Privacy Policy

1. The Verodd iOS app

a) What lives on your device and in your own iCloud

Verodd is a local-first tracker. The following live in on-device storage and, if you have iCloud turned on, in your own private iCloud (Apple's CloudKit private database), which only you can access. We have no ability to read your iCloud:

• Your bets: stake amounts, odds, results, profit/loss, sportsbook names, and the events you bet on
• Your tax inputs: filing status, other income, resident state, deduction choices, and any W-2G figures you enter
• Your progress: grades, XP, streaks, and your Verodd Score

We never store a stake, a payout, a profit or loss, or a tax figure on our servers.

What does reach us, and only when a feature needs it. Grading a bet sends its game and your pick (section 1b). Opening a game on the Feed, or filling in a bet from one, sends the game, and it can name the sportsbook you use most. We don't keep the sportsbook it names. Marking a bet from its game's final score sends only the game. Both go with no sign-in (section 1b). To mark a bet that doesn't say when its game starts, the app first asks which game it is. That sends the sport, the teams, the game day if it has one, and when you placed the bet, with your install ID (section 1b). If you're signed in with Join the leaderboard on, a verified grade also sends the price you logged, and we keep the verdict, never the price (section 1c). AI import sends the slip you pick, stake and payout included, to be read, and we keep nothing from it (section 1d). Starting a post sends the bet's game and your pick, so we can find the game it would land on, and we keep none of it (section 1g). Searching for people or posts sends what you type, to answer that one search, and we keep none of it (section 1c). A pick you choose to post is kept, and it's public: the game, the side, the line, the price, its result, and in the app the sportsbook, unless you turn that off (section 1g). If you sign in and save an avatar, we keep your level, which sets the frames you can wear (section 1c). None of them keeps a stake, a payout, or a profit or loss.

You can erase all of it at any time from the app (You → the gear → Settings → Your data → Delete all my data). If you're signed in, that also deletes the verified results we hold for you, except the verdict on a pick you posted, which stays with the pick. A pick you posted stays public until you delete your account, and then it stays with your name taken off (section 1g). Deleting the app removes the copy on your phone; the copy in your iCloud stays until you erase it.

b) What the app sends us to verify a closing line

To independently grade a bet, the app asks our closing-line service for the historical market price of the game. It asks only about a bet our service can check, and only at these times:

• When you tap a Verify button, on a bet or for all the bets that need one. Before version 2.0.1, that button is "Verify my CLV", in History.
• When you import bets.
• By itself, from version 2.0.1. Once a game you bet on has started, the app asks about that bet when you open the app and each time you come back to it, until it finds the close or our service says it can't find it. It can also ask while History's Ungraded list is open, and with the app closed, at times iOS picks. An open bet with no game day is asked about once it's a day old, since the app can't tell when its game starts.

Each time, the app sends our service:

• The bet's event identity: sport, the two teams, the market type (e.g. moneyline / spread / total), the line, your pick, and the relevant timestamps. It can also say whether the time you placed the bet is exact, and whether its game has started, as far as the app can tell.
• A random ID for this install of the app (made on your phone and kept in its keychain), which we use to stop abuse and to limit how many lookups one install can make

This request does not include your name, email, account, stake, payout, or profit/loss. If you sign in, we also keep the install ID next to your account, so we know which phones are yours. It is never used to track you across other apps or websites. We keep a short log of these requests to stop abuse and to set each install's limit. It holds the install ID, never the bet, and it's deleted after 24 hours. We keep the odds we look up, with nothing about who asked: each closing line with its game, and the boards of prices and lists of games it came from, so we don't have to look them up again. Your internet address is used to deliver the request. We don't store it with the request, and our hosting providers' standard logs may keep it for a short time, for security.

Which game? When a bet names only one team, or its teams played each other twice around the time you placed it, the app can ask you which game it was. From version 2.0.3, it can also ask you this when no game turns up around the time you placed it, and then it lists the games from the week before you placed it. To list the games it could be, the app sends our service the sport, the team or teams, and when you placed the bet (and its game day, if it has one), with your install ID. Nothing else about the bet goes. It's logged like a lookup, by the install ID for 24 hours, and nothing else is kept from it.

