Privacy

Stakepoint stores what it needs to run an account and settle a bet, and it stores it on its own server. There is no payment processor, no advertising network and no analytics product in this application, because there is nothing here for any of them to do.

The rest of this page is the actual list, taken from the data model rather than written around it. If something is not on it, this software does not collect it.

Created when you register, edited when you change something:

• Username and email address. Identity and the way we reach you. Both unique across the platform.
• Your password, hashed. Stored as a scrypt hash with the parameters it was made under, never as the password itself. Nobody here can read it, including us; a password reset replaces the hash rather than recovering anything.
• Display name and country, if you give them. Optional, and blank is a perfectly good value.
• Your role and account status — whether the account is active, suspended or closed.
• Your own limits: maximum stake, daily loss cap, and the date any self-exclusion runs until. These are checked at the moment a bet is placed and at sign-in.
• Sign-in safety counters: how many failed attempts in a row, whether the account is locked and until when, the time of your last successful sign-in and the IP address it came from. This is what stops somebody guessing their way into your account.
• When the record was created and last changed.

One row for every sign-in, so that a session can actually be revoked. A signed token that carries its own claims cannot be stopped before it expires; a row can be, immediately.

• A hash of the session token — never the token itself. The random value in your cookie is stored only as its SHA-256, so a copy of the database does not hand anybody a live session.
• A CSRF token, echoed back by your browser on anything that changes data.
• The IP address and browser user-agentthe session was opened from. This is what makes “somebody else has been on my account” an answerable question.
• Created, last seen, expires, and revoked timestamps. A session lasts seven days unless it is revoked first.

Changing your password revokes every other session in the same request. Suspending or closing an account revokes all of them.

Cookies.Two, both strictly functional: the session cookie, which your browser cannot read from script, and the CSRF cookie, which it can and which is useless without the first. Your light-or-dark theme choice is kept in your browser's own storage and never sent to us. Nothing else is set, and there is no tracking cookie to consent to.

• The wallet: your currency, your spendable balance, what is currently in play, and a version counter that stops two bets spending the same cent.
• Every movement, as its own entry: what kind it was (stake, return, refund, adjustment, credit), the signed amount, the balance immediately after it, what caused it, the staff member who booked it where one did, an optional note, and the time.

It follows that we cannot erase an individual movement on request, and neither can anyone working here. Deleting your account deletes the wallet and its entries together, or nothing.

Each bet keeps its own record and its legs keep theirs.

• The bet: a short reference code, single or multiple, status, stake, combined odds, what it would return, what it actually paid, the currency, the IP address it was placed from, when it was placed and when it settled, and — where a person settled it — who, and any note they left.
• Each leg: the fixture, market and selection it refers to, and a frozen copy of the names and the price as they stood at the instant the bet was struck. Not a link to a live market: a copy, because a settled bet has to still read correctly years after the fixture has left the feed.
• How the leg was settled: which resolver decided it or which administrator did, the score or state it was decided from, and when.
• A snapshot of the marketexactly as the feed had it when the bet was accepted. This exists for one purpose: it is the answer to “those were not the odds I clicked”.

The frozen copy is also why a bet cannot be re-read into something it was not. Nothing about a placed bet is taken from your browser at settlement time.

Every privileged action is written down: what was done, by whom, to which account, the before and after values, a reason where one is required, the IP address, and the time. Suspending an account, adjusting a balance, settling a bet by hand, changing a role or a platform setting — all of it.

The audit trail is append-only too. Nothing in this application edits or deletes an audit row. That is deliberate and it cuts both ways: it is the record that protects you from us, so it is not a record we will quietly remove entries from.

• No payment data. There is no cashier, no card, no bank detail, no payment processor. A balance is credit issued by an administrator.
• No identity documents. There is no verification upload in this software.
• No analytics, advertising or third-party trackers in the application itself. No profile is built and nothing is sold or shared for marketing.
• No location beyond an IP address, and the optional country you may have typed yourself.

The live odds on the board come from an upstream feed, and the images beside them are fetched through this server. That traffic is about fixtures, not about you.

• Sessions. A session stops working the instant it expires — seven days — or is revoked, and it can never be used again. Clearing the dead rows out of the database is a separate housekeeping job, which on this installation is run by hand rather than on a schedule, so a row may sit there after it has stopped meaning anything.
• Your account, statement and bets. Kept for as long as the account exists, and after closure for [retention period required by the licensing regulator], which is set by the rules that apply where this platform operates rather than by us.
• The audit trail. Kept for the life of the installation. It is append-only by design.
• Fixture results. Scores recorded for settlement. About matches, not about people.

Email [email protected] from the address on your account. We can tell you what is held, correct something that is wrong, and close the account.

Two things we will say straight rather than discover later: an append-only ledger and an append-only audit trail cannot have individual rows removed from them, and a bet that has been settled is a financial record for as long as the retention rules say it is.

The controller of this data is Stakepoint Ltd, [operator address]. The rights you have over it, and the authority you can complain to, depend on where this platform is licensed and where you live: [applicable data-protection law, supervisory authority and contact].