Privacy
Last updated 4 October 2026
We keep as little about you as we can. You don't need to give us your name, email address or a password to use oddssea.
What we store
| Account | Your account number and API keys, stored only in a one-way scrambled (hashed) form, so we can check them but not read them back. The names you give your keys, and when they were created and last used. |
|---|---|
| API use | How your account and each of its keys use the API, counted per hour: requests by endpoint, sport and result (answered, refused, over a limit), data sent, how long we took to answer, which options you use, and for each stream connection when it started and ended and how much it sent. Also how many different networks a key was used from each day, counted as one-way hashes that change every day, so the networks themselves are never known or kept. We use this to run the limits, help you when something goes wrong, plan capacity, and enforce the terms (keys aren't for sharing). It's never sold or shared. |
| Account events | When the account was created and signed in to, when keys were made or revoked, checkouts started and payments. |
| Sign-ins | When your account last signed in, and its sign-in sessions (also hashed). |
| Payments | For each payment: the plan, term, amount, the coin you paid with, its status, the country (and VAT id, if you give one) you enter at checkout, and the country your connection came from at that moment (not the address itself). Tax law needs this evidence of where a customer is. |
| Only if you add one: used for reminders before your paid time runs out and to help you back in if you lose your account number. Nothing else, never shared, never used for marketing. |
What we don't store
- No access logs of who requested what. Your IP address is used in memory only, to limit abuse (for example how many accounts one address can create, or failed sign-in attempts), and is forgotten within a day.
- No advertising, and no tracking by other companies. This site loads nothing from other companies: fonts, scripts and images are all served by us.
- No card details: card payments, when we add them, go directly to the payment provider.
How we count visits
To know which pages are useful and where visitors come from, our own server counts visits, without cookies and without storing anything that identifies you:
- Page views per hour, by page, the site that linked to us (its domain only), campaign tags in the link (
utm_source,utm_campaign), your country, device type (desktop, mobile, tablet) and browser family. - Your country is looked up from your IP address on our own server and only the country is kept. IP geolocation by DB-IP.
- Unique visitors: a one-way hash of your address and browser under a secret that changes every month and is then destroyed. Repeat visits within a month count once; you can't be followed from one month to the next. The hashes are deleted after 95 days.
- Clicks on a few buttons (such as "Get API key" and the pricing choices) and use of the odds board (which sport or view is opened), counted, not tied to you.
Automated traffic is counted separately, so it doesn't inflate the numbers: crawlers that say who they are (by their name), and requests from data-centre networks (we look up which network an address belongs to with DB-IP, and keep only whether it's a data centre). Nothing of this is shared with anyone.
Cookies and browser storage
oddssea_s | Keeps you signed in on the odds board and the account page (30 days). Can't be read by scripts. |
|---|---|
oddssea_hint | Only your plan's name, so every page's top bar can show whether you're signed in (30 days). Contains nothing secret. |
oddssea_theme | Light or dark, if you choose one, so every page of oddssea.dev uses it (a year). |
| Local storage | Your choices on the odds board (theme, odds format, time zone, watchlist and the like). Stays in your browser; we never see it. |
All of these are needed for the site to work; there are no others, so there's nothing to consent to.
Who else handles your data
- Hosting: our servers are in the European Union.
- Payments: crypto payments are processed by NOWPayments, which sees what's needed to process the payment (the amount, the coin and the paying wallet), under its own privacy policy. We receive the payment's status and amount.
- Email: if you add an address, the email service we use to send reminders will handle it.
We don't sell or share data with anyone else.
How long we keep it
Account data for as long as the account exists. Payment records for as long as accounting law requires. Sign-in sessions end after 30 days. Hourly usage and visit counts for 90 days; after that only daily totals.
You can delete your account at any time on the account page. It's deleted at once: the account number, keys, sign-ins, email and key names are removed, and your usage history is either deleted or folded into anonymous totals. Payment records are kept as accounting law requires, without any link to you. Free accounts that haven't been signed in to or used for 12 months, and never paid, are deleted automatically.
Your rights
Under the GDPR you can ask what we hold about you, have it corrected or deleted, or take it with you. To delete your account, use the button on the account page. For anything else, or if you've lost your account number, write to hello@oddssea.dev from the email on your account, or include your account number's last four characters and one of your API key prefixes so we can find the account. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).
Changes
If this policy changes in a way that matters, we'll update the date above and, if you've added an email address, tell you.