From version 2.0.1, the app also asks this by itself. It asks about an open bet that names both teams but not when its game starts. It asks when you open the app and each time you come back to it, so it can mark the bet won, lost or pushed from its game's final score. It sends the same things, and it's logged the same way. If exactly one game fits, the app asks for that game's final score (below). If none fits, or more than one, the bet stays open.

A game's prices and its final score. When you open a game on the Feed before it starts, or track or post a bet from one, the app asks our service for that game's prices, so it can show them and fill in your side's line and price. For an open bet whose game the app knows, it asks for that game's final score, so it can mark the bet won, lost or pushed once the game is over. Each of these asks names the game, by its id or by its sport, its two teams and its start. An ask for a game's prices can also name the sportsbook you use most, so the app can show you that book's price, but only when it's one of these six licensed books: DraftKings, FanDuel, BetMGM, Caesars, BetRivers or Fanatics. These asks never send your bet, your side, your stake, or the price you took, and they carry no sign-in and no install ID. Like a page read without signing in, each is counted by a salted one-way hash of your internet address, kept two days (section 2), and nothing else is kept from it, not even the sportsbook it names.

c) If you opt into social features (Sign in with Apple)

Verodd's profile and verified-CLV leaderboard are entirely optional — the tracker works fully without an account. If you choose to join, you sign in with Apple, and we store on our backend:

• Your Apple relay email — the Hide-My-Email alias Apple provides. It is the account of record; we never see your real email unless you choose to share it with Apple's relay turned off.
• Your public handle, optional display name, and avatar choice (a generated, non-photo avatar — there is no photo upload).
• Your level, which sets the avatar frames you can wear. The app sends it each time you save an avatar, and it shows on your public page through the frame you wear.
• Your verified-CLV results: a closing-line "beat / missed" verdict, an edge figure (in basis points), the market family, the league, when the bet was graded, whether you entered it by hand or by AI import, and an opaque reference to the bet on your device. To mint that verdict, the app has to send us the price you logged — your odds, your pick, and the line — so our service can re-derive the edge against the closing line it looks up independently. Those prices are used for that one check and then discarded: they are never written to the stored record, which has no odds field at all, and they are never shown to anyone. What we keep holds no stake, payout, profit/loss, dollar amount, or raw odds, and grading never sends a stake or a payout. The app sends a verified result only while Join the leaderboard is on.
• Who you follow or block, who you mute, and any content you report (with the reason you select). Who you follow, and who follows you, shows on your profile to other members who are signed in, and the counts show on your public page.
• If you subscribe to Premium, a salted one-way hash of your subscription's ID, so one subscription opens the Premium splits for one account (section 1d).
• Your Apple sign-in ID, and a token from Apple that we use only to cut the Sign in with Apple link when you delete your account.
• The install ID of each phone you sign in on (section 1b), so we know which phones are yours.
• A record of each signed-in session, kept by our sign-in provider for security, with the internet address and the kind of device it started from.

Your profile page is on the open web. This is the part people are most often surprised by, so it is spelled out here rather than left to be discovered. The page exists as soon as you sign in: we start you with a handle we assign, like user49216307, and you can change it to your own right away (the first change away from a starter handle is free; after that, handle changes are limited to once every 30 days). Your handle, display name, and avatar are served on a public web page at verodd.com/u/your-handle. Anyone who has that link can open it. There is no login, and they do not need the Verodd app or an account of their own.

Signing in is how you join the leaderboard. The switch that controls it is called Join the leaderboard (You → the gear → Settings → Account), and it is already on when your account is created. The app tells you so right above the Sign in with Apple button. While the switch is on, your record is public too.

