Privacy Policy

Last Updated: April 13, 2026

1. Introduction and Scope

This Privacy Policy ("Policy") describes how Odds On ("Odds On," "we," "us," or "our") collects, uses, discloses, stores, and safeguards Personal Information (as defined below) when you access or use the Odds On mobile application, web application, and any related services (collectively, the "Service"). This Policy applies to all users of the Service worldwide and forms part of the contract between you and Odds On, together with our Terms & Conditions.

By creating an account, installing the Service, or otherwise using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, do not use the Service.

"Personal Information" means any information relating to an identified or identifiable natural person, as defined under the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), and any other applicable privacy laws.

2. Data Controller and Contact Information

The data controller responsible for Personal Information processed in connection with the Service is:

• Entity: Odds On
• Email (general & data rights): oddson.support@gmail.com
• Email (privacy-specific): oddson.support@gmail.com

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, you may contact us at the privacy email above to reach our designated privacy contact. We have not appointed a statutory Data Protection Officer under GDPR Article 37, as our processing does not meet the mandatory thresholds requiring one; however, we maintain a dedicated privacy contact for all data subject inquiries.

3. Information We Collect

We collect the following categories of Personal Information, grouped by source:

3.1 Information You Provide Directly

• Account Registration Data: display name, email address, password (stored only as a one-way cryptographic hash, never in plaintext), optional phone number, country code.
• Age Verification Data: year of birth (used solely to determine whether you meet our 17+ minimum age requirement; the year value is stored as a confirmation flag and timestamp, not as a calendar date of birth).
• Profile Data: avatar selection identifier, display preferences.
• User-Generated Content ("UGC"): messages sent in direct messages or group chats, custom prediction descriptions, challenge content, and content reports.
• Social Graph Data: friend requests sent and received, blocked users, group memberships.
• Preference Data: selected sports, leagues, and market categories; notification preferences; privacy toggles (e.g., "hide stats from friends").
• Support Communications: any correspondence you send to us (email content, attachments, metadata).

3.2 Information Generated Through Your Use of the Service

• Prediction Activity: virtual-credit wagers (amounts, selected outcomes, odds at lock-in, settlement status, win/loss results, timestamps).
• Competitive Event Data: league and group memberships, gameweek participation, leaderboard rankings, per-gameweek budget consumption.
• Aggregated Statistics: lifetime wins, losses, win rate, lifetime winnings (in virtual credits), global ranking points.
• Monthly Bonus Tracking: lastPhoneBonusDate flag to determine eligibility for the monthly phone-number bonus credit grant.

3.3 Information Collected Automatically

• Device and Technical Data: device model, operating system and version, application version, language, time zone, IP address (transiently, for request routing and abuse prevention), and general network information.
• Diagnostic Data: crash reports, error logs, and performance metrics necessary to maintain Service stability.

3.4 Information We Do Not Collect

• We do not collect or process payment card data, bank account data, or any financial account information. The Service does not support real-money transactions.
• We do not collect precise geolocation (GPS) data.
• We do not access your device contacts, calendar, photo library, camera, or microphone.
• We do not collect health or medical data.
• We do not collect biometric identifiers.
• We do not collect the Identifier for Advertisers (IDFA) or engage in cross-app or cross-website tracking as defined by Apple's App Tracking Transparency framework. We therefore do not display the App Tracking Transparency permission prompt.

4. How We Use Your Information

We use Personal Information for the following purposes, each tied to a specific legal basis under Section 5:

• Service Operation: account creation and authentication, session management, prediction placement and settlement, leaderboard calculation, message delivery, friend and group management.
• Personalisation: surfacing markets, predictions, and events aligned with your stated sports preferences.
• Communication: sending transactional notifications such as gameweek reminders, prediction settlement results, friend requests, and responses to support inquiries. We do not send marketing communications without your explicit prior opt-in.
• Safety, Integrity, and Moderation: profanity filtering on display names and UGC, processing content reports, enforcing blocks, detecting account fraud and automation, and enforcing the Terms & Conditions.
• Analytics and Service Improvement: analysing aggregated usage patterns, crash data, and performance metrics to improve feature stability and user experience.
• Legal Compliance: complying with applicable laws, regulations, court orders, and lawful requests from public authorities.
• Defending Legal Claims: establishing, exercising, or defending legal claims.

5. Legal Bases for Processing (GDPR & UK GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, we rely on the following legal bases under GDPR Article 6(1):

Where we rely on legitimate interests, you have the right to object under Article 21 GDPR. We will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defence of legal claims.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you within the meaning of GDPR Article 22.

