Privacy Policy

Account data: Your email address, the display name and username you choose, and the sign-in tokens that keep you signed in. If you sign in with Apple, Apple sends us your email address (or a private relay address, if you choose Hide My Email) and an ID for your Apple account. If you sign in with Google, Google sends us your email address, your name, a link to your Google profile picture and an ID for your Google account. We never see your Apple or Google password. If you sign in with Apple in the app, we also keep a token from Apple, encrypted, only so that deleting your account can disconnect Sign in with Apple, and we delete it once Apple confirms that.

Date of birth: Whet is only for adults 21 and over. When you create an account, you give your date of birth and accept our Terms. We keep your date of birth, and when you accepted and which version of the Terms, as the record of that.

Your US state: If you pick a US state while signed in, on whet.gg or in the app, we save it to your account and use it only to build the sportsbook links that need it. You can clear it in Settings. We never use GPS or your phone's location.

Your bets and settings: The bets and parlays you log (the pick, sportsbook, odds, stake, payout and result), your bankroll, the sportsbook accounts you track (their limits, notes and profit or loss), your saved choices (books, sports, alert settings, odds format and time zone), and any betting limits or self-exclusion you set.

Alerts: If you turn on pick alerts, we keep what we need to reach that device. In the Whet app, that's the alert token Apple or Google gives your phone, whether it's an iPhone or an Android phone, and the app version. On whet.gg, it's your browser's push address. We also keep a record of which picks we've alerted you about, so you never get the same alert twice. Turning alerts off, or signing out of the app, removes that phone's token, and deleting your account removes them all. On Android, Google's Firebase service, which delivers app alerts, sets up an ID for the app on your phone when the app starts, even before you turn alerts on.

Bet-slip pictures (Score My Bet): If you upload a screenshot or photo of a bet slip, it goes only to Whet's own server. Text-reading software that runs on that server, not an outside AI or reading service, pulls out the text, and the picture is dropped right away. It's never saved, and only the text comes back to your screen. The app asks to use your camera or photos only when you choose to take or pick a bet-slip picture. A bet you type in to score isn't saved either: we only keep a count of how many you've scored.

Support messages: When you write to us from the Support page, we keep the topic, subject and message with your account, and email them, with your email address, name and plan, to our support inbox. We email you a copy to confirm we got it.

Payment data: On whet.gg, Stripe processes your payment; we don't store card numbers on our servers. In the Whet app, Apple (iPhone) or Google Play (Android) takes the payment, and we never see your payment details. We receive and keep the store's record of your membership: the plan, its dates, whether it's in a free trial or set to renew, its status, and the store's purchase and transaction IDs. Apple and Google also tell us when it renews, changes, is refunded or ends, and we keep a log of those notices. We use all this to turn your membership on, keep it in step with the store, and make sure one purchase pays for one account only.

Usage & device data: Pages visited, features used, scan frequency, and bet-logging activity, along with your IP address, browser and device type, and approximate location (such as your country and state, from your IP address), used to operate and improve the Service, personalize state-specific content, and detect fraud. Loading third-party images (team logos, player photos, country flags) also causes your browser to contact those providers, which may receive your IP address and referrer.

Analytics & session replay (whet.gg only, not the Whet app): We use PostHog and Vercel Analytics for usage metrics. PostHog runs only if you accept analytics cookies on the cookie banner, and never if your browser sends a Do Not Track signal. When it runs, PostHog records a playback of your interactions (clicks, navigation, and mouse movement) to help us debug and improve the product. Form inputs are masked and are not captured, and in the signed-in product every character of on-screen text is masked too. When you're signed in, PostHog also receives your Whet account ID and plan. Vercel Analytics counts visits without cookies. No personal data is shared with advertisers.

In-app events: On whet.gg and in the app, we record a few events on our own servers, such as opening Whet, viewing the board, opening a pick, tapping an alert, a sportsbook link or an upgrade button, and steps of the tour, with your account ID when you're signed in. We use them to see which features get used. They carry no IP address, browser details or page address.

Error reports: When something breaks in the app or on whet.gg, a report goes to Sentry, our error-tracking service. It says what went wrong, your device or browser type, its system and app version, and the screens, taps and network requests just before it. We don't attach your name or email, and our settings tell Sentry not to record your IP address, but a report can include your Whet account ID. Sign-in codes and tokens are removed first. On whet.gg, Sentry also times a sample of page loads.

How you found Whet (whet.gg only): If you arrive through a link with campaign tags or a member's referral code, we record, once, when you sign up: the tags, the ad click ID if the link had one, the page you first landed on, and the address of the site that sent you (not the full link).

Referrals: If you join through a member's referral link, we record who referred you, so you get the longer trial and they get their credit. Before a referral pays out, we check through Stripe whether the two accounts pay with the same card, and keep only the yes-or-no answer. If you're in our creator programme, we also keep your creator handle and the email address we pay you at.