What your public page shows. Your handle, display name, and avatar, with a frame that shows your level. How many people follow you, and how many you follow. While Join the leaderboard is on, it also shows how many of your bets we have verified, from the first one; at 30 verified bets, your beat-the-close rate and how many of those bets you posted as picks; and a Verified Creator tag if you have one. The preview image that other sites show when your link is shared draws the same things. At 30 verified bets your row also appears on the in-app leaderboard of people who follow you. If you posted at least 8 in 10 of those bets as picks before their games, your record is also ranked on the Everyone board, which shows its top 100 to everyone signed in. A row on either board shows your rank, handle and avatar, your beat-the-close rate, how many verified bets it counts, and your average edge against the close. In the app, while the switch is on, anyone can also see how many of your verified bets beat the close, from the first one, which sports and markets you bet, and how many picks you have open, and Premium members can see your record by sport and by market. These pages ask search engines not to list them, which is not the same as private: holding the link is enough. The page never shows a stake, a payout, a profit or loss figure, or any dollar amount, and it never shows your email.

You can turn the switch off at any time, and accounts created before July 23, 2026 keep the off-by-default setting they signed up under. Turning it off takes your record off your page, your picks and the leaderboard at once. A page or link preview someone already loaded can show it for a few more minutes, and your own row on your own board waits for the next refresh, up to 15 minutes, which only you see. The identity part of the page stays until you delete your account or change your handle.

Searching for people and posts. The Feed has a search bar. It finds people by the start of their handle, or by the start of a word in their display name, and it finds posts by the words in them or by the game they are on. Finding people needs you to be signed in, because the list of members is not something a stranger should be able to walk through. Anyone can search posts, signed in or not, since every pick a search can return is already public.

What you type in search comes to us, and we never store it. It goes to our service to answer that one search, and that is all it is used for. It is not saved in our database, it is not in a log line, and it is never a usage-analytics event. We do count how many searches are made, so nobody can walk the member list letter by letter. A count is one row: who searched (your account while you are signed in, the random ID for this install of the app, or a salted one-way hash of the internet address the search came from), which minute, hour or day it falls in, and a number. It never holds what you typed. We delete these counts after two days. This is the same kind of short record we already keep to cap floods of comments, reactions, tails, posts and reports (section 6).

A search only shows what is already public. A person in the results shows what their page already shows: their handle, display name and avatar, with the frame that shows their level, and, while Join the leaderboard is on, their verified record. A post in the results is a pick that is already public. Search shows nobody anything they could not already see by opening the page.

Your handle and display name become findable by their first letters. Both are already public: your handle is on every pick you post, and your page at verodd.com/u/your-handle is on the open web. What changes is that someone signed in can reach you by typing the first few letters, instead of your whole handle. If you would rather not come up that way, turn off Let people find me in search (You → the gear → Settings → Privacy → Let people find me in search). It starts on, because your handle is public already. With it off, your handle and display name stay out of people results. Picks you posted stay public, so they can still come up when someone searches posts. Your handle typed in full still opens your page, because a handle is an address: that link works in any browser, and it is on every pick you posted.

When you share your profile link, we count how many people open it. Tapping Share in the app asks our backend for a short one-time tag and puts it in the link. Your phone sends us nothing else on that call. The tag is what lets us tell your shared links apart from everyone else's, so we can count how many different people have opened a link you shared. That count is the only thing the number is for: it unlocks a cosmetic finish on your avatar at 10, 35 and 85 different openers. We never store who those people are. Each opener is recorded as a salted one-way hash of their IP address and browser user-agent, which we cannot turn back into a person. The hash exists so the same person opening your link five times still counts once. Bots and link-preview scrapers are dropped before any of this runs, and you never see anything about an opener except the total.

You can delete your account and the data tied to it at any time from the app (You → the gear → Settings → Your data → Delete account). This erases from our backend your profile and level, verdicts, follows, mutes, blocks, reports, reactions and tails, push tokens and notification settings, the install IDs of your phones, your share tags and opener counts, and your Premium receipt's hash, takes down the public page, and revokes the Sign in with Apple link. Your posted picks and comments stay, with your name taken off, as section 1g explains. Your on-device bet history is kept (use "Delete all my data" to remove that too).

