Privacy Policy

Effective date: 4 May 2026 · Last updated: 15 October 2026 · Version 2.10-2026-10-15

This is the same text you accept in the OddsOut app, which also shows it in Portuguese, Spanish, French, German and Italian.

Português · Español · Français · Deutsch · Italiano

OddsOut is a mobile app that supports people recovering from gambling — sports betting, casino, crypto trading or poker. OddsOut is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data, and what rights you have over it, in compliance with the General Data Protection Regulation (GDPR). The controller of your data is OddsOut, Lda (NIPC 519558456), with its registered office in Funchal, Portugal, which you can contact at support@oddsout.app. This policy also covers our website, oddsout.app.

1. Data We Collect

We collect the following data to provide our services:

• Email address (for account creation and communication)
• Password — stored by Firebase Authentication only as an irreversible hash; we never see it
• Name or pseudonym (display purposes only)
• Country (to adapt the currency and the helplines to your country)
• Recovery start date and weekly gambling data (for progress tracking)
• Journal entries (private, stored securely in your account)
• Your plan for hard days (optional) — your warning signs, what you do first, places with people around, professionals you trust, your reason for stopping and the "doors you've closed" that you tick (for example, a gambling block on your card). We never ask which bank you use, or for any card or account number. The people you can call from the plan are your emergency contacts, which stay on your phone only and are never sent to us.
• Urge log entries (private, used for pattern analysis)
• Relapses you log — what happened, how much you bet and how you felt (private)
• Initial quiz answers and selected symptoms (to personalise the app)
• Daily mood check-ins (optional)
• Financial goals — the money you set aside by not gambling
• Content you post in the community — posts, replies and group messages, under a pseudonym — and the groups you belong to
• Photos you send in a group — before anyone sees them, the server removes their location and other hidden image data and checks them automatically; photos that don't pass are deleted
• Links you share in the Forum — the address and the page title — and the posts you save
• Who you follow in the Forum (no one sees who follows them) and your mentorships — who you asked for guidance, or who you guide — with the messages exchanged in the mentorship, which only the two of you see
• Messages with your recovery companion — in the app, only the two of you can see them
• If you post a card in the Square to find a companion: your pseudonym, your day count, the note you write and your invite code — visible to anyone who uses the app
• If you apply as a provider: professional name, credential and contact email
• App usage data (anonymous, for improving the service)
• Your device's language (to choose the app's starting language)
• Booking data with directory providers (pseudonym, dates and messages exchanged) — visible to the provider you choose
• The two declarations made at sign-up — that you are 18 or older, and that the information you entered is true — with the date and time each was made
• If you buy the subscription: the store country, the product, the price and the purchase identifier, for invoicing
• If you buy on the website: also your name or company name, tax number, address and country for the invoice, and the country of your IP address at the time of purchase — one of the proofs of country that EU VAT rules require
• If you choose a trusted person at a distance: an identifier for them, a summary that recognises their phone (a small file, a cookie, is kept in their browser just for this) and, when you ask them for a code, a summary of that code for 10 minutes. Never their phone number or email. It is deleted when you remove them or delete your account.
• When you visit the website oddsout.app: it uses no cookies, no analytics tools and no advertising pixels. Cloudflare, which serves the site, briefly processes technical request data — IP address, browser and the page requested — to protect it against abuse.
• If you ask for the first-week guide on the website: your email address, used only to ask you to confirm and, once you do, to send the guide — once. There is no mailing list. The address is deleted as soon as the guide goes out or, if you never confirm, within three days. To prevent abuse we keep, for one hour, a fingerprint of the address that cannot be turned back into it.

We do NOT collect payment card data — all payments are processed by Apple or Google.

2. How We Use Your Data

Your data is used exclusively to:

• Operate and personalise the OddsOut app
• Calculate your recovery progress
• Send motivational push notifications (if enabled)
• Let you know about news in the community — companion requests, messages and Forum replies (if enabled). For this we keep in your account a notification identifier for this phone, together with the app language — it is used for nothing else and is removed when you sign out — and the choices you made for these notifications. Your other notification preferences and times stay on your phone only.
• Improve app features based on anonymous usage patterns

We never sell your data to third parties. We never use your data for advertising.

The two sign-up declarations are kept for two reasons: to meet our legal obligation not to provide the service to minors, and because they are the basis of any decision to close an account (section 3 of the Terms). They are used for nothing else and shared with no one.

