Privacy Policy

1. What we collect

Information you give us:

• Account details — name, email address, and a profile picture if your sign-in provider supplies one. Sign-in is handled by Clerk; if you use Google, we receive your name and email from Google, not your Google password.
• Preferences you set — favourite sports and teams, sportsbooks you use, filter and page settings, bankroll figure, betting experience, and your US state if you tell us.
• Bets you track in My Bets, including the odds and stake you record.
• Messages you send to the in-app assistant, and anything you email us.
• Your Discord account id and username, if you choose to link Discord.
• An affiliate link of your own, if you add one for your share pages.

2. What we collect automatically

• Usage data — pages viewed, features used, and events like signing up or starting a checkout, through PostHog.
• Technical data — IP address, browser and device type, and timestamps, in server logs and analytics.
• Referral data — if you arrive through an affiliate link, our affiliate platform records the click and, if you sign up, ties your account to the partner who referred you.

3. Payment information

We never see or store your card number. Payments run through Stripe, which handles card details directly. What we store is a Stripe customer id, your plan and its status, and a card fingerprint Stripe gives us — an identifier that lets us spot the same card being reused across accounts to claim repeated discounts. It cannot be turned back into a card number.

4. Who we share it with

We do not sell your personal information. We share it only with the processors that run the service:

• Clerk — authentication and account management.
• Stripe — payments, subscriptions and the billing portal.
• PostHog — product analytics.
• Tolt — affiliate attribution, for visitors who arrive through a partner link. Your email is registered with them as a referred signup so the partner can be credited.
• Resend — transactional email, including the daily picks digest if you opt in.
• Anthropic — messages you send to the in-app assistant, to generate its replies.
• Discord — only if you link your Discord account, to sync your role.
• Google Cloud Storage — hosting for images the product generates, such as share cards.
• Railway — hosting for our application and database, in the United States.

5. Why we are allowed to use it

• To provide the service you asked for — your account, your subscription, your saved preferences and tracked bets.
• For our legitimate interests — keeping the service working, understanding which features are used, preventing fraud and abuse, and paying our affiliate partners correctly.
• With your consent — marketing email, which you can withdraw at any time.
• To meet legal obligations, including tax and accounting records.

6. Cookies and local storage

We use a session cookie from Clerk to keep you signed in, analytics storage from PostHog, and, for visitors who arrive through a partner link, storage from our affiliate platform that records which partner referred you. The app also stores your preferences in your browser's local storage — filter settings, layout choices, dismissed prompts — which never leave your device.

Blocking cookies is possible in your browser, but the session cookie is required to stay signed in.

7. How long we keep it

We keep account data for as long as your account exists, and for a period afterwards where we need it for tax, accounting or fraud-prevention purposes. Analytics data is retained on our analytics provider's schedule. Delete your account and we delete or anonymise your personal data, except where we are required to keep records of transactions.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to certain processing, or receive a copy in a portable format. Email us and we will action it. You can change most of your data yourself in Settings, and every marketing email has an unsubscribe link.

We will not discriminate against you for exercising any of these rights.

9. Security

Data is encrypted in transit, access to production systems is restricted, and sensitive credentials such as card details never reach our servers. No service can promise perfect security, but we take it seriously and we will tell you if a breach affects your data.

10. Age restriction

Locktopus is not for anyone under 21. We do not knowingly collect data from anyone below that age, and we never knowingly collect data from children. If you believe someone underage has given us personal data, email us and we will delete it.

11. International users

Our servers and processors are primarily in the United States. If you use Locktopus from elsewhere, your data is transferred to and processed in the US, which may have different data-protection rules than your own country.

12. Changes

We may update this policy. The date at the top changes when we do, and material changes will be communicated in the product or by email.

13. Governing law

These terms are governed by the laws of the State of New York, without regard to conflict-of-law rules.