Privacy Policy

HaterPicks Pty Ltd ("HaterPicks", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the HaterPicks website and apps (the "Service") with an account in the United States.

HaterPicks is an Australian company and handles all personal information under the Australian Privacy Act 1988 (Cth). If you live in a US state with a consumer privacy law, the US State Privacy Notice below also applies to you.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, and password when you register
• OAuth profile data: name and email from Google or Apple when you sign in via those providers
• Age confirmation: your confirmation that you are 21 or over, and when you gave it
• Payment information: on the web, billing details processed securely by Stripe — we do not store your full card number. In the iOS and Android apps, subscriptions are billed by Apple or Google; we receive your subscription status, never your payment details
• Bet tracking data: bets you voluntarily log in the bet tracker, including bet slips you choose to scan
• Push notification tokens: device identifiers for delivering push notifications, if you enable them
• Support correspondence: emails or messages you send to us

1.2 Information Collected Automatically

• Usage data: pages viewed, features used, timestamps
• Device information: browser type, operating system, screen size
• IP address and approximate location: country and state, which we use to set your account's country and to show only sportsbooks licensed where you are
• Cookies and local storage: used for authentication sessions and preferences

2. How We Use Your Information

We use your personal information to:

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Authenticate your identity and secure your account
• Show you the version of the Service, prices, and sportsbooks that apply where you live
• Send transactional emails (account verification, password resets, billing receipts)
• Communicate service updates, changes to terms, or security notices
• Process refund requests
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations

We send news and feature email only to members who agreed to it when they signed up, or who were members before we began sending it. Every such email has a one-click unsubscribe link, and unsubscribing stops it for good. Account email (verification, password resets, billing and subscription confirmations, security notices) is part of the Service and is always sent. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

3. Service Providers

We disclose personal information only to these service providers, only to the extent necessary, and only to run the Service for you:

• Supabase — authentication and database hosting (stores your account data)
• Stripe — payment processing on the web (receives billing and card information)
• Vercel — application hosting and performance measurement
• Apple App Store / Google Play — in-app subscription billing in the iOS and Android apps
• RevenueCat — manages in-app subscriptions (receives your account ID and subscription status)
• Apple Push Notification service (APNs) — push notifications on iOS devices
• Firebase Cloud Messaging (Google) — push notifications on Android devices
• Google / Apple — OAuth authentication (only if you choose to sign in with these providers)
• Cloudflare — bot protection on sign-up and sign-in forms
• Anthropic — reads a bet slip image when you choose to scan one into the bet tracker
• Telegram — internal alerts to our own staff about account and billing events
• DigitalOcean — hosts our own servers in Sydney, Australia, which run the projection and odds engines, settle the bets you track, and send email
• Resend — delivers account email and, if you receive it, news email (receives your email address and the message)
• Upstash — rate limiting that protects the Service from abuse (briefly holds your account ID or IP address)

Each provider operates under its own privacy policy. We do not share your information with advertisers or data brokers.

4. Cookies and Tracking

We use essential cookies to maintain your authentication session and your account's country. These are strictly necessary for the Service to function and cannot be disabled.

We do not use third-party advertising cookies or cross-site tracking pixels. We measure how the Service is used with our own first-party records, but we do not build advertising profiles from your data.

5. Data Storage, Transfers and Security

HaterPicks is based in Australia, and your information is transferred to, stored in and processed in Australia: our database (Supabase), the servers that run the website and apps (Vercel) and our own servers (DigitalOcean) are all in Sydney. Some of the service providers in section 3, such as Stripe, Apple, Google, Anthropic and Resend, also process it in the United States. Australia's privacy laws may differ from those of your state; we protect your information as this policy describes wherever it is processed.

We implement industry-standard security measures, including encryption in transit (TLS), secure password hashing, and role-based access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or de-identify your personal information within 90 days, except where we are required to retain it for legal, tax, or compliance purposes. Payment records are retained for 7 years to meet tax record-keeping requirements.

7. Children

The Service is not directed at anyone under 21. We do not knowingly collect personal information from anyone under 21, and if we learn that we have, we will delete it promptly.

8. US State Privacy Notice

This notice applies to residents of California and of other US states with consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Tennessee, Indiana, Kentucky and Rhode Island, to the extent those laws apply to us.

8.1 What we collect, and why

In the 12 months before this policy was updated, we collected these categories of personal information, from you, your device, and the sign-in and billing providers listed in section 3:

• Identifiers: name, email address, account ID, IP address, device push tokens
• Commercial information: your plan, subscription status and payment history (not full card numbers)
• Internet or other electronic network activity: pages viewed and features used in the Service
• Geolocation data: approximate location (country and state) derived from your IP address, never precise GPS location
• Other information you provide: bets you log, bet slips you scan, support messages, and your age confirmation

We use and disclose these categories only for the purposes in section 2, and only to the service providers in section 3. We do not collect sensitive personal information as defined by these laws, other than your account password, which is used only to sign you in. We keep each category for the periods in section 6.

8.2 No sale, no sharing, no targeted advertising

We do not sell personal information, we do not share it for cross-context behavioral advertising, we do not use it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We have not done so in the past 12 months. We honor Global Privacy Control (GPC) browser signals as a request to opt out of sale and sharing, though there is nothing to opt out of.

8.3 Your rights

Depending on your state, you have the right to:

• Know and access the personal information we hold about you, and receive a portable copy
• Correct inaccurate personal information
• Delete your personal information (you can also delete your account yourself in Profile)
• Opt out of sale, sharing, targeted advertising and profiling (we do none of these)
• Not be discriminated against for exercising any of these rights

8.4 How to exercise them

Email support@haterpicks.app from the address on your account, saying which right you are exercising and your state of residence. We verify a request by confirming it from that email address, and respond within 45 days (we will tell you if we need up to 45 more). You may use an authorized agent; we will ask the agent for your signed permission and may ask you to confirm the request yourself.

Appeals. If we decline your request, you may appeal by replying to our decision with "Appeal" in the subject line. We answer appeals within the time your state's law sets (generally 45 or 60 days). If you are not satisfied, you may contact your state Attorney General.

California "Shine the Light". We do not disclose personal information to third parties for their own direct-marketing purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. The "Last updated" date at the top of this page indicates when the policy was last revised.

10. Contact

If you have questions or concerns about this Privacy Policy or our data practices, contact us at support@haterpicks.app.