3. Legal Bases (GDPR)

The GDPR requires a legal basis for each use of your data. Ours are these:

• Performance of a contract (Art. 6(1)(b)): your account, recovery profile, journal and progress tracking — they are the core of the service you subscribed to.
• Explicit consent (Art. 9(2)(a)): health-related data, such as symptoms and mood. You give this consent at sign-up, separately from the Terms, and you can withdraw it at any time by deleting your account. Sharing with a professional from the directory has its own consent — see section 7.
• Legitimate interest (Art. 6(1)(f)): error reports and technical diagnostics, to keep the app working. The same basis covers the technical data of website visits, used to protect the site against abuse.
• Consent (Art. 6(1)(a)): the first-week guide you ask for on the website — you confirm it by email, and it is sent only once.
• Legal obligation (Art. 6(1)(c)): invoicing records, which tax law requires us to issue and keep, and the two sign-up declarations (see section 2).

4. The App Blocker

The blocker only works if you turn it on. It works differently on each system, and on neither of them do we find out which apps you chose.

• On iPhone and iPad we use Apple's own Screen Time (Family Controls). You choose the apps in Apple's picker and it is iOS that covers them. OddsOut never receives their names — only how many you chose. Your choice is stored by iOS, not by us.
• On Android, the app checks which application is in the foreground, so it can cover the ones you chose. That check happens entirely on your device: the name of the app in the foreground is never sent to us, never kept on our servers and never used for advertising.

On neither system do we collect the list of apps installed on your phone.

You can turn the blocker off in the app whenever you want and, on Android, withdraw the permissions it relies on in your phone's settings (usage access, and permission to draw over other apps).

If you choose a trusted person at a distance, what we keep about them is set out in section 1.

5. Data Storage & Security

All data is stored securely using Google Firebase (Firestore), a GDPR-compliant cloud service. Journal entries and sensitive recovery data are protected by strict Firestore security rules — only you can access your own data.

Journal entries and your plan for hard days are encrypted on your device before being stored. The key is kept in your account too, so you can open them on any phone where you sign in. No one at OddsOut reads them. Your other recovery data is protected by strict access rules, but, as with any service, the technical team can access it to operate and support the app.

In addition:

• Everything that travels between the app and our servers is encrypted (TLS 1.2 or higher).
• The journal key is also kept in your phone's secure vault (Keychain on iOS, Keystore on Android). That same vault holds a copy of your plan for hard days, so SOS can show it straight away, even without a connection.

No system is 100% secure. If we ever detect a breach that affects your data, we will notify the competent authority within 72 hours, as the GDPR requires, and let you know without delay.

6. Who We Share Your Data With

We never sell your data. We never use it for advertising. The app has no tracking pixel and no advertising SDK.

This is the complete list of who receives anything, and what:

• Google Firebase (European Union; Google's sign-in service may process data outside the EU) — where the app lives: your account, your progress and what you post in the community. Journal entries and your plan for hard days arrive there already encrypted by your device.
• Google Cloud Vision (European Union) — only the photos you send in a group, already without their location, to check that they don't show betting, casinos or inappropriate content. It doesn't receive your name or anything about your recovery.
• RevenueCat (United States) — the state of your subscription, identified by an account code. It does not receive your email, your journal, or anything about your recovery.
• Apple and Google — the subscription payment. We never see your card details, and they receive nothing about your recovery.
• Sentry (European Union) — error reports when the app fails: device model, app version and the screen where the failure happened. By our own decision, these reports carry no account identifier — they cannot be linked back to you.
• Expo (United States) — app updates, and the delivery of community notifications. For a notification it receives this phone's notification identifier and a fixed message such as "You have a new message from your companion" — never the text of the message, the name of who wrote it, or anything about your recovery. Expo passes it to Apple or Google, who deliver it to your phone.
• Resend (United States, sending from Ireland) — your account emails — confirming your email and choosing a new password — and the first-week guide you ask for on the website. It receives your email address and the message text, and nothing about your recovery.
• Cloudflare (United States, with servers around the world) — serves the website oddsout.app and the pages where these documents are published. It briefly processes technical request data (IP address, browser, page requested), and nothing about your recovery.
• Next Move — the certified invoicing software that issues the invoices. It receives the invoice details, and nothing about your recovery.
• ipinfo.io — tells us the country of an IP address, only for purchases made on the website.
• European Commission (VIES) — confirms VAT numbers, only when a company buys on the website.
• The professional you choose, and only if you book a session — see section 7.
• The authorities, if a court order requires it or to prevent imminent harm to a person.

