Privacy Policy

Last updated: July 15, 2026

This Privacy Policy describes how Bad Beats ("we", "us", "our") collects, uses, and protects your information when you use the Bad Beats™ application ("Service").

1. Information We Collect

Information You Provide

Data	Purpose	Required
Email address	Account verification, password reset, important notifications	Yes
Username	Display name on slips and leaderboard	Yes
First/Last name	Profile display	No
Password	Account authentication (stored as bcrypt hash, never in plain text)	Yes
Bet slip images	AI parsing to extract bet information	To use upload feature
Profile avatar (optional)	Displayed on your profile, slips, and leaderboards	No
Apple Sign In identifier (optional)	Account authentication when you sign in with Apple. We receive an opaque Apple user identifier and (on first sign-in only) the email and name you choose to share. We never receive your Apple ID password.	Only if you use Sign in with Apple

Information Generated by Use

Parsed bet data: Teams, odds, wager amounts, and other bet details extracted from your uploaded images.
Financial data: Wager amounts, payouts, and profit/loss calculations derived from your slips. Visibility of financial data is controlled by your privacy settings (Only Me, Friends, or Everyone).
Friend connections: Your friend list and friend requests.
Push notification subscriptions: Browser push subscription endpoints (web) or Apple Push Notification service (APNs) device tokens (iOS app) for delivering notifications.
Subscription status: Whether you have an active Premium subscription, and when it expires. Purchase processing is handled entirely by Apple; we never see your payment details.
Tags and notes: Any tags or annotations you add to your slips.

Information Collected Automatically

Session tokens: For maintaining your login session (90-day expiry).
API usage logs: Token counts and model usage for cost tracking (no personal content is stored in these logs).

2. How We Use Your Information

Provide the Service: Parse bet slips, track scores, calculate results, and display your betting history.
Account management: Verify your email, authenticate logins, and enable password resets.
Notifications: Send push notifications about live game updates, bet results, and friend activity (when you opt in).
Improve the Service: Monitor API usage and costs to maintain and improve the platform.
Communication: Send transactional emails (verification, password reset) and important service announcements.

3. Third-Party Services

We use the following third-party services to operate:

Service	Purpose	Data Shared
Cloudflare	CSAM detection (image hash matching), DDoS protection, content delivery	Image bytes (transient, edge cache only). Privacy Policy
Anthropic (Claude API)	AI parsing of bet slip images	Uploaded images are sent for processing and are not retained or used for model training by Anthropic per their API terms. We store your images on our servers to display on your slips.
ESPN (public API)	Game scores and results	No user data shared
Resend	Transactional email delivery	Email address, username
Apple (Sign in with Apple)	Account authentication for users who choose Sign in with Apple	Apple verifies the identity token we receive and returns an opaque user identifier. See Apple's Privacy Policy.
Google (Sign in with Google)	Account authentication for users who choose Sign in with Google	Google's OAuth flow returns your email, name, and an opaque Google user identifier. See Google's Privacy Policy.
RevenueCat	In-app subscription management and entitlement verification	Your Bad Beats user identifier and the App Store transaction events Apple forwards for your subscription. No payment details. See RevenueCat's Privacy Policy.
Google AdMob	Serving ads in the iOS and Android app (free tier only — disabled for Premium subscribers)	If you grant App Tracking Transparency permission, the iOS Advertising Identifier (IDFA) is shared with Google for ad personalization. If you decline, only non-personalized ad signals are shared. See Google's Ads Privacy.

We do not sell, rent, or share your personal information with third parties for marketing purposes outside of the advertising disclosures above.

4. Data Storage and Security

Data is stored on secured infrastructure with access restricted to authorized administrators.
Passwords are hashed using bcrypt with a cost factor of 12 and are never stored in plain text.
Session tokens are cryptographically generated and expire after 90 days.
Email verification tokens expire after 24 hours.
We use HTTPS for all data transmission.

5. Your Privacy Controls

Slip visibility: You control who can see each slip (Private, Friends, or Global).
Financial visibility: You control who can see your wager amounts and financials (Only Me, Friends, or Everyone).
Push notifications: You can enable or disable push notifications at any time.
Account deletion: You can permanently delete your account and all associated data from the Account settings page.

6. Data Retention

Active accounts: Your data is retained as long as your account is active.
Deleted accounts: When you delete your account, all personal data is permanently removed. Slips that are co-owned with other users will have your name replaced with "[deleted]" to preserve their records.
Archived slips: Settled slips are moved to the archive automatically but remain accessible to you.
Expired sessions: Expired session tokens are automatically cleaned up every 6 hours.
Safety incident records: When we detect prohibited content (e.g., via PhotoDNA hash-matching or AI content safety signals), we retain the associated metadata (user ID, username, email, IP address, timestamp, hash source, match details) indefinitely for legal compliance, law-enforcement cooperation, and preservation requirements under federal law. These records persist even if the associated account is deleted. Image bytes themselves are never retained.

7. Children's Privacy

The Service is not intended for anyone under 18 years of age. We do not knowingly collect information from children. If we learn that we have collected data from a user under 18, we will delete it promptly.

8. Cookies, Tracking, and Advertising

Web version: Bad Beats does not set tracking or advertising cookies on the web. We use browser localStorage for session management (auth token, user preferences). No third-party analytics scripts are loaded.

iOS and Android apps: The free tier of the app displays ads served by Google AdMob. On iOS, Apple requires that we ask your permission before any data is used to track you across apps and websites owned by other companies (App Tracking Transparency).

If you allow tracking, Google AdMob may use your device's Advertising Identifier (IDFA) to personalize the ads you see.
If you decline, Google receives only non-personalized signals. The app works identically either way — your choice does not affect any features.
Premium subscribers: No ads are shown, and no advertising-related data is sent to Google regardless of your ATT choice.

We do not use Google Analytics, Facebook Pixel, or any other third-party analytics or tracking SDK. The only third parties that receive any user-linked data are the services listed in Section 3.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (available via Account settings).
Export your data in a portable format.
Withdraw consent for data processing.

To exercise these rights, contact us at the email below or use the in-app account management features.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For questions about this Privacy Policy or your data, contact us at support@poudroughprojects.com.