insights measure page use and performance. A first-party event records one of five completed actions, a broad page category, and a broad source category. I do not collect stakes, odds, profit, email addresses, full referrers, or URL query data. A random pseudonymous browser identifier expires after 30 days.
• Email update data — your email address, consent status, consent dates, and hashed confirmation and unsubscribe tokens. Resend also stores the contact and its subscription status.

2. Cookies

One essential session cookie (a signed JWT) keeps you logged in. Optional usage measurement stores your choice and random identifier in browser local storage. It does not use an advertising cookie. The footer control lets you change your choice. Global Privacy Control or Do Not Track keeps measurement off.

3. Where the data lives

In a PostgreSQL database hosted by Supabase (EU-West-2). The site itself runs on Vercel. Both are GDPR-compliant.

4. Conversations

When you message me from anywhere on the site, I store your email address, your name if you gave one, the page you started from, and every message either of us sends. The email address is how I reply. The page is so I can see which guide you were reading without making you describe it.

I delete a conversation twelve months after its last message, and the messages go with it. The clock runs from the last message rather than from when you opened it, so an exchange that carries on for a year doesn’t get cut off halfway through. The deletion is automatic and runs monthly — it isn’t something I have to remember to do.

Conversations are kept apart from BetBoffins accounts on purpose: you don’t need to sign up to message me, and deleting your login shouldn’t delete a conversation you’re waiting on a reply to. The trade-off is the honest one — deleting your BetBoffins account does not delete your conversations. They stay, with your email address on them, until the twelve months run out or until you ask me to remove them sooner.

5. Usage retention

First-party usage events expire after 90 days. If you withdraw consent, the site clears the usage identifier and source from your browser. Existing pseudonymous events remain until their 90-day expiry because they cannot be linked back to your browser.

Usage measurement now starts only after consent. These counts do not compare directly with earlier Vercel pageview counts.

6. Email updates

Requesting an update does not subscribe you. I send a confirmation link that expires after 48 hours. The link opens a page first. You must then press the confirmation button.

I delete unconfirmed requests seven days after their confirmation token expires. I keep a confirmed or unsubscribed record until you request deletion. This record prevents an old confirmation link from restoring a subscription. The database stores token hashes, not the links that you receive.

7. Third parties

If you sign in with Google, Google OAuth handles authentication. I receive your name, email, and profile picture. Resend delivers password resets, conversation links, and email update confirmations. Resend also stores confirmed newsletter contacts and unsubscribe status.

8. Affiliate links

I don't use them. Payment for a signup can influence which offer a publisher recommends. All links here point to the bookmaker directly, with no affiliate tracking parameters.

9. Your rights

Under UK GDPR you can ask me what personal data I hold about you, correct anything wrong, or request deletion. There isn’t much to hold, so it’s usually quick. Your conversations and email update record are covered by the same request. I won't make you wait for a retention period. Get in touch and I’ll sort it.