Privacy Policy

FakeBet (the "Service", accessible at https://fakebet.fun) is a free sports betting simulator. No real money is wagered, no real money is paid out, and no real betting takes place. The Service exists for entertainment and education. This Privacy Policy explains what data we process when you use the Service and what rights you have over that data.

The Service is operated by an independent maintainer based in the European Union. We deliberately do not publish a personal identity or contact email so the project can keep its hobby/portfolio character. You can reach us at any time via the in-app feedback widget (the bug icon in the bottom-left corner of the home page), which is the canonical privacy contact channel for the purposes of GDPR Article 13(1)(b).

• Account data. Email address (email signup) or Google profile data (Google sign-in: email, display name, profile picture URL) — only what Google shares with the app. A unique user ID issued by our auth provider (Supabase).
• Profile. The username you pick (3–20 lowercase characters, public on the leaderboard if you bet in ranked mode), and your two virtual balances (ranked $1,000, casual $100,000 starters).
• Betting history. Virtual bets you place — event, market, stake, odds, outcome, and whether the bet was placed in ranked or casual mode. None of this represents real money.
• Technical data. IP address, user-agent, and request logs handled by our hosting provider (Vercel) and our auth provider (Supabase) for security, abuse prevention, and routine operation. Retained briefly per their respective policies.
• Push notification subscriptions. Only if you explicitly turn notifications on. Your browser issues a subscription and we store it: the push-service endpoint URL that identifies your specific browser installation, the two encryption keys that let only that browser read our messages, the user-agent string of the device you subscribed from, and the timestamps of subscription and last use. You can revoke this at any time from Settings or in your browser's site permissions; revoking deletes the record.
• Cookies. Strictly essential authentication cookies set by Supabase Auth (chunked sb-...-auth-token), one essential cookie that remembers you confirmed you are 18 or older (fakebet_18plus), one functional cookie that remembers the theme you picked (fakebet_theme), and a small number of functional flags in localStorage (e.g. your preferred mode, dismissed banners). No advertising or cross-site tracking cookies.

• Authenticate you and keep you signed in.
• Show your bet history, your stats, your achievements, and (if you opt into ranked mode) your standing on the public leaderboard. Your username and your profile picture are visible to other users — both appear on the public leaderboards and on your public profile page, and both are readable without signing in. Your email address and your balances are never published.
• Operate the Service — settle bets when sport scores come in, credit balances, refund stale pending bets, send Realtime updates to your own session.
• Investigate abuse, security incidents, and bug reports you submit via the feedback widget.
• Send you push notifications, but only if you turned them on — things like a bet settling, an achievement unlocking, or a match you bet on starting. We never use push for advertising, and turning it off stops it completely.

Legal basis under GDPR Article 6: performance of contract (running the account), legitimate interest (security, abuse prevention, service improvement), and consent for push notifications specifically — which is why they are off until you switch them on, and why switching them off withdraws that consent and deletes the subscription.

We do not sell your data and we do not share it with advertisers. The Service is built on a small number of sub-processors who handle data on our behalf under their own terms:

• Supabase (auth + database hosting) — stores your account, profile, and bet history. Supabase privacy policy.
• Vercel (web hosting) — handles request logs, CDN, and edge functions. Vercel privacy policy.
• Google — in two distinct roles, and the second one applies to everybody. Sign-in: if you use Google to sign in, Google performs the OAuth handshake and shares your email and display name with us. Profile pictures: avatars are served from Google's image CDN (googleusercontent.com) and are fetched by your browser directly. That means Google receives your IP address, browser user-agent and the referring page on any page showing an avatar — a leaderboard or a profile — whether or not you have an account with us.
• Sports and market data providers — Highlightly (current) and The Odds API (previous) supply schedules, scores and odds; public Polymarket data supplies prediction-market questions and prices. These are one-way reads performed by our servers. No user-identifying data is sent to any of them — they see our server's request, never you.
• Web3Forms — receives messages you submit via the feedback widget so we can read your report. Subject to Web3Forms privacy policy.
• Cloudflare (scheduled background jobs) — runs our pollers and the settlement worker. These are processors, not just schedulers: to settle a bet the worker reads the bet row — which is linked to your account — and writes the outcome back. It stores nothing of its own; the data lives in Supabase and passes through Cloudflare while the job runs.
• flagcdn.com — serves the small country flags shown next to national teams. Like the avatars above, these are fetched by your browser directly, so that CDN receives your IP address, user-agent and referring page. We send it nothing else, and it is used on match listings only.
• Your browser's push service — only if you turned notifications on. Web push is delivered by whichever service your browser vendor operates: Google (Chrome and most Android browsers), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). We do not choose it — your browser does, and its address is part of the subscription your browser hands us. That service sees the encrypted message and the endpoint it is being delivered to; the message body is encrypted with keys only your browser holds. We never send your email address, balances or betting history through it.

