Privacy policy

Puntsmith is a registered business name operated by a sole trader in Victoria, Australia (ABN 46 416 164 526). "We" and "us" in this policy mean Puntsmith. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Questions or requests: support@puntsmith.com.au.

• Waitlist sign-ups: your email address, and anything you choose to tell us about which bookmakers you use, what you do with bonus bets now, and a promo or referral code.
• Your account: your email address, and the settings you choose: bookmakers you hold accounts with, bankroll and staking preferences, odds format, alert rules, and a Discord webhook address if you add one.
• Sign-in: one-time sign-in links and 6-digit codes (stored only in scrambled form, and they expire after 15 minutes), and for each signed-in session your IP address and browser type, kept with the session.
• Sign in with Google (if you choose it): Google tells us your email address, that it's verified, and an account ID that links your Google login to your Puntsmith account. We don't ask for your name, photo, contacts or any access to Gmail, Drive or other Google services. Google's sign-in tokens are stored encrypted. If you haven't been approved for the beta yet, trying to sign in with Google adds your email to the waitlist, and we ask the waitlist questions when you first sign in. You can remove Puntsmith's access any time in your Google Account (Security → Third-party connections), and still sign in by email.
• Discord private-message alerts (if you choose them): when you click Connect Discord, Discord tells us your Discord user ID and username, and we use a one-time permission to add you to the Puntsmith Discord server so our bot can message you. We don't keep Discord's sign-in token, and we can't see your messages, email address or other servers. Disconnect any time on the Alerts page; you can leave the server yourself in Discord.
• Usage: which pages of the app you open and when, so we can see what's useful during the beta. We don't record what you type, your bets, or your bookmaker accounts.
• Feedback you send us through the app or by email.
• Abuse protection: short-lived counters keyed by IP address or email address, used to limit repeated sign-in, waitlist and feedback requests. They're cleared after about a day.

We never ask for your bookmaker logins, passwords, or payment card details. When paid plans start, payments will be handled by Stripe, and we'll update this policy first.

• To run the service: sign you in, remember your settings, and show results for your bookmakers.
• To send emails you've asked for: sign-in links, beta invites, and alerts you set up.
• To manage the beta: invite people from the waitlist and see which features get used.
• To keep the service secure and stop spam and abuse.
• To answer your questions and act on feedback.

We don't use your information for advertising, we don't sell or rent it, and we don't send you marketing email without your permission.

We use one essential cookie to keep you signed in. Your light or dark theme choice is saved in your browser. There are no advertising or third-party tracking cookies.

We use these providers to run Puntsmith. They process information only to provide their service to us:

• Vercel (website hosting, Sydney region; United States company)
• Turso (database, Sydney region)
• Fly.io (background price checker, Sydney region; it doesn't receive your details except to send your alerts)
• Resend (sending emails; may process data in Japan and the United States)
• Cloudflare (domain and email forwarding; United States company)
• Google (sign-in with Google, if you use it; and our support inbox, where emails to our addresses are delivered)
• Discord, only if you connect Discord or add a webhook: alerts are sent as private messages from our bot, or to your own Discord channel

Because some of these providers are overseas or store data overseas, your information may be held or accessed in the United States or Japan. We choose providers with strong security practices. We may also disclose information if the law requires it.

• Account information: while you have an account. Ask us and we'll delete it.
• Waitlist entries: until you're invited and join, or you ask us to remove you.
• Usage records and feedback: while they're useful for improving the service, and no longer than your account.
• Sign-in links: 15 minutes. Sessions: 30 days. Abuse-protection counters: about a day.

Information is sent over encrypted connections (HTTPS) and stored with providers that encrypt data at rest. Sign-in uses one-time email links and codes, so there's no password to steal, and repeated requests are rate-limited. No system is perfectly secure; if a data breach is likely to cause you serious harm, we'll tell you and take the steps the law requires.

Email support@puntsmith.com.au to see the information we hold about you, correct it, or have your account and information deleted. We'll respond within 30 days. You can change your settings and remove a Discord webhook yourself in the app.

If you have a concern about how we've handled your information, email support@puntsmith.com.au. We'll look into it and reply within 30 days.

Puntsmith is for people aged 18 and over. We don't knowingly collect information from anyone under 18; if we find we have, we'll delete it.

We'll update this policy when what we collect or how we use it changes, and change the date at the top. If a change is significant, we'll tell account holders by email. See also our terms of use.