Privacy policy

We collect the information you give us when you create an account, use the service, and pay or receive payouts:

• Account details: email address, display name, public username, hashed password, and your declaration that you are 18 or older.
• Profile picture: if you upload an avatar, the resized image is stored on our object-storage provider.
• Wallet and activity: virtual-currency balance, transactions, bets, signal purchases or sales, and their outcomes.
• Payment data:when you top up virtual currency or sell a signal, Stripe collects your card or payout details directly. We only store Stripe's identifiers (customer ID, charge ID, Connect account ID).
• Push token: if you enable push notifications, your device gives us an Expo push token so we can notify you about account events. You can revoke it at any time.
• Communication preferences: the on/off flags for email and push notifications.
• Session + device info: session tokens we issue at sign-in, your IP address, and basic device metadata used to keep your account secure.
• Logs: error logs and audit logs (sign-in, password change, ban events) for security and support.

We process your data to provide and improve the service, send transactional messages (sign-in verification, password resets, bet-settled notifications, signal-sale receipts, dispute updates), process payments and payouts, deliver push notifications when you opt in, keep the service secure, and meet legal obligations.

Our lawful bases under UK GDPR are contract performance, legitimate interest, and — for push notifications — your consent.

We use a small set of processors to deliver the service. Each receives only the data it needs:

• Stripe — payments and Stripe Connect payouts (cards, bank details, payout schedules).
• Postmark — transactional email delivery (your address and the body of messages we send).
• Expo Push Service — push notification delivery via Apple Push Notification Service (iOS) and Firebase Cloud Messaging (Android).
• Neon — PostgreSQL hosting for your account, wallet, bets, and signals.
• Replit Object Storage — stores your uploaded avatar image.
• odds-api.io — sports event data and odds we use to settle bets. We send no personal data to this provider.

We do not sell your personal data and do not share it for advertising.

We keep your account data while your account is open. When you delete your account, we delete or irreversibly anonymise your personal data — except for records we are legally required to retain (e.g. payment records for tax purposes).

Under UK GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. You can:

• Turn email and push notifications off from your profile page (verification and password-reset email are not gated by the toggle).
• Update your profile (name, username, email, avatar) at any time.
• Delete your account from the Danger Zone on the profile page, or by emailing us.
• Sign out of all active sessions at once.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Email info@betfrnd.com to exercise any of these rights.

We store passwords as one-way hashes, encrypt data in transit with HTTPS, and use signed session tokens for authentication. No system is impenetrable — if you suspect your account has been compromised, change your password immediately and contact us.

BetFrnd is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us and we will close the account and erase the data.

We may update this policy from time to time. The "Last updated" date above tells you when. If the changes are material we will email registered users and surface a notice in the app before they take effect.

BetFrnd Ltd
Email: info@betfrnd.com