How Tipster uses your data

Tipster is a small, free prediction game run by Tommy. This is everything it keeps, who sees it, and why. No ads, no tracking, and nothing is sold.

What Tipster keeps

• Your account: your nickname, your email address, your password (stored scrambled, so nobody can read it), when you confirmed you're 18 or over, and your made-up leaderboard name if you hide yours.
• Your game: your predictions, power-ups and cards, your skips, and the leagues you're in, with when you joined or left.
• Notifications: if you turn them on, the address your browser gives Tipster for sending them, one for each phone or browser.
• How you use it: when you were last on Tipster (at most once an hour), whether and when you opened it installed on your home screen and on what kind of phone, the invite code you signed up with, how far you've got in the beta guide when you're signed in, and how often you tapped the share buttons. Only Tommy sees this, and it goes when you delete your account. It isn't page views, clicks or a recording of what you do.
• Feedback: any bug or idea you send, with its screenshots or recordings, the page you were on, the app's version and your browser.
• Small settings: which pop-ups and tips you've closed, and which Predict layout you see.
• Moderation: if an admin renames you or your league, or suspends your account, a note of what changed, when and why, for as long as your account exists.
• Signing in: the internet address and browser you sign in from, kept by Supabase with your sign-in to keep it safe.
• Logs: what the app did and what went wrong, with your account number but never your email or internet address (they're taken out before anything is written).

Cookies keep you signed in, and your browser remembers a few things on your phone (like closing the install bar). There's no third-party analytics, ad tracking or tracking cookies: see Cookies.

Who sees it

• Mates in your leagues: your nickname, points and place, and your predictions, power-ups and stats once each match has kicked off. Never before kickoff. They could also find when you joined Tipster.
• Global leaderboards (if you join one): any player sees your nickname, or your made-up name if you hide yours, and your points. Your predictions there can be read by any signed-in player once a match kicks off.
• Tommy, who runs Tipster, can see the database to fix problems, and reads your feedback.
• No other player ever sees your email address.

Who handles it for Tipster

• Supabase runs the database and signing in.
• Cloudflare carries the traffic to and from Tipster, checks that sign-ups, sign-ins and password resets aren't robots (Turnstile, which runs in your browser), and keeps Tipster's encrypted backups.
• Resend sends Tipster's emails, like the one for resetting your password.
• Google Cloud keeps the logs.
• GitLab holds your feedback as a private note for Tommy (your nickname, never your email), and Telegram tells him it's arrived (your nickname and the start of your message).
• Your browser's own push service (Google, Apple or Mozilla) delivers notifications.
• The app runs on a server in the EU (Helsinki, at Hetzner). Supabase, Cloudflare, Resend, Google and GitLab are US companies.
• Fixtures, scores and odds come from football-data.org and The Odds API. They never get anything about you.

How long

• Your account and everything in it: until you delete it.
• Feedback: once it reaches Tommy's GitLab (usually within minutes), its screenshots and recordings are deleted from Tipster; the report, with them, stays in GitLab.
• Logs: 30 days.
• Backups (encrypted, for when something goes wrong): 30 days.

Cookies

Tipster only uses cookies it needs to work, so it doesn't ask first. None of them track you, and none come from advertisers.

• tipster-auth (sometimes split into tipster-auth.0, .1 and so on): keeps you signed in, until you sign out (or after about a year without visiting).
• tipster-auth-code-verifier and two like it: set when you sign up or ask for a password reset, part of how Supabase checks the emailed link.
• tipster-confirming: after you sign up (or sign in before confirming your email), remembers your email address for the “Check your email” page, for a day at most.
• tipster-recovering: while you reset your password, for 10 minutes at most.
• tipster-ad-preview: for admins only, whether they see Tipster's own promos.
• Cloudflare may set its own short-lived cookie when it checks you're not a robot.

Your browser also keeps a few things on your phone, not sent with every page: that you closed the install bar or the notifications card, which account this phone's notifications are for, and your “Notify me” choice while you sign up.

Deleting your account

At the bottom of this page, Delete your account (you'll need your password). Everything of yours goes from Tipster straight away. A league you made goes to whoever's been in it longest, or is deleted if you're the only one in it.

A few things stay for a while. Your data stays in Tipster's encrypted backups until they expire, up to 30 days, and your account number in the logs for up to 30 days. And copies of feedback you've sent stay in Tommy's issue tracker (GitLab) and his Telegram, under your nickname.

Questions, or your data

Ask Tommy, who runs Tipster, for a copy of what Tipster has about you, or to correct or delete it: contact@tapps.vip. The rules for playing are in the terms.