What stays private:

• The content of your journal. It is encrypted on your device before being stored in your account. The key is kept in your account too, so you can open your journal on any phone where you sign in. No one at OddsOut reads it, and we never share it with anyone.
• Your plan for hard days. Like your journal, it is encrypted on your device before being stored in your account. No one at OddsOut reads it, and we never share it with anyone.
• Your conversations with Odd. They stay on your phone and are not sent to any artificial-intelligence provider, nor to our servers.

When one of these services is outside the European Union, the transfer is made with the safeguards the GDPR requires — the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

Each of these services has its own privacy policy and its own GDPR obligations, and all of them act on our behalf and under our instructions.

7. The Professional You Choose

The professional directory is the only part of the app where your data can reach a person outside OddsOut. Nothing happens unless you book a session yourself.

When you book, the professional can see:

• Your pseudonym, the date, the time, the duration and the modality (video or in person).
• An account code, which does not say your name.
• Whatever you write to them in the in-app conversation.
• The notes they take about you themselves, as any professional does. Those notes are their responsibility and are governed by their professional obligations, not ours.

What the professional cannot see:

• Your journal or your plan for hard days. Not encrypted, not decrypted, not any part of them.
• Your days without gambling, the money saved, your milestones, the intake questionnaire, your mood check-ins, or what you post in the community.
• Your email or your real name, unless you tell them yourself.

This is a separate consent, and that is deliberate. Article 9 of the GDPR treats health data as a special category and requires specific, explicit consent — sitting at the end of a long text does not count. We ask you at the moment you book, for that specific professional.

You can withdraw it whenever you want. Withdrawing prevents future sharing; it does not erase what that professional already received — you ask them directly for that, as they are the ones answerable for those notes. Booking nothing takes nothing away from the rest of the app.

Beyond this, we do not share data with anyone else for purposes not described in this policy. If we ever want to, we will ask you separately, it will be your choice, and saying no will cost you nothing — the app keeps working exactly the same.

8. Data Retention

Your data is retained for as long as you maintain an active account. When you delete your account, all personal data is permanently deleted within 30 days, with two exceptions: the messages you sent to your companion stay in their conversation, no longer linked to an account and showing only your pseudonym; and community reports are kept as evidence of moderation. Your journal and its key are deleted from your account and from your phone. Your plan for hard days also leaves your account, and the copy on your phone is deleted when you delete your account or sign out.

Invoicing records are the exception: tax law requires us to keep them for 10 years from the end of the year of purchase, even after you delete your account. They are kept separate from your recovery data, limited to what the law requires, and every access is logged.

Anonymous community posts may be retained in anonymised form: in the posts and replies you wrote in the Forum, your name and your identifier are replaced with a "former member" label, so the conversation still makes sense without identifying you.

Private notes a directory provider keeps about you are the provider's responsibility and are deleted when you delete your account.

The sign-up declarations are kept for as long as the account exists and are deleted with it. They are written once and cannot be changed afterwards — not by you, and not by us through the app.

9. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data — ask for a copy of everything we hold about you
• Correct inaccurate data
• Delete your account and all associated data
• Export your data, in a machine-readable format
• Restrict processing while we resolve a disagreement
• Object to processing based on legitimate interest
• Withdraw consent at any time
• Lodge a complaint with the data protection authority in your country — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados)

To exercise these rights, you can delete your account directly from Settings, or contact us at support@oddsout.app. Deleting your account in Settings is immediate and cannot be undone. We respond to requests within 30 days.

10. Minors

OddsOut is intended for people aged 18 and over. At sign-up we ask for a declaration; we do not collect your date of birth and have no way of verifying anyone's age. If we discover that we have collected data from a minor, we close the account and delete the data immediately. If you think a minor has signed up, write to us at support@oddsout.app.

11. Changes to This Policy

We may update this policy as the app evolves. When it changes, the app shows you the new text and asks you to read and accept it before you continue. The "Last updated" date at the top shows the most recent revision.

12. Contact

For any question, request or complaint about privacy or your personal data, contact us at: OddsOut, Lda · NIPC 519558456 · Funchal, Portugal support@oddsout.app

Version 2.10-2026-10-15 — 15 October 2026