Privacy policy

1. Who holds your information

the operator of StatPredict (TipOff) is the organisation responsible for personal information collected through StatPredict.

Contact: hello@tipoff.app.

2. What we collect

Account data: email address, password (stored by our auth provider as a hash, not as readable text), display name, helmet colour, referral codes, and timestamps for legal acceptance.

Play data: game sessions, inputs we need to score a run, scores, leaderboard rank, predictions, Social Coin and Pro Coin ledger entries, and whether a run was valid.

Payout data, if you ask to be paid: account name, BSB or equivalent bank code, account number, SWIFT/BIC, bank name, and country. Treat this as sensitive. Only use it if you want a cash prize.

Technical data: IP address, device and browser type, approximate location derived from IP, anti-abuse signals, human-verification tokens (such as Cloudflare Turnstile), rate-limit counters, and security flags.

Communications: emails you send us, and emails we send you about your account, prizes, or the Service.

We do not ask for full payment card numbers. If card checkout is enabled, the payment provider collects card data on their own forms.

We do not knowingly collect personal information from people under 18. If you believe a child has an account, email us and we will close it.

3. How we collect it

Directly from you when you sign up, play, buy coins, update Profile, or contact us.

Automatically when you use the Service (logs, sessions, verification widgets).

From payment and infrastructure providers that process a transaction or host the Service.

4. Why we use it

To create and secure your account, and to remember that you accepted these policies.

To run games, score runs on the server, operate Social and Pro leaderboards, and credit or debit wallets.

To take entry fees in coins, grant bonuses, and (where you win and are eligible) pay cash prizes.

To prevent bots, multi-accounting, fraud, and abuse, including review of perfect or unusual scores before cash is paid.

To send transactional email (confirmations, password reset, prize contact). Marketing email is optional and you can opt out.

To measure what is broken or popular, using aggregated or de-identified stats where we can.

To comply with law, enforce our Terms, and deal with disputes.

5. Legal basis and Australian Privacy Principles

We collect personal information that is reasonably necessary to provide StatPredict in Australia and other places we offer the Service.

If you do not give us account and play data, we cannot give you an account or a scored run. If you do not give payout details, we cannot pay you cash.

We will not sell your personal information.

6. Who we share it with

Hosting and database: Supabase and its infrastructure partners, to store accounts, sessions, and ledgers.

Email: our email provider (for example Resend) if we send transactional or alert mail.

Human verification: Cloudflare, if Turnstile is enabled, to tell us a request looks like a person.

Payments: the payment provider we use for Pro Coin or Social Coin packs, when checkout is live.

Admins of the Service, under access control, to score events, review cash claims, and support you.

Professional advisers, insurers, or authorities if required by law or to protect the Service.

A buyer of the business, if we sell or restructure, under a duty to handle information consistently with this policy.

Leaderboards are public. Other players can see your display name, helmet, and scores. They cannot see your email, bank details, or IP address.

7. Overseas disclosure

Our hosts and vendors may store or process information in Australia, the United States, the European Union, or other places where they operate. Where we disclose personal information overseas, we take reasonable steps so that the recipient handles it consistently with the Australian Privacy Principles, including by contract where appropriate.

8. Cookies and similar technology

We use cookies and similar storage to keep you logged in, remember settings (for example sound and onboarding), and run security checks.

Turnstile and similar tools may set their own cookies. Analytics cookies, if we add them later, will be described here or in an in-product notice.

You can block cookies in your browser. The Service may not work (in particular, login) if you block essential cookies.

9. Security and retention

We use HTTPS, access-controlled admin tools, hashed passwords via our auth provider, and server-side scoring so players cannot write their own results. No online service is perfectly secure.

We keep account and ledger records for as long as you have an account and for a reasonable period after, so we can run leaderboards, handle prize disputes, tax or accounting needs, and legal claims.

Security logs and rate-limit data are kept only as long as needed for abuse prevention.

When we delete an account, we remove or de-identify personal data we no longer need, except records we must keep (for example a completed cash payout).

10. Access, correction, and deletion

You can change your display name, helmet, and payout bank details in Profile.

You can reset your password from the login screen.

You may ask us for access to the personal information we hold about you, or to correct it, by emailing hello@tipoff.app from your account email. We may need to verify it is you.

You may ask us to delete your account. We will do so except where we must retain information (prize, fraud, accounting, or legal reasons).

If you have a complaint about privacy, email hello@tipoff.app. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

11. Changes

We may update this policy. The date at the top of the page is the current version. If the change is material, we will ask you to accept it in the app.