6. Data Storage, Security, and Retention

6.1 Infrastructure and Sub-Processors

Personal Information is stored and processed using the following technical infrastructure:

Each sub-processor is engaged under a data processing agreement (where applicable) and is required to implement appropriate technical and organisational measures consistent with this Policy.

6.2 Security Measures

• Encryption in Transit: all client–server communication occurs over TLS 1.2 or higher.
• Encryption at Rest: Firestore data is encrypted at rest using AES-256; Firebase Authentication credentials are stored as one-way PBKDF2/scrypt-family hashes by Google.
• Access Control: production database access is restricted to authorised personnel with multi-factor authentication; application-level access is enforced through Firestore Security Rules that limit per-document access to the owning user and authorised collaborators (e.g., group members).
• Application Integrity: Firebase App Check validates that API requests originate from legitimate installations of the Service.
• Content Integrity: UGC passes through an automated profanity filter and reporting pipeline.
• Incident Response: we maintain a documented incident response procedure. In the event of a Personal Data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk, we will also notify affected data subjects in accordance with Article 34.

No system is perfectly secure. While we use industry-standard safeguards, we cannot guarantee the absolute security of Personal Information. You are responsible for safeguarding your account credentials.

6.3 Retention Periods

We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements:

7. Disclosure of Personal Information

We disclose Personal Information only in the limited circumstances described below. We do not sell Personal Information as that term is defined under the CCPA/CPRA or any applicable law. We do not share Personal Information for cross-context behavioural advertising.

• To Sub-Processors: as set out in Section 6.1, solely to provide the Service under binding contractual terms.
• To Other Users: your display name, avatar, public statistics (unless you enable "Hide Stats from Friends"), leaderboard position, and any UGC you publish within the Service.
• For Legal Reasons: where required to comply with applicable law, legal process, or lawful request from a public authority, or to enforce our Terms & Conditions, protect our rights, property, or safety, or the rights, property, or safety of others.
• In a Corporate Transaction: in connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our assets, subject to the acquirer's commitment to this Policy or a successor policy providing equivalent protection.
• With Your Consent: with any additional recipients you explicitly authorise.

8. International Data Transfers

Personal Information collected through the Service may be transferred to, stored in, and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that are different from those of your country.

Where Personal Information is transferred from the EEA, the United Kingdom, or Switzerland to a jurisdiction that has not received an adequacy decision from the European Commission or the UK government (as applicable), we rely on the following transfer mechanisms:

• Standard Contractual Clauses: the European Commission's Standard Contractual Clauses (Module 2 or 3, as appropriate) incorporated into our data processing agreements with sub-processors;
• UK International Data Transfer Addendum or the UK IDTA, as applicable, for UK-originated data;
• Equivalent safeguards for Swiss-originated data under the Swiss Federal Data Protection Act.

You may request a copy of the safeguards we use by contacting us at the address in Section 2.

9. Your Rights

9.1 Rights Under GDPR and UK GDPR

Subject to applicable conditions and exemptions, you have the following rights:

• Right of Access (Article 15): obtain confirmation of whether we process your Personal Information and, if so, a copy of that data and the information required by Article 15(1).
• Right to Rectification (Article 16): request correction of inaccurate Personal Information and completion of incomplete Personal Information.
• Right to Erasure (Article 17): request deletion of Personal Information in the circumstances listed in Article 17(1).
• Right to Restriction of Processing (Article 18): request that we restrict processing in the circumstances listed in Article 18(1).
• Right to Data Portability (Article 20): receive Personal Information that you have provided to us in a structured, commonly used, machine-readable format, and transmit that data to another controller.
• Right to Object (Article 21): object to processing based on legitimate interests or processing for direct marketing purposes.
• Rights Related to Automated Decision-Making (Article 22): we do not engage in automated decision-making producing legal or similarly significant effects; this right therefore does not arise, but you may confirm this at any time.
• Right to Withdraw Consent (Article 7(3)): where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint (Article 77): lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may complain to the Information Commissioner's Office at ico.org.uk.

9.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:

• Right to Know: the categories and specific pieces of Personal Information we have collected, the sources, purposes, and categories of recipients.
• Right to Delete: request deletion of Personal Information we have collected, subject to statutory exceptions.
• Right to Correct: request correction of inaccurate Personal Information.
• Right to Opt-Out of Sale or Sharing: we do not sell or share (for cross-context behavioural advertising) Personal Information, so no opt-out is required; you may nonetheless submit a request to confirm this.
• Right to Limit Use of Sensitive Personal Information: we do not collect sensitive personal information as defined by the CPRA; accordingly, there is nothing to limit.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of the above rights.

