Privacy policy

The data controller for FreakBets.com is legal entity name, registered at registered address. For anything in this policy, including a request to exercise the rights in section 10, contact privacy contact address.

Where the law of your country requires us to register with its data protection authority, our registrations are: NDPC (Nigeria) registration, if required ODPC (Kenya) registration, if required.

You can read every page without an account. Reading sets no cookie and asks for nothing that names you.

Like every web server, the infrastructure that serves this site receives your IP address and browser user agent with each request, and our hosting provider records them in platform request logs for security, abuse prevention and diagnosing faults. We do not copy them out of those logs into any record of our own.

Page views are counted by Vercel Web Analytics, and nothing else. It counts page views and referrers. It sets no cookie, does not follow you across other websites, and does not build a profile of you — Vercel derives an anonymous per-day visitor hash from request data and discards it daily rather than storing an identifier on your device. There is no tag manager and no advertising pixel. If either ever changes, this page is updated before it is switched on, not after.

Team crests are loaded by your browser directly from the media server of API-Sports, our football data provider. Like any server, it receives your IP address and browser user agent with that request. We send it nothing else about you. The typefaces are downloaded at build time and served from our own domain, so your browser makes no request to a font provider.

Members post tips under a public record. To make that work we hold:

Email address

To sign you in and to tell one member from another. Never shown publicly — only to you, on your account page. We send no email at all — not marketing, not notifications.

Password

Stored only as a one-way hash. We cannot read it, and nobody who obtained the database could either without guessing it.

Google sign-in

Google tells us your email address, that Google has verified it, and an account number. We keep those. We do not keep your Google name, your photo or any Google access token, and we never act on your Google account.

Display name

The name you choose. It is public from your first tip — see section 4. It may not be your email address.

Where you came from

If the link you followed to sign up said where it sat — a button on our home page, say, or a campaign — we keep that short label ("home-hero", for example) with your account, to learn which links bring members. It is set once, when you join, and not changed after that — except that we clear it if you ask (section 10). Nothing else about the visit is kept.

Sign-in sessions

A random session token, when it expires, and a keyed one-way hash of the IP address and browser that signed in — kept so that a shared or hijacked account can be investigated. The address and browser themselves are not stored.

Price lookups

When you check a price while posting a tip, we record your member number, the match and the time, to enforce the hourly lookup limit. Deleted after about a day.

Integrity flags

If a tip of yours is voided under the rules — posted after kick-off, for example — a note of it is kept against your account.

We do not ask for your real name, phone number, date of birth, address or any payment detail. Sign-in with Telegram is built but not offered yet. When it is, it will store your Telegram user number and username — not your first name, last name or photo — and this page will say so when it goes live.

Posting a tip publishes it. The tip and its outcome are shown under your display name on the tips feed, and your record on the leaderboard and the tipsters page:

• the match, the market, your selection and the price
• when you posted it, and how long before kick-off
• any analysis you write with it
• how it settled, and your running record and rank

A posted tip cannot be deleted, and its match, selection, price and stake cannot be changed — by you or by us. A record that could lose its losing tips would prove nothing, and that permanence is what the site is for. The only thing that can be taken down is analysis that breaks the terms. Your display name can be changed once after your first tip.

If you ask us to delete your account, we delete your email address, your password hash, your sign-in sessions and your Google link, and replace your display name everywhere with a neutral label such as “Member 3F9A2C”. The tips stay in the record under that label, so it no longer points to you. Anything you wrote in a tip's analysis stays too — so don't put anything in it that identifies you.

These are every cookie this site sets. All are first-party, marked HttpOnly so no script on any page can read them, and SameSite=Lax so they are not sent with requests other sites make in the background.

Over a secure connection your browser shows the sign-in cookies with __Secure- in front of the name. The two sign-in cookies are strictly necessary for an account to work and are only set when you choose to sign in.

Some pages carry commercial links to bookmakers and casinos: the bookmakers, free bets and casino pages, and the casino welcome offers on the bet of the day page. The homepage, the member tips feed, the leaderboard and the results ledger carry none. If you click a commercial link, the request passes through our own redirect at /go/… and, at that moment only, we set fbc.