A few more things deleting your account does not erase, and we would rather say so than let you find out. A note you sent us from the in-app feedback box stays, with its email copy, so we can still act on what you told us. From that point it has no account on it, though it still carries the scrambled install code that section describes. The security key record for your phone (section 1d) stays too. If you want either one gone, email privacy@verodd.com and we will delete it. And we keep a short note that an account was deleted and when, with the account's random ID and whether the Sign in with Apple link was cut, as our record that we did what you asked. It has no name, email, or handle.

What we hold for 30 days when you give up a handle. This happens two ways: you delete your account, or you change your handle and keep the account. Either way we keep two small things about the handle you gave up: the handle itself, and a scrambled code made from your Apple sign-in ID. The scrambled code is not your Apple ID, and we cannot turn it back into one. It does two things, and both are only about you. One: it lets us answer a single question, is the person asking for this name the person who gave it up? Your old links point at your old handle, so if someone else grabbed it right away, those links would start pointing at them. So you can take your old handle back at any point in those 30 days. If you deleted, sign back in with the same Apple ID. If you changed your handle, just change it back. Two: it remembers when you last changed your handle. You can change a handle once every 30 days, and this is what keeps that limit in place even if you delete your account and sign back in. After 30 days we erase both, and the handle is free for anyone to take.

d) If you use AI bet-slip import (optional)

AI import lets you turn a screenshot of a bet slip into a tracked bet. It is opt-in and used only when you choose it. Here is exactly what happens:

• Your phone first reads the slip on-device (Apple's on-device text recognition). By default we send only the extracted text to our import service; we fall back to sending the image only when the text is low-confidence or the slip is a parlay we can't read from text alone.
• Our import service forwards that slip text (or image) to our AI provider, Anthropic (Claude), which returns the parsed fields (book, sport, market, selection, odds, stake, payout, result, date). You review those fields, and the resulting bet is saved on your device only. The text or picture goes as it is, and we add nothing about you, so if your screenshot shows your name or balance, crop it first.
• Verodd retains nothing from the slip. We do not store the screenshot, the extracted text, or the parsed stake, payout, or result on our servers. We keep only what stops abuse: a record of each scan, with your install ID and, if you're signed in, your account, kept 45 days to count your free scans; and the security key that proves a request came from our app on your phone. The key record holds your install ID, and your account once you save an avatar while signed in. It never holds your bets, and it stays until you ask us to delete it.
• If you subscribe, the import also carries a receipt from Apple. Premium raises how many imports you get each month, so our service has to confirm the subscription is real before it grants the higher allowance. Your app attaches the signed transaction Apple issued to your device (Apple's StoreKit "JWS"), and our service checks Apple's signature on it and reads only what that decision depends on: which app and product it was bought in, when it expires, whether it was refunded, whether it is family-shared, whether it is a real or sandbox purchase, when Apple signed it, and Apple's transaction id. It has no card number and no billing address; Apple never gives us those. It does list things like the price and the store's country, which our service doesn't read. The import keeps none of it: the check runs in memory on that one request, and the import writes nothing from the receipt to our database. If you are not a subscriber, no receipt is attached at all.
• If you subscribe, the same receipt opens the Premium splits, and for that we keep one thing. The splits are a member's record by sport and by market, and only Premium opens them. When you're signed in, the app sends your receipt each time it loads a record, yours or someone else's, and our service checks it the same way. The first time it checks out, we tie it to your account: we keep a salted one-way hash of your subscription's ID beside your account, and when we first saw it. That ID is the receipt's original transaction ID, which Apple keeps the same each time your subscription renews. The hash is a scrambled code made from it. We never keep the ID itself, and for the splits we keep no price, no plan, and no purchase date. It's there so one subscription opens the splits for one account, and a copy of your receipt can't open them on another. We keep it until you delete your account. Then it's deleted, and your subscription can open the splits on another account. Signed out, the app doesn't send your receipt when it loads a record. If you leave usage analytics on, the event for a purchase says whether you picked monthly or yearly (section 1e).

e) If you leave usage analytics on (you can turn them off)

To understand which features people use, the app can send a small, fixed set of feature-usage events (for example: app opened, import completed, tax estimator opened, paywall viewed, share card rendered). They go to us and no one else, and they contain no dollar amounts, no stakes or P&L, and no tax figures. Each one carries its name, your app version, and your region, with the random install ID from section 1b. Some say a little more, and each of those is named below. While you're signed in, they're tied to your account, because we keep that install ID next to your account (section 1c).

