Privacy Policy

1. Who we are

OddsOut is a mobile application designed to support people recovering from gambling addiction (sports betting, casino, crypto trading, poker). This Privacy Policy explains what personal data we collect, why we collect it, and what rights you have over it.

This app is operated by Diogo Alexandre de Freitas Dias Ipolliti Carrelhas, based in Lisbon, Portugal. For any privacy-related question, contact [email protected].

2. What data we collect

2.1 Account information

• Email address — to identify your account and send password resets
• Password — stored only as a one-way hash by Firebase Authentication; we never see it in plain text
• Display name or pseudonym — what other community members see

2.2 Recovery profile (you provide during onboarding)

• Date of birth — to confirm you are 18+ (legal requirement for an addiction recovery service)
• Country — to localise currency, language, and helpline numbers
• Type of addiction (sports betting, casino, etc.) — to personalise content
• Quit date and approximate weekly spend — to compute your streak and money-saved progress
• Quiz score and selected symptoms — to estimate your dependency level for personalised guidance

2.3 Sensitive recovery data

• Journal entries — your reflections about your recovery. These are encrypted on your device using a per-user key stored in your phone's secure enclave (iOS Keychain / Android Keystore) before being sent to our servers. Even if our database were compromised, the entries would remain unreadable.
• Mood check-ins, urges logged, recovery tools used — to track your progress over time
• Financial goals — money you set aside as a result of not gambling

2.4 Community data (only if you participate)

• Forum posts and replies — under your chosen pseudonym
• Direct messages with your "Battle Buddy" recovery partner — only the two of you can read these
• Group memberships

2.5 Technical data

• Device language and locale — to choose your initial app language
• Notification preferences and times — stored locally on your device
• Crash reports via Sentry — anonymised stack traces, no personal data attached

3. Why we use this data (legal basis under GDPR)

• Performance of contract (Art. 6(1)(b) GDPR): account, recovery profile, journal, progress tracking — these are core to delivering the service you signed up for
• Explicit consent (Art. 9(2)(a) GDPR): processing of health-related data (addiction symptoms, mood) requires your explicit consent, which you provide during signup. You can withdraw at any time by deleting your account.
• Legitimate interest (Art. 6(1)(f) GDPR): crash reports and technical diagnostics, to keep the app working

4. Where your data is stored

Your data is stored by Google Firebase (Firestore database, Authentication, Cloud Storage) on Google Cloud servers located in the European Union or the United States, depending on availability. Google is GDPR-compliant and certified under the EU-US Data Privacy Framework.

Subscription and payment data is processed by Apple (App Store) or Google (Play Store) and validated through RevenueCat. We never see or store your payment card details.

Crash reports are sent to Sentry, with personal identifiers stripped.

5. How long we keep it

• Account and recovery data: as long as your account is active
• After account deletion: all your personal data is permanently erased within 30 days. Forum posts and replies you authored are anonymised (your name and ID replaced by "Former member") so the community thread context is preserved without identifying you. Your journal encryption key is wiped from your device, making any residual ciphertext mathematically unrecoverable.
• Backups: may retain anonymised data for up to 90 days for disaster recovery

6. Your rights under GDPR

You have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct any inaccurate data through Settings or by contacting us
• Erasure — delete your account at any time via Settings → Delete Account. The deletion is immediate and irreversible.
• Data portability — request your data in a machine-readable format
• Restriction of processing — pause processing while we resolve a dispute
• Objection — object to processing based on legitimate interest
• Withdraw consent — for any consent-based processing, at any time
• Lodge a complaint with your national data protection authority. In Portugal: CNPD.

To exercise any of these rights, email [email protected]. We respond within 30 days.

7. Data sharing

We do not sell your data to anyone. We share data only with:

• Service providers who help us run the app (Google Firebase, RevenueCat, Sentry, Anthropic, Apple, Google) — each bound by confidentiality and data-protection agreements. Anthropic processes Guardian chat messages solely to generate responses; they are never used for advertising or model training under our agreement
• Legal authorities if required by court order or to prevent imminent harm to a person

We do not share your data with advertisers, analytics brokers, or any third party for marketing.

8. Children

OddsOut is intended for users aged 18 and older. We verify age during onboarding. If we discover that we have collected data from a minor, we will delete it immediately. If you believe a minor has registered, please contact [email protected].

9. Security

• All data in transit is encrypted with TLS 1.2+
• Journal entries are additionally encrypted at rest with a per-user key stored in your phone's secure enclave
• Firestore security rules enforce that only you can read or modify your own data
• Passwords are stored as cryptographic hashes by Firebase Authentication — we never see them

No system is 100% secure. If we ever discover a breach affecting your data, we will notify you and the relevant authority within 72 hours, as required by GDPR.

10. Changes to this policy

We may update this policy as the app evolves. Material changes will be notified through the app and by email. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For any question, request, or complaint regarding this Privacy Policy or your personal data:
Email: [email protected]