Privacy Policy
Version 2026-09-25. We collect as little as the service needs.
Controller
Operator details are published here before public launch.
What we keep, and why
| Data | Purpose | Legal basis (GDPR) | Kept |
|---|---|---|---|
| Email address | Your account and sign-in | Contract, Art. 6(1)(b) | Until you delete the account |
| Password (one-way hash only) | Sign-in | Contract, Art. 6(1)(b) | Until you delete the account |
| Sign-in sessions (token hash, start, expiry) | Keeping you signed in | Contract, Art. 6(1)(b) | Up to 30 days, or until sign-out |
| Account dates, plan, failed sign-in count | Running the account; protecting it against password guessing | Contract; legitimate interest in security, Art. 6(1)(f) | Until you delete the account |
| Terms version accepted and 18+ confirmation time | Showing that you accepted the terms and confirmed your age | Legitimate interest, Art. 6(1)(f) | Until you delete the account |
| Last active day (the date only) | Counting how many people use ODDSXI, without tracking what they do | Legitimate interest, Art. 6(1)(f) | Until you delete the account |
| Feedback messages you send | Improving the service | Legitimate interest, Art. 6(1)(f) | Until you delete the account |
| Premium waitlist entry | Telling you when Premium opens | Consent, Art. 6(1)(a); withdraw by leaving the waitlist | Until you leave it or delete the account |
We do not collect payment data, location, contacts, or your browsing history. We do not sell or share personal data, show personalised advertising, or use third-party analytics or tracking. Hosting may keep short technical logs (such as IP addresses) for security; these are deleted within 30 days.
Cookies
ODDSXI sets one cookie, oddsxi_session, only when you sign in. It keeps you signed in, cannot be read by page scripts, and expires after 30 days or when you sign out. It is strictly necessary for the service you ask for, so no consent banner is needed. There are no advertising, analytics or third-party cookies. Fonts are served from ODDSXI itself.
Where the data is
Data is stored in the European Economic Area. We do not transfer it outside the EEA. Backups are overwritten within 30 days, so deleted data leaves them within that time.
Your rights
- Access and portability: download all your data from the account page.
- Erasure: delete your account on the account page; it is erased at once.
- Rectification, restriction, objection, withdrawal of consent: contact us; we answer within one month.
- Complaint: you can complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or the authority of your country.
Age
ODDSXI is for people aged 18 or over. We do not knowingly keep data about minors.