Picks the app can't post yet. When you tap a pick the app can't post yet (a parlay, a prop, a future, a fight, or a sport we don't cover yet), or our server turns one down for that reason, one event also says what kind of pick it was and its sport, like "parlay" and "NFL". That's all it says about the pick: never the teams, the side, the odds, the stake, or the result. It tells us what to build next.

Premium. A few events show us how people find Premium. They can name a screen, from this list: the paywall, Settings, the You tab, a profile page, the Feed, a game, a bet, a page you open from the Dashboard, and History. Opening a screen with Premium in it says which screen it was. When the paywall opens, its event also says which screen you opened it from, or that it opened for a purchase you started on the App Store. A tap on a locked part of a screen says which part it was, never what's under it. Starting a free trial says nothing more. A purchase says whether you picked monthly or yearly. It never says the price. They tell us which parts of Premium people want.

• EU / UK / EEA / Switzerland: analytics are off by default and run only if you opt in.
• Elsewhere: analytics are on by default and you can opt out at any time (You → the gear → Settings → Privacy). Turning it off also deletes what was collected from your install.

Region is determined from your device's locale setting, not from IP geolocation.

Stopping floods. So nobody can spam this, our server counts how many analytics requests come from one internet address per hour. To do that it stores a salted one-way hash of your IP address, never the address itself. For analytics, that counter sits in its own table with no event, no install ID, and no account in it, and it's deleted after 24 hours.

We use the same kind of hash to stop floods in a few other places. Most are kept apart the same way: AI import's security check (kept one hour), the Delete all my data request (kept 24 hours), and the count of reads that carry no sign-in (section 2, kept two days). Two are not kept apart, so we describe each one where it belongs: in-app feedback (the hash is stored on the feedback row itself, next to your message) and website email signups (section 2). We use these hashes only to stop floods, and we don't try to turn them back.

f) Permissions

The app asks for one permission, and only if you tap Turn on: notifications. It never asks for your location, contacts, photos, camera, or microphone, and there is no ATT ("ask app not to track") prompt because we don't track you. AI import uses the system photo picker, which needs no photo-library permission and hands the app only the single bet slip you pick. There is no camera feature anywhere in the app. Importing a CSV likewise uses the system file picker, which hands the app only the one file you choose.

Feature availability: AI import, usage analytics, the picks feed and notifications may not be enabled yet in your version of the app. The descriptions above apply if and when you use those features.

In-app feedback

If you send feedback from inside the app (the "Send feedback" option, or the "Could be better" reply after a rating prompt), we store one row on our backend (Supabase). Here is everything on it:

• The message you write.
• Your app version and iOS version, for troubleshooting.
• Which of the two places you sent it from (the feedback option, or the reply after a rating prompt).
• Your account, but only if you are signed in to an optional social account, so we can follow up. If you are not signed in, no account is attached.
• A salted one-way hash of the random per-install ID on your device, and a salted one-way hash of your IP address. Both exist for one reason: to stop one person flooding the box. They are scrambled codes, not the values themselves. We use them only to stop floods, and we don't try to turn them back.

Be aware of two things about those last two. Unlike the analytics counter described in section 1e, these two hashes are stored on the same row as your message, and as your account if you are signed in. And they are not deleted after 24 hours: they last as long as the feedback note itself. So feedback you send while signed in is not anonymous, and feedback you send signed out, while not tied to your name, is tied to a hash we could use to tell that two notes came from the same install. If you would rather we did not store that hash, the app's "Email us instead" option skips it, though of course your email address then identifies you.