Its value is a click identifier generated at the moment you click — a timestamp with random characters after it. It is not your name, it is not derived from anything about you or your device, and it is never shared between users. Its only job is to let us recognise, if an operator later reports a referral, that the referral came from this site — which is how we are paid.

If you never sign in and never click a commercial link, no cookie is ever set. That is why this site does not put a cookie banner in front of you for reading it. You can delete any of these cookies at any time in your browser's settings.

When you click a commercial link, or a link to our Telegram channel, we write a record containing:

• a randomly generated click identifier
• where the link pointed: which bookmaker and offer, or Telegram
• the two-letter country code your request came from
• where on the page the link sat, and which tip or fixture it belonged to
• the page on this site you clicked from

That record does not contain your IP address, your browser user agent, your member account or anything that names you — even if you are signed in. The country is resolved at the network edge and stored as a country code only.

Your account data is processed to provide the service you signed up for — an account that posts tips under a public, checkable record. That is the contract between us.

The session fingerprints, lookup limits and integrity flags rest on our legitimate interest in keeping the record honest and the site secure. Referral attribution rests on our legitimate interest in being paid for referrals we generate. The click records in section 6 — commercial links and links to our Telegram channel — and the label of the link you signed up from rest on our legitimate interest in knowing which links bring readers and members. Those interests are narrow, and the data is kept to the minimum that makes each one work: none of it identifies you except the sign-up label, which sits on your own account.

That holds under the Nigeria Data Protection Act 2023, the Kenya Data Protection Act 2019, and the UK GDPR and GDPR. You can object to processing based on legitimate interests at any time — see section 10. Where the law requires consent for something, we ask for it before doing that thing, not after.

• Your account data: for as long as you have an account. Deleted on request, as section 4 describes.
• Your tips and record: permanently, under your display name — or under a neutral label once your account is deleted.
• Sign-in sessions, with their fingerprint hashes: until you sign out, or until they expire after 30 days and a daily clean-up deletes them.
• Price lookups: deleted by the same daily clean-up once they are a day old.
• The fbc cookie: 30 days in your browser, or until you delete it.
• Click records: 13 months — long enough for an operator to report, reconcile or dispute a commission across a full year — then deleted.
• Platform request logs, including the IP addresses in them, are held by our hosting provider under its own retention policy and are not copied or retained by us separately.

Data protection law in Nigeria, Kenya, the UK and the EEA gives you the following rights over personal data we hold about you.

Access

Ask what personal data we hold about you and get a copy of it.

Rectification

Have inaccurate data corrected.

Erasure

Ask us to delete data we hold about you — with the one limit on the public record explained in section 4.

Restriction

Ask us to stop processing data while a dispute about it is resolved.

Objection

Object to processing we carry out on the basis of legitimate interests, including the referral attribution described in section 5 and the record of which link you signed up from (section 3). We will clear that label on request.

Portability

Receive the data you gave us, and your tips, in a machine-readable form.

Complaint

Complain to your data protection authority — in Nigeria the Nigeria Data Protection Commission (ndpc.gov.ng), in Kenya the Office of the Data Protection Commissioner (odpc.go.ke), in the UK the Information Commissioner's Office (ico.org.uk). You do not need to contact us first.

To make a request, contact privacy contact address from the email address on your account, so we know the request is yours. We respond within one month. If you have no account, the only record that could be linked to you is a commercial click — so include the value of your fbccookie, which you can read in your browser's cookie settings. Without it we usually have no way to identify your data, and we will not ask you for extra identifying information just to go looking.

Our hosting runs on a global edge network, and our database and providers are outside Nigeria and Kenya, so your data is processed in other countries. Where that involves a transfer of personal data, it is made under the safeguards our providers offer for it, such as standard contractual clauses. Our database region is database region.

Passwords are stored only as one-way hashes. IP addresses and browsers are stored only as keyed hashes. Sign-in cookies cannot be read by scripts, and every connection to the site is encrypted. If a breach puts your data at risk, we tell you and the relevant authority within the time the law requires.

This site is for adults only — 18 or over, or older where the local minimum age is higher. It is not directed at children, we do not knowingly collect data from anyone under 18, and if we learn that we have, we delete it.

When what we collect changes, this page is updated before the change goes live, not after it. The date at the top tells you when it last changed.