• Provide and operate the Service
• Process payments and manage memberships, on whet.gg and in the app
• Send emails about your account and membership, like sign-up, payment and trial notices, support replies and account deletion
• Send the pick alerts you turn on
• Email you a weekly review of your settled bets (in weeks you have some) and a note after your first win. We send these to every account that hasn't unsubscribed, never during a self-exclusion you set, and every one has an unsubscribe link
• If you sign up for the daily free pick email, use your email address and the state you pick to send it. It has an unsubscribe link too. If online sports betting isn't legal in your state yet, we keep your email address and state on a waitlist instead
• Improve performance, features, and user experience
• Detect and prevent fraud or abuse

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share data only with service providers that are necessary to operate Whet, under contracts that limit their use to providing the Service and require them to protect it at least as well as this policy does. Apple and Google handle in-app payments, app alerts and Apple or Google sign-in under their own privacy policies.

• Supabase: Database and authentication
• Stripe: Payment processing on whet.gg
• Apple and Google Play: Payments for memberships bought in the app. With a purchase we give Apple your Whet account ID, and Google Play a one-way hash of it instead of the ID itself, so the purchase is matched to your account
• Apple and Google: Delivering alerts to the Whet app (Apple Push Notification service, Firebase Cloud Messaging)
• Apple and Google: Sign-in, if you choose Sign in with Apple or Google
• Resend: Email delivery
• Sentry: Error tracking
• PostHog: Product analytics and session replay on whet.gg, only with your consent
• Vercel: Hosting and analytics
• Railway: Backend hosting (our scanning and API servers, including the one that reads bet-slip pictures)

We use essential cookies for authentication and session management. We use a small number of preference cookies to remember choices you make, such as the US state used to build sportsbook links, your answer to the cookie banner, and whether you've seen our notice about where online sports betting is legal. When you're signed in, the state you pick is also saved to your account, so all your devices use it. A one-day cookie on whet.gg holds the country and state your IP address points to, so we can show that notice and fill in the state on the free pick signup form. PostHog sets analytics cookies only if you accept them on the cookie banner when you first visit; Vercel Analytics uses no cookies. The banner doesn't come back once you've answered: to change your answer, clear whet.gg's cookies and site data in your browser and it asks again. You can also block cookies in your browser settings at any time.

• Account data, your bets and your settings are kept while your account is open
• When you delete your account, it closes right away and is permanently removed after 7 days (if a whet.gg subscription is still active at Stripe by then, we hold the account until the cancel goes through). Your date of birth, saved state, support messages, alert tokens and alert record go with it; the copy of a support message in our support inbox stays there until we delete it
• Bet-slip pictures: never stored
• Usage counts (how many scans and bet scores you've used each month): 6 months, or until your account is deleted
• In-app events: kept with no set end date; when your account is deleted, the link to it is removed
• App Store and Google Play purchase records: kept after your account is deleted, with no set end date, so one purchase can never pay for two Whet accounts. They no longer point to any Whet account
• Payment records at Stripe stay with Stripe under its own rules; deleting your Whet account doesn't delete them
• Free pick email list: if you unsubscribe or delete your account, your address stays on the list marked unsubscribed, so it's never emailed again. Waitlist sign-ups are kept until you ask us to remove them
• Error reports: kept by Sentry for 30 days
• Whet's picks, prices and public record hold no personal data

We implement industry-standard security measures including encrypted connections (TLS), row-level security policies, JWT authentication, rate limiting, and security reviews of our code. However, no system is 100% secure and we cannot guarantee absolute security.

You have the right to:

• Access your personal data via the Settings page
• Export a copy of your data at any time from Settings
• Delete your account in Settings, or by emailing us. whet.gg/delete-account lists what is deleted and the few records we keep. Deleting your account doesn't cancel a membership billed by Apple or Google Play: cancel it with them first
• Update your information at any time

To change your choices: turn alerts off in Settings or in your phone's settings, unsubscribe from any email with its link, clear your saved state in Settings, and decline analytics on the cookie banner (to be asked again, clear whet.gg's cookies and site data).

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request its deletion, and to opt out of the sale or sharing of your personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising these rights. If your browser sends a Do Not Track signal, PostHog stays off. We do not yet read Global Privacy Control (GPC) signals; decline analytics on the cookie banner instead.

EEA/UK residents (GDPR): you also have the right to rectification, to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority. Our legal basis for processing is your consent and the performance of our contract with you.

To exercise any of these rights, use the Settings page or email privacy@whet.gg.

We do not knowingly collect personal information from anyone under 13, consistent with the Children's Online Privacy Protection Act (COPPA); if we learn we have, we will delete it promptly. Separately, Whet is intended only for adults 21 and over, and people under that age should not use the Service.

We may update this policy as needed. We will notify you of material changes via email. Continued use after changes constitutes acceptance.

Whet is run by Obsidian Code LLC, a Virginia limited liability company. Privacy questions? Contact us at privacy@whet.gg.