Privacy policy

Last updated 12 November 2026

Who we are

ZippyOdds is the controller of the personal data described here, for zippyodds.com and zippyoddsapi.com (ZippyOddsAPI is a ZippyOdds service). The two sites share one account system, so this policy covers both. To ask about your data or use your rights, use our contact page and choose Privacy request.

What we collect

  • Your account: your email address, a name if you give one, which site you signed up on, when you confirmed your age and accepted the terms, when the account was made, when you last signed in, and whether your email address is confirmed. Your password is stored only as a slow, salted hash, never as the password itself.
  • Signing in: a session cookie in your browser, and on our side a hash of its token with when it was made, when it expires and when it was last used. Links for confirming your email or resetting your password are stored only as a hash, and work for 24 hours or one hour.
  • Your plan: which plan you have, its status and dates, and whether we granted it.
  • Payments, when paid plans are available: your customer reference at Mollie, and for each payment its reference, amount, currency, date and the period it covers. We never see or store card numbers.
  • API keys: each key's name, its public prefix, its status and dates, when it was last used, and how many requests and credits your account has used. A key's secret is stored only as a keyed hash.
  • Messages you send us: what you enter on the contact page (your email address, a name if you give one, the topic and the message), which site you sent it from and when.
  • Security records: counts of recent attempts at signing in, signing up, resetting a password, sending a message and similar actions, kept against a keyed one-way hash of your IP address or email address, never the address itself; and a log of account actions such as password changes, plan changes and keys issued.
  • Technical logs: Cloudflare, which hosts both sites, records each request (such as the time, the address requested, the result, and the IP address and browser details sent with it) so we can keep the service running and secure.

Some things stay in your own browser and never reach us: your tool preferences, your bet tracker and its limits, and an API key you paste into the member tools, which is kept only for that browser tab.

Cookies and tracking

We set one cookie, __Host-ue_session, when you sign in. It keeps you signed in, so it is strictly necessary. It lasts up to 30 days (12 hours for admin accounts) and is removed when you sign out. Neither site runs analytics, advertising or social media trackers, and we set no third-party cookies. Mollie's payment page is Mollie's own site, and its own privacy notice applies there.

Why we use it, and our lawful bases

  • To provide the service you signed up for (contract): your account, signing in, your plan, payments and API keys.
  • To answer you (legitimate interests, or contract when it's about your account): messages you send us.
  • To keep the service and its users safe (legitimate interests): rate limits, the account action log and technical logs, to stop abuse, fraud and attacks.
  • To meet our legal duties (legal obligation): keeping payment records for tax and accounting.

We don't sell your data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.

Who else handles it

  • Cloudflare hosts both sites, runs our code and stores our database and logs.
  • Resend: if we email you, for example to confirm your address or reset your password, the email is sent through Resend, which receives your email address and the message.
  • Mollie takes card payments when paid plans are available. It receives your email address from us, and the details you enter on its payment page.
  • Discord hosts a private channel where we're told a contact message is waiting. The notice says only which site and which topic; nothing you wrote is sent to it.

Cloudflare, Resend and Mollie each handle the data for us, under contract, and not for their own purposes. We'd also share data if the law required it, or to protect our users or the service.

International transfers

Cloudflare runs a global network, so your data may be handled in the United States and other countries outside the UK. Resend and Discord are based in the United States, and Mollie in the Netherlands. Where data leaves the UK, it's protected as UK law requires: by an adequacy decision (as for the Netherlands and the rest of the EEA, and for US companies certified under the UK Extension to the EU-US Data Privacy Framework), or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in our providers' data processing terms.

How long we keep it

  • Account data, including plan, key and account action records: while your account is open, and for 30 days after it is closed.
  • Payment and invoice records: six years from the payment, as UK tax and accounting rules require.
  • Messages you send us: two years from when you send them.
  • Technical logs: up to 30 days.
  • Rate-limit records: deleted once there have been no attempts from that address or account for 30 days.
  • Odds and line history isn't personal data.

Your rights

Under UK data protection law you have the right to:

  • get a copy of your personal data;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict how we use it;
  • object to our use of it where we rely on legitimate interests;
  • receive data you gave us in a portable format;
  • withdraw consent, where we rely on consent;
  • not be subject to decisions made solely by automated means that have legal or similarly significant effects.

To use any of them, use our contact page, choose Privacy request, and write from the email address on your account so we can match it. It's free, and we'll answer within the time the law sets, normally one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you live in the EU, you can also complain to your local data protection authority.

Children

ZippyOddsAPI isn't for anyone under 18, and we don't knowingly collect data about them. If we learn an account belongs to someone under 18, we close it.

Changes

When we change this policy, we update the date at the top of this page.