To exercise these rights, contact us at oddson.support@gmail.com. We will verify your identity by matching the email address of your request to the email address on your Odds On account, or by other reasonable means.

9.3 Rights Under Other Jurisdictions

Residents of other jurisdictions (including, without limitation, Colorado, Connecticut, Utah, Virginia, Texas, Québec, Brazil, Australia, Japan, and South Korea) may have similar rights under applicable law. We will honour valid requests consistent with those laws.

9.4 How to Exercise Your Rights

You may exercise most rights directly within the Service:

• Access & Portability: email oddson.support@gmail.com; we respond within the statutory time limit (generally 30 days under GDPR, 45 days under CCPA, each extendable once if necessary).
• Rectification: update your profile in Settings, or email us for fields you cannot edit.
• Erasure: Settings – Delete Account within the Service.
• Objection and Consent Withdrawal: email us; for marketing opt-outs, follow the unsubscribe link in any marketing communication.

We will not charge a fee for responding to a request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse the request, as permitted by applicable law.

10. Age Requirements and Children's Privacy

The Service is intended for users 17 years of age and older. You must confirm that you meet this age requirement before using the Service. We enforce this through an in-app age gate that records your confirmation.

The Service is not directed at children under the age of 13, and we do not knowingly collect Personal Information from children under 13 in contravention of the United States Children's Online Privacy Protection Act (COPPA) or equivalent laws (including GDPR Article 8). We also do not knowingly collect Personal Information from users between 13 and 17 years of age, as the Service is restricted to users 17 and older.

If we become aware that we have collected Personal Information from a user who does not meet the minimum age requirement, we will promptly delete the account and associated data. If you believe we may have collected such information, please contact us immediately at oddson.support@gmail.com.

11. Account Deletion

You may delete your account at any time via Settings – Delete Account. The deletion workflow requires a two-step confirmation. Upon confirmed deletion, we permanently remove the following within a commercially reasonable period (target: 30 days):

• User profile document (display name, email, phone number, avatar identifier, preferences, age confirmation flag);
• All prediction records, parlays, and event bet records;
• Global-league memberships and per-gameweek leaderboard entries;
• Competitive-event participation records;
• Friend connections and pending or resolved friend requests;
• Group memberships (you are removed from all groups);
• Content reports you have filed (reporter identifier removed; summary retained for safety enforcement where required);
• Cached user profile data;
• Firebase Authentication credential record.

Messages you sent in direct or group conversations may persist in those conversations to preserve context for other participants, but the sender identifier is dissociated from your deleted account. Certain backup copies may persist for a limited period until their standard rotation cycle completes, after which they are permanently destroyed.

12. Cookies, SDKs, and Similar Technologies

The mobile application does not use browser cookies. It uses the following on-device storage mechanisms:

• AsyncStorage (React Native): stores non-sensitive local preferences, cached user profile snapshots, and ephemeral notification metadata. You may clear this data by uninstalling the app.
• Firebase Authentication persistence: stores your signed-in session token locally to keep you logged in across app launches.
• Expo Updates cache: stores OTA update bundles.

The web version of the Service may use strictly necessary cookies and localStorage for session management. Where required by applicable law, we will display a cookie banner on first use of the web application.

13. Marketing Communications

We do not send marketing communications by default. If we introduce an opt-in marketing programme in the future, participation will be voluntary, you will be required to affirmatively opt in, and you may unsubscribe at any time using the link provided in every marketing message.

14. Do Not Track

The Service does not respond to "Do Not Track" browser signals because there is no industry-standard interpretation of such signals. We do not engage in cross-context behavioural tracking, so this does not affect your privacy position.

15. Third-Party Links and Content

The Service may contain links to third-party websites, services, or content not operated or controlled by us. This Policy does not apply to third parties. We encourage you to read the privacy policies of any third-party services you visit.

16. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will (i) update the "Last Updated" date at the top of this Policy, (ii) post the revised Policy within the Service, and (iii) where required by applicable law, provide additional notice (such as an in-app notice or email). Your continued use of the Service following the date of the revised Policy constitutes acceptance of it. Where changes materially affect the legal basis of processing, we will, where required, obtain renewed consent.

17. Governing Law

This Policy is governed by the laws of the State of Delaware, United States, without regard to its conflict-of-laws principles, except where overridden by mandatory provisions of applicable local law (including GDPR, UK GDPR, and CCPA/CPRA, each of which applies to its respective subjects regardless of this choice).

18. Severability and Entire Agreement

If any provision of this Policy is held to be invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect. This Policy, together with the Terms & Conditions, constitutes the entire agreement between you and Odds On regarding the subject matter addressed herein.

19. Contact