The Service displays outbound affiliate links to a real sportsbook (Rainbet). We never share your email, your account, or your browsing activity with them — we send them nothing at all. But following any link on the web is a request your browser makes itself, so Rainbet does see your IP address when you click, exactly as it would if you typed their address in. The links carry rel="noreferrer", so your browser does not tell them which page you came from either. Each link passes through our own address first (/out/rainbet), which asks you once to confirm you are 18 or older; when it sends you on to Rainbet we add one to a count kept per day and per place on our site the link sat on (the home page, the sidebar and so on) — no account, IP address or cookie is stored with it, so no count can be traced back to anyone, and we use it only to compare our numbers with Rainbet's affiliate report. Full details on the affiliate arrangement live on our Affiliate Disclosure page.

If you are in the European Economic Area, the UK, or any jurisdiction with comparable rules, you have:

• Right of access — you can request a copy of the data we hold about you.
• Right to erasure — delete your account yourself at any time in /settings (Danger Zone), or ask us via feedback. Deletion removes your auth users row and every cascaded profile + bets row immediately.
• Right to rectification — you can correct inaccurate data (your username via /settings, anything else via feedback).
• Right to data portability — you can request a machine-readable export of your data.
• Right to object to processing based on legitimate interest.
• Right to lodge a complaint with your local supervisory authority (in Poland this is UODO).

To exercise any of these rights, use the feedback widget on the home page. We aim to respond within 30 days.

We use the minimum cookies needed to run an authenticated web app:

• Essential auth cookies (Supabase Auth session). Without these you cannot stay signed in.
• Age confirmation (fakebet_18plus). Set when you confirm you are 18 or older — at the question before a link to Rainbet, or with the box at sign-up — so you are asked once. It holds the value 1 and nothing else, is used only by FakeBet, and expires after 12 months; clearing this site's cookies removes it, and you are simply asked again.
• Theme (fakebet_theme). Set only when you pick a theme — dark, light or your device's own setting — in the header, the menu or Settings, so every page is drawn in it from the first moment. It holds dark, light or system and nothing else, is used only by FakeBet, and expires after 12 months; without it the site is dark.
• Functional preferences stored in localStorage — your active mode toggle, dismissed-banner flags, and bet slip selections so they survive a page refresh.

We do not set any third-party tracking, advertising, or analytics cookies. Our performance and page-view measurement (Vercel Analytics and Speed Insights) is cookieless — it stores nothing at all on your device and never follows you to other sites.

Because of that, there is nothing here that legally requires your consent, and we do not pretend otherwise: the bar you see on a first visit is a notice, not a consent gate, and dismissing it changes nothing. What you can change is real — you can switch the measurement off entirely under Settings → Preferences, which stops those scripts from loading. The essential auth cookie cannot be switched off, because without it you cannot stay signed in.

Account, profile, and bet-history data is retained as long as your account is active. On deletion (self-service in Settings → Danger Zone, or on request), the row is removed and the cascade deletes your bets too. Request logs at Vercel/Supabase follow each provider's own retention windows (typically weeks, not years). We do not maintain any independent long-term analytics store.

The Service is intended for users aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us via the feedback widget and we will delete the account.

Supabase hosts the database in the AWS us-east-1 region (North Virginia, USA). Vercel hosts serverless functions globally. By using the Service you acknowledge that your data may be transferred outside the EEA; both providers maintain Standard Contractual Clauses for such transfers.

We may update this policy when the Service changes or when the law changes. Material changes will be flagged in a banner on the home page; the "Last updated" date at the top of this page always reflects the most recent revision.

For any privacy question, data request, or complaint, please use the feedback widget on the home page. Submissions are routed through Web3Forms to a private inbox the operator monitors. Include "privacy" in your message so it can be prioritised.