Privacy policy.

Short version: this site collects almost nothing, stores less, and shares none of it.

1. What I collect

• Account data — only if you sign up: name (optional), email, and a hashed password. Sign in with Google and I get your name, email, and profile picture from Google.
• Tracker data — logged bets, offer progress, account balances you’ve chosen to record. Stored against your account so you can see it on another device.
• Conversations — if you message me from the site: your email address, your name if you give one, everything either of us writes, and the page you were on when you started. You don’t need an account to message me, so for most people this is the only thing I hold.
• Anonymous usage — Vercel Analytics + Speed Insights for aggregate page view and performance data. No identifying data.

2. Cookies

One essential session cookie (a signed JWT) to keep you logged in. That’s it — no advertising, retargeting, or tracking cookies.

3. Where the data lives

In a PostgreSQL database hosted by Supabase (EU-West-2). The site itself runs on Vercel. Both are GDPR-compliant.

4. Conversations

When you message me from anywhere on the site, I store your email address, your name if you gave one, the page you started from, and every message either of us sends. The email address is how I reply. The page is so I can see which guide you were reading without making you describe it.

I delete a conversation twelve months after its last message, and the messages go with it. The clock runs from the last message rather than from when you opened it, so an exchange that carries on for a year doesn’t get cut off halfway through. The deletion is automatic and runs weekly — it isn’t something I have to remember to do.

Conversations are kept apart from BetBoffins accounts on purpose: you don’t need to sign up to message me, and deleting your login shouldn’t delete a conversation you’re waiting on a reply to. The trade-off is the honest one — deleting your BetBoffins account does not delete your conversations. They stay, with your email address on them, until the twelve months run out or until you ask me to remove them sooner.

5. Third parties

If you sign in with Google, authentication is handled by Google’s OAuth — I only receive your name, email, and profile picture. Transactional emails (password resets etc.) go through Resend.

6. Affiliate links

I don’t use them and never will. Bookmaker affiliate programs pay per signup, which creates an incentive to recommend bad offers. All links here point to the bookmaker directly, with no tracking parameters.

7. Your rights

Under UK GDPR you can ask me what personal data I hold about you, correct anything wrong, or request deletion. There isn’t much to hold, so it’s usually quick. Your conversations are covered by the same request — I won’t make you wait out the twelve months. Get in touch and I’ll sort it.