Privacy Policy

1. Who we are

SportsBiff ("we", "us") runs the SportsBiff website and app and is responsible, as the controller, for the personal data described here. You can reach us about anything in this policy at awahid@sportsbiff.com.

2. What we collect

• Your account. Your name, email address, password (stored only as a one-way hash), date of birth (to confirm you are 18 or over), and your country, region and city. Also the sports, teams, players and tipsters you follow, and your notification settings.
• Payments, on our website only. Your SportsBiff Pro plan and tipster subscriptions, their status and dates, and the customer identifier our payment processor, Stripe, gives us. Your card details go straight to Stripe; we never see or store your full card number.
• How you use SportsBiff. The pages you view and the features you use (for example following a team), with the date and time, linked to your account when you are signed in. We also record when you sign in and the IP address of your current and previous sign-in.
• Ask SportsBiff (our AI assistant, on the website, for Pro members): the questions you ask and the answers you receive.
• Messages you send us. Through the contact form: your name, email address, subject and message, with your IP address, browser details and the page you wrote from. Through the tipster application form: your name, email address, phone number and Telegram link.
• Phone notifications, in the app. If you allow notifications, the token your phone gives us to deliver them, your phone's model name and the app version.
• Security checks. Sign-up, the contact form and repeated failed sign-ins use Cloudflare Turnstile, which checks your browser and IP address to tell people from bots.
• Tipsters. We build each tipster's record from the posts in their public Telegram channel, with the time each was posted. For tipsters with a SportsBiff account, payout details are held by Stripe.

3. Why we use it, and our legal basis

• To provide SportsBiff to you: your account, the teams, players and tipsters you follow, tip records, and subscriptions you buy. The legal basis is our contract with you.
• To take payments and keep tax records. Contract, and the legal obligations we have to keep financial records.
• To send phone notifications. Only when you allow them on your phone, and only for the kinds you leave switched on in Profile, under Notifications. You can withdraw this at any time in your phone's settings.
• To confirm you are 18 or over, and to keep SportsBiff secure: preventing fraud, spam and abuse of accounts. Our legitimate interests in running a safe service for adults.
• To understand how SportsBiff is used and improve it, from our own records only. Our legitimate interests.
• To answer your messages and applications. Our legitimate interests, or steps you asked us to take.

We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you that have legal or similarly significant effects by automated means.

4. Who we share it with

We use these providers, who process personal data on our behalf and only for the purposes above:

• Railway: hosts our servers and database, in the United States.
• Stripe: takes payments on our website, and holds payout details for tipsters who set them up.
• Resend, which runs on Amazon Web Services: sends our emails, such as sign-up codes and password resets.
• Anthropic: generates Ask SportsBiff answers from the questions you ask, and reads tipsters' public posts to turn them into tips.
• Cloudflare: runs the Turnstile security checks.
• Google: Firebase Cloud Messaging delivers phone notifications, using your notification token. Some public pages load Google Fonts, which shares your IP address with Google.
• Microsoft: our email inbox (Microsoft 365) holds the messages you send us.
• Telegram: we read tipsters' public channels through Telegram. We send Telegram no information about our members.

We may also share information when the law requires it, or to protect the rights and safety of our members and others.

5. International transfers

Our servers are in the United States, and several of our providers are based there. When personal data leaves the UK or the European Economic Area, we rely on our providers' data protection terms, which include safeguards recognised by UK and EU law, such as standard contractual clauses.

6. How long we keep it

• Your account and what you follow: until you delete your account. How to delete your account gives the steps.
• Payment records: kept by Stripe for as long as tax law requires (six years in the UK).
• Messages you send us: 24 months, then deleted.
• Tipster applications: 24 months, then deleted.
• Usage records: deleted after 180 days, and separated from your account straight away if you delete it.
• Ask SportsBiff conversations: until you delete your account.
• Phone notification registrations: until you sign out on that phone, delete your account, or the phone stops accepting notifications.
• Server logs, which can include your IP address: kept by our hosting provider for a limited period for security, then deleted.

7. Your rights

You can ask for a copy of your personal data, and ask us to correct it, delete it, restrict how we use it, or send it to you or another service in a portable form. You can object to uses based on our legitimate interests, and withdraw consent you have given. You can delete your account yourself in Account settings. For anything else, email awahid@sportsbiff.com; we reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office in the UK, or the Data Protection Commission in Ireland. We would appreciate the chance to put things right first.

If you live in the United States, you have the same choices: ask what we hold about you, have it corrected or deleted, and opt out of any sale or sharing of your personal data (we don't sell it, and we don't share it for advertising). Residents of California and other states with privacy laws can exercise these rights by emailing awahid@sportsbiff.com; we won't treat you differently for doing so.

8. Cookies and storage on your device

We use no advertising cookies and load no third-party analytics: no Google Analytics, no advertising pixels, no session recording. The cookies we set are strictly necessary:

• Session cookie: keeps you signed in as you move between pages and protects forms against cross-site request forgery. Cleared when you sign out.
• Remember-me cookie: keeps you signed in on your next visit. On the website it is set only if you tick "Remember me"; the app always remembers you, because your phone can close it at any time.
• Cookie preference: records your choice in the cookie banner. Expires after six months.
• Phone notifications (app only): remembers this phone's notification token so that signing out stops its notifications.

The usage records described in section 2 are kept in our own database, are never sent to anyone else and use no extra cookie. We also keep a few interface preferences in your browser's local storage, such as the home-page panel you last opened; in the app, this includes when this phone last registered for notifications. These never leave your device except as described above.

You can change your cookie choice at any time with the Cookies link in the footer, or by clearing cookies in your browser. Blocking the cookies above signs you out and can stop forms working.

9. Security

All traffic to SportsBiff is encrypted in transit. Passwords are stored only as one-way hashes. Access to personal data is limited to the people who need it to run SportsBiff.

10. Over 18s only

SportsBiff is not for anyone under 18. We ask for your date of birth at sign-up and do not knowingly collect data from under-18s. If we learn an account belongs to someone under 18, we delete it.

11. Changes to this policy

When we change this policy we update the date at the top. If a change matters to how we use your data, we will tell you by email or in SportsBiff before it takes effect.

12. Gambling

SportsBiff tracks tipsters' records and provides information only. We are not a bookmaker and take no bets. If gambling is causing you harm, see our responsible gambling page for free, confidential help.