Privacy Policy — The Pirate Bet

1. Information We Collect

Account Information
• Email address (for account verification and communication)
• Username (public identifier)
• Password (securely hashed, never stored in plain text)
• Display name (optional)
• Profile picture/avatar (optional)
• Year of birth (collected at signup, used solely to verify the minimum age requirement)

Betting and Gameplay Data
• Bets you create or join
• Predictions you make on matches
• XP, levels, and progression data
• PirateCoin balance and transactions
• Leaderboard rankings and statistics
• Bet history and results

Social Data
• Friend connections you create
• Friend requests sent and received
• Bet invitations
• Community data: When you create or join a community, we collect the community name, description, your membership role (founder, co-founder, or member), and the date you joined. If you create a community, we store the invite token associated with your community (a unique random value with no personal data embedded in it). Community avatars you upload are stored in our cloud storage.

Technical Data
• Device type and browser information
• Operating system
• IP address
• Session and authentication tokens
• App usage patterns and analytics
• Push notification tokens (if enabled)
• Product-analytics events and masked session recordings (all text inputs are masked) via PostHog — collected only if you accept analytics cookies, used to understand and improve usage

Community leaderboard rankings are computed from existing PirateCoin transaction data and prediction accuracy records. No additional profiling data is created solely for leaderboard purposes.

What We Do NOT Collect
• Payment or financial information (no real-money transactions)
• Government-issued ID or sensitive personal data
• Location data beyond IP-based geolocation
• Contact lists or phone numbers

2. How We Use Your Data

Platform Functionality
• Create and manage your account
• Authenticate your identity and secure your session
• Enable you to create, join, and track bets
• Calculate and display XP, levels, and leaderboards
• Manage PirateCoin balances and transactions
• Facilitate friend connections and social features
• Calculate and display community leaderboards based on PirateCoins won and prediction accuracy within community bets

Communication
• Send account verification emails
• Notify you about bet results and updates
• Send friend request and invitation notifications
• Deliver important service announcements
• Respond to feedback or support requests

Analytics and Improvement
• Analyze usage patterns to improve the platform
• Identify and fix bugs or performance issues
• Develop new features based on user behavior
• Ensure platform security and prevent abuse

We never sell your personal data to third parties.

3. Email and Notification Usage

We may send you emails and push notifications for:

• Account-related: Email verification, password resets, security alerts
• Bet updates: Bet results, upcoming match reminders
• Social notifications: Friend requests, bet invitations
• Service announcements: Important updates, new features, maintenance

You can manage notification preferences in your Settings. Some essential communications (like security alerts) cannot be disabled.

4. Third-Party Services

We use trusted third-party services to operate the platform:

• Supabase: Database, authentication, and file storage
• Mailgun (EU region): Transactional email delivery
• Firebase Cloud Messaging: Push notifications
• PostHog (EU region, eu.i.posthog.com): Product analytics and masked session replay, loaded only after you accept analytics cookies
• Cloudflare Turnstile: Bot/abuse protection on signup and login (sets a strictly necessary cookie)

These services are contractually bound to protect your data and use it only for the purposes we specify.

5. Data Sharing

We may share limited data only in these circumstances:

• Service providers: As described above, to operate the platform
• Legal requirements: When required by law, court order, or legal process
• Protection of rights: To protect our rights, safety, or property
• With your consent: When you explicitly agree to share data

We do NOT share personal data for advertising or marketing purposes.

6. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Authentication: Keep you logged in securely
• Security: Prevent fraud and unauthorized access
• Preferences: Remember your settings (theme, notifications)
• Analytics: Understand how users interact with the platform

Authentication, security, and Cloudflare Turnstile rely on strictly necessary cookies that are always active because the platform cannot function without them.

Our analytics provider, PostHog, stores non-essential cookies and localStorage entries. These are loaded only after you press Accept in the cookie banner.

Your choice: When you first visit the platform, a cookie banner lets you Accept or Decline non-essential analytics. If you press Decline, no analytics events are sent. You can change your choice at any time from the Settings page under "Cookie preferences". Essential cookies (authentication and security) are always active because the platform cannot function without them.

7. Data Security

We implement industry-standard security measures:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Secure password hashing (passwords are never stored in plain text)
• Row-level security policies to protect your data
• Regular security audits and updates
• Limited access to personal data on a need-to-know basis

While no system is 100% secure, we take reasonable steps to protect your data from unauthorized access, alteration, or destruction.

8. Data Retention Policy

We retain your data as follows:

• Account data: Retained while your account is active
• Betting history: Retained for the lifetime of your account
• Analytics data: Internal analytics events are retained while your account is active. PostHog product-analytics data and session recordings (collected only with your consent) are linked to your account ID and retained according to PostHog's EU data retention; you can withdraw consent at any time, which stops further collection.
• Deleted accounts: Personal data deleted within 30 days of account deletion
• Legal requirements: Some data may be retained longer if required by law
• Community data: If a community is deleted by its founder or by The Pirate Bet, membership records are removed. However, bets that were created within that community, and the associated PirateCoin transaction history, are retained for record-keeping purposes. If your account is deleted, you are automatically removed from all communities you belong to.

9. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Request corrections to inaccurate data
• Deletion: Request deletion of your account and data
• Portability: Request your data in a portable format
• Objection: Object to certain types of data processing
• Withdraw consent: Withdraw consent for optional data processing

To exercise these rights, contact us through the feedback form (logged-in users) or via email. We will respond within 30 days.

10. Children's Privacy

The Pirate Bet is not intended for users under 13 years of age. We do not knowingly collect personal data from children.

If we discover that we have collected data from a child under 13, we will delete it promptly. If you believe a child has provided us with personal data, please contact us immediately.

We verify this by collecting each user's year of birth at signup and blocking registration for anyone under 13.

11. International Data Transfers

Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including:

• Use of providers with strong data protection practices
• Contractual clauses requiring data protection
• Compliance with applicable data protection laws

12. Changes to This Policy

We may update this Privacy Policy as the platform evolves. Changes will be posted on this page with an updated "Last updated" date.

For significant changes, we will notify users through email or in-app notification. Continued use of The Pirate Bet after changes constitutes acceptance of the revised policy.

13. Contact Us

For questions about privacy, data requests, or to exercise your rights, contact us:

You can also email us at info@piratebet.fi.

We aim to respond to all privacy-related requests within 30 days.