We also email ourselves a copy. So we see a note quickly, we send a copy of it to our own inbox: your message, the app and iOS versions, where you sent it from, and your account if you're signed in (not the two hashes). It goes through Cloudflare's email service to our mailbox at Zoho, and it stays there until we delete it.

We use feedback only to fix problems and improve the app. We do not sell it, and you can ask us to delete it, with its email copy, anytime at privacy@verodd.com. Your bets, stakes, and money are never attached.

g) If you post a pick (optional)

Verodd has a feed where people post a pick before the game starts, so the call is on the record either way. Posting is off unless you do it, one pick at a time. The tracker is complete without ever posting, and nothing you have already logged gets posted for you.

Before you post, the app checks the game with us. When you pick a bet to post, the app sends our server the pick's sport, market and side, both team names, and the game's start time if the bet has one, with your sign-in, as the post does. Nothing else about the bet is sent. Our server answers with the game the pick would land on, so the post screen can show it to you before you tap Post pick. We use what the app sent for that one answer and keep none of it.

Here is exactly what a pick you post puts on our backend:

• The game (the sport and both team names), the market (moneyline, spread or total), the side and line you took, and the price you say you got.
• An optional caption you type, up to 140 characters.
• The sportsbook named on that bet in your tracker, if it is on our list of sportsbooks licensed in a US state. The name only, as plain text.
• The time you posted, stamped by our server and not by your phone, plus a reference to the bet on your device.

What is not on it, and this is the part worth reading twice. A posted pick carries no stake, no payout, and no profit or loss. Not hidden, not rounded: our database has no column for any of them, and an automated test fails if anyone adds one. The one price on a pick is the market price of that bet, which is a fact about a game. How much you put on it is never on the pick, and we never store it.

A posted pick names the sportsbook you bet at. The book on that bet in your tracker goes on the pick in the app as plain text, so people can see where the price came from. It is not on the pick's web page or on a picture you share. You see it on the pick before you post it. Only a sportsbook licensed in a US state is ever shown, and a name you typed yourself is never published. There is never a link to a sportsbook, never a promo code, and we take no money from any of them. You can turn this off at any time (You → the gear → Settings → Account → Show my sportsbook). Turning it off takes the book off every pick you posted, right away.

Two things about a posted pick are different from everything else in this policy, so we say them plainly. It is public: it appears in the app's feed and on a public page, and anyone with the link can read it without an account. And you cannot delete it. That is the whole point of the feature. A pick you post before kickoff grades itself against the final score, and if it loses, the loss stays. You can edit a pick before the game starts. The pick then shows it was edited, and we keep the earlier version. After the game starts, nothing about it changes except the result.

Around a pick, we also store what you choose to do with other people's:

• Comments you write, up to 280 characters, on your pick or someone else's. Like the pick, a comment is public: anyone who opens the pick can read it, with your handle and avatar, with or without an account. You can delete your own comment. We blank the text right away and remove the row after 30 days. If someone reported it, we keep a copy of its words with the report until then, so we can review the report.
• Reactions you leave: respect, fire or fade. One per pick, and you can take it back.
• When you tail a pick, which means you copy someone's pick into your own tracker, we record that you did it, and a reference to your copy of the bet on your phone. We never record at what size, and there is no link out to any sportsbook. Your own bet stays yours, at your book, at your amount.

The person whose pick it is may get a notification with your handle when you react to it or comment on it.

A profane caption or comment is refused before it is stored. You can report or block on any pick or comment, the same as on a profile.

What stays when you delete your account. Deleting your account removes your profile, your handle, your reactions and your tails, and takes down your public page. Your posted picks and comments stay, with your name taken off. They read as "a deleted member". We would rather tell you now than have you find out. What you post in public stays in public, and for a pick that is the whole point: a record anyone can erase after a bad month is not a record, and that is the only reason this feature is worth anything.

