Privacy policy

NOVA, 71 boulevard Raymond Poincaré, 06160 Antibes, France, registered under SIREN 941 222 671.

For any question, or to exercise your rights: contact@trackstake.com.

No data protection officer has been appointed: neither the size of the company nor the nature of the processing requires one.

Your account: email address, display name, password as an irreversible hash, and a public handle if you choose one. Plus your language, currency and time zone, which only affect display.

What you record: your bankrolls, your bets and their selections, and the names of competitions, teams, bookmakers and tipsters you type yourself. Those names are your own words; we neither translate nor enrich them.

Running the service: a session cookie on the web, authentication tokens in the mobile app, and the log of actions taken on a verifiable bankroll. That log is what makes a record provable; it is inseparable from the feature.

What we do not collect: no advertising tracker, no third-party analytics, no profiling. There is no consent banner because there is nothing to consent to.

When you use slip reading, your image is passed to a model that extracts the information from it, and is then discarded. It is written to no database and no file: our database has no field to store it in.

What is kept is only what was read — the stake, the odds, the teams — because that is what fills in your form, and you review those values before anything is recorded.

The request sent to the provider forbids it from routing your image to a supplier that would retain submitted content or use it to train a model. That prohibition travels with every request, rather than living in an account setting that could be changed without anyone noticing.

To provide the service you asked for — keeping your bankrolls, computing your statistics, publishing what you choose to make public: performance of our contract.

To secure accounts and limit abuse — password hashing, rate limits, an administration action log: legitimate interest in protecting the service and its users.

To write to you in order to confirm your address or reset your password: performance of our contract. We send no marketing messages.

Nobody other than the providers listed below, who act on our instructions. Your data is neither sold, rented nor exchanged.

What you deliberately publish — a public profile, a public bankroll, a bet shared through a link — is visible to anyone who knows the address. That is the point of those features, and they are off by default.

Hosting stays in Germany: your bankrolls and your bets do not leave the European Union.

Two providers are established in the United States: the one delivering our emails, and the one routing photos submitted for slip reading. Those transfers rely on the European Commission’s standard contractual clauses. You can use Trackstake without ever triggering the second: slip reading only happens when you choose to send an image.

Your account and its contents: for as long as the account exists. Deletion is immediate and permanent, and you can trigger it yourself from the settings, on the web as on the phone.

Mobile app tokens: sixty days, and all of them are revoked as soon as a password is reset.

Address confirmation and password reset links: twenty-four hours, single use, and stored as a hash — we do not keep the link itself.

A deleted public bankroll leaves a counted trace on your public profile. That is a product requirement: a record that can be made to disappear unnoticed is not a verifiable record.

You have the right to access, rectify, erase, restrict, object and to data portability. Exporting your bets is available directly in the product, without having to ask.

For everything else, write to contact@trackstake.com. We answer within one month.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or www.cnil.fr, or with the authority of your own country of residence.

Passwords are stored as irreversible hashes and cannot be read back, including by us. Mobile app tokens live in the device’s secure keychain rather than in plain storage.

Endpoints that could reveal which addresses have an account answer the same way whether the address exists or not. On a betting-related service, knowing who has an account is already sensitive information.