Privacy policy

The provider named at the top of this page is the controller of your personal data under the General Data Protection Regulation (GDPR).

• Account data: your email address, your name if you give one, and your password, which our authentication provider stores only in scrambled form. If you sign in with Google, we receive your name and email address from Google.
• Technical data: your IP address, browser and device details, and the pages you request. Our hosting provider records these in server logs to run and secure the service.
• Anonymous usage and performance statistics, collected without cookies and without identifying you personally.
• Usage counts, so we can see whether OddSense is useful: a few fixed events, such as a day you opened the site while signed in, whether REF’s chat could answer (never what you asked), or a pick added to the bet slip. When you’re signed in they are tied to your account; signed out, they are counted without anyone attached. Nothing is stored on your device for this.
• Your language choice, kept in a cookie.

The bets you track, your conversations with REF and your settings (odds format and theme) are saved on our servers, tied to your account; only you can read them. Your filters and your bet slip stay in your browser. If you send a report with “Report an issue”, we keep what you write, any files you attach, your account email, the page you were on and your browser details, so we can look into it; only our team can read reports.

• To create and run your account and give you the features you asked for (performance of a contract).
• To keep the service secure, prevent abuse and fix problems (our legitimate interests).
• To understand how the service is used and make it faster and better, using anonymous statistics (our legitimate interests).
• To see whether people come back and which features they use, from the usage counts above, seen only by our team (our legitimate interests). You can object at any time by writing to us.
• To meet legal obligations, where they apply.

We do not sell your data and we do not use it for advertising.

We use service providers who process data on our behalf, under contracts that protect it:

• Supabase: authentication and our database.
• Vercel: hosting, plus anonymous analytics and performance measurement.
• Sentry: error and performance tracking, with data kept in the EU. When something breaks, it receives the technical details (the page, your browser and device, and what the app was doing), without your IP address, cookies or account details. For some visits it also keeps a recording of how the page was used, with every text and image hidden. It also receives REF’s questions and answers, to check REF’s quality, speed and cost.
• AI providers, for REF: when you ask REF something, your question and the games and prices it is about go to the AI model that writes the answer (Groq, Google’s Gemini, or a model reached through the Vercel AI Gateway). REF’s web searches send only the names of the teams and the competition (to Tavily or the AI Gateway’s search provider).
• Google: only if you choose to sign in with Google.

Team crests and player photos are loaded from TheSportsDB. When your browser fetches them, TheSportsDB can see your IP address, as with any image loaded from another site.

We may also disclose data where the law or a public authority requires it.

Some providers may process data outside the European Economic Area. Where they do, they rely on safeguards the GDPR recognises, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

We keep account data while your account is open and delete it when you close the account (Account → Delete account), unless the law requires us to keep something for longer. Server logs are kept by our hosting provider for a limited period. Usage counts are deleted after 13 months, and with your account if you close it first.

You have the right to:

• access the personal data we hold about you;
• have it corrected or erased;
• restrict or object to how we use it;
• receive it in a portable format;
• withdraw consent at any time where we rely on it.

You can delete your account and its data yourself, in Account → Delete account. To use any other right, write to the email address at the top of this page. You can also complain to the data protection authority where you live, or to the Portuguese one, the Comissão Nacional de Proteção de Dados (CNPD), at https://www.cnpd.pt.

OddSense uses the cookies needed to run the service, and no advertising or tracking cookies. With your consent only, Sentry records some visits, with every text and image hidden, to help us fix errors. You can change that choice at any time under “Cookie settings”. The Cookies page lists what is stored.

We use reasonable technical and organisational measures to protect your data, but no online service can be completely secure.

OddSense is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think we have, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version.

For questions or requests about your data, use the email address at the top of this page.