We don't tie what stays back to you. It has no handle, no avatar, no sportsbook, and no account on it. We'll keep it that way, and we won't try to work out who it came from. The words stay as they were typed, though, and a caption or a comment can say anything its writer put in it. So if one of yours says who you are, it still will. You can delete a comment first, before you delete your account. A caption can't be deleted, because it is part of the pick. One more thing: if you sign in again on the same phone with Join the leaderboard on, the app sends your verified results again, under the new account.

h) If you turn on notifications (optional)

You can ask the app to tell you when someone you follow posts, or when one of your picks grades. It is off until you turn it on, and we never ask at launch. While notifications are on, the app can also tell you when a check it ran with the app closed has verified some of your bets, and how many still need you. That notice comes from the app on your phone, so it sends us nothing.

When you turn it on, we store your push token, which is the address Apple gives your install so a notification can reach it, with your install ID. It is stored against your account for that one reason. We delete it when you sign out (from version 2.0) or delete your account, and we switch it off as soon as Apple tells us it is dead, or after 90 days unused. Turning notifications off doesn't delete it. We also store your notification settings: which kinds you want, the hours you would rather not be disturbed, and your device's time zone offset (how far your clock is from UTC), which is there so quiet hours land at your night and not ours. Each notification goes through Apple's push service, and we keep its words for 7 days after it goes out.

A notification from Verodd never contains a dollar amount, a stake, or a result before it is final. Reactions are off by default, and you can turn any of it back off in You, the gear, Settings, Notifications.

2. The verodd.com website

Email signup

Two forms on this site take an email address, and each one joins its own list. We only email you about the list you joined.

• The tax calculator's form joins our tax-season emails: a few a year about bettors' taxes, like when the books send W-2Gs, if the tax rules change, and before you file. They can tell you about the Verodd app, too.
• The home page's form joins the beta list: emails about the beta and new features, and a free code if you're a match.

For each list you join, we store your email address, plus the page source/referrer, your browser user-agent, and the time. We store this on our own infrastructure (Supabase); your email is not handed to a third-party email marketer. Your IP address is kept only as a scrambled code (a salted one-way hash), to stop floods of signups. To leave a list, email privacy@verodd.com and we'll take you off.

The tax calculator

The calculator runs entirely in your browser. The numbers you type never leave it.

Opening a shared profile link

Verodd users can share their public page as a verodd.com/u/ link. When the link carries the sharer's share tag, opening it stores one row on our backend: a salted one-way hash of your IP address and your browser user-agent, and which account's link it was. It is there to count distinct openers for that person and nothing else. We do not store your IP address, we cannot turn the hash back into you, and we never use it to profile you, to advertise, or to follow you anywhere else. The person whose link you opened is only ever shown a number, never anything about you. Bots and link-preview scrapers are excluded before the row is written. The row is kept for as long as that person's account exists and is deleted with it. If you would rather not be in the share count, open the plain verodd.com/u/their-handle address with no ?s= tag on the end.

Opening a public page

When you open a profile or pick page on verodd.com, or read the feed, a record, or comments in the app without signing in, our server counts how many pages come from your internet address, so no one can flood us. It keeps a salted one-way hash of the address, never the address itself, with a count and nothing else, and deletes it after two days. The plain link above is counted this way too. So are the app's asks for a game's prices or final score (section 1b), signed in or not, since they carry no sign-in. A search made without signing in is counted the same way, in the search counts section 1c describes.

Cookies & analytics

The site sets no cookies for advertising or analytics, and runs no cross-site trackers and no marketing pixels, so there is no cookie-consent banner to click through. Standard server/CDN logs (Cloudflare) may record requests (including IP and user-agent) for security and reliability for a limited period.

Visit counts (Cloudflare Web Analytics). To see how many people visit and how fast our pages load, the site runs Cloudflare's Web Analytics script. For each page view it sends Cloudflare the page you opened, the site that sent you there, your country, your browser, operating system and type of device, and how long the page took to load. It sets no cookies and stores nothing on your device, and Cloudflare says Web Analytics doesn't collect or use your personal data: it doesn't fingerprint you or follow you to other sites. We only ever see totals, never a person. Cloudflare keeps the full data for 7 days and then about one page view in ten, and we can see about six months of it.