Get startedLog in

Legal

Privacy policy

What Oddbert stores about you, why, and how to have it deleted.

[DRAFT — to be finalised by the operator] This page is a structured draft. Text in square brackets is a placeholder; nothing here is a final legal statement until the operator has reviewed and published it.

Last updated: [DATE] · Contact: [OPERATOR CONTACT EMAIL]

  1. 1

    Who we are

    [OPERATOR LEGAL NAME], [CVR NUMBER], [REGISTERED ADDRESS] is the data controller for Oddbert. Questions about this policy go to [OPERATOR CONTACT EMAIL].

  2. 2

    What we store

    With an account: your email address, a hash of your password (never the password itself), your language, your 18+ confirmation, whether your email is verified, the leagues you follow, and your subscription status. If you turn on two-step verification we store the authenticator secret and hashed recovery codes. Sign-ins and security changes are recorded as events that keep your IP address and browser only as keyed hashes. Without an account we store nothing about you on our servers.

  3. 3

    In your browser

    A few preferences live only in your browser's local storage: the 18+ confirmation, followed leagues, a stake-sizing bankroll you may enter, and a random anonymous id used for first-party page-flow counts. None of these are sent to a server as personal data, and we honour Do Not Track / Global Privacy Control by not counting you at all. Signed-in sessions use HttpOnly cookies; we set no third-party or advertising cookies.

  4. 4

    Why we process it

    [LAWFUL BASIS PER PURPOSE — to be set by the operator: e.g. performance of the contract for the account and subscription, legitimate interest for security records, consent for signal emails.]

  5. 5

    Payments

    Subscriptions are billed by Stripe. Card details are entered on Stripe's pages and never reach our servers; we keep only the Stripe customer and subscription identifiers and the subscription status.

  6. 6

    Hosting and processors

    The service runs on Railway [EU REGION TO BE CONFIRMED]. Processors: Stripe (payments), [EMAIL PROVIDER] (account and signal emails), [ANY OTHER PROCESSOR]. Weather data comes from OpenWeather and contains no personal data.

  7. 7

    How long we keep it

    [RETENTION PERIODS — to be set by the operator: account data for the life of the account; security event records for [N] months; Stripe records for as long as bookkeeping law requires.]

  8. 8

    Your rights

    You can ask for a copy of your data, have it corrected, or have it erased. Erasure is built in: deleting your account removes the account together with your subscription record, followed leagues, bankroll, verification and reset tokens, two-step secrets and recovery codes, and your signal-email records — the only trace kept is that an account was deleted, with no identity attached. Until a button exists in the dashboard, request deletion at [OPERATOR CONTACT EMAIL] and we run it for you. You can also complain to Datatilsynet, the Danish Data Protection Agency.

  9. 9

    Changes

    We post changes here with a new date. [NOTIFICATION POLICY — to be set by the operator.]