Privacy Policy
Effective date: 24 June 2026 · Last updated: 25 September 2026
This policy explains what personal data tipsbyAI (“we”) processes when you use tipsbyai.com, and your rights under the EU General Data Protection Regulation (GDPR).
In short: we keep as little as we can. You can read the public pages without an account. If you sign in, we store your Google name, email and picture. We run our own analytics, with no third-party trackers or advertising cookies. We send no newsletters, we sell nothing and we never sell or share your data with advertisers.
1. Who is responsible
The controller of your personal data is tipsbyAI, operator of tipsbyai.com. For anything about your data, write to [email protected].
2. What we collect
If you sign in
Sign-in is through Google. From Google we receive and store your name, email address and profile-picture link, plus when you created your account and when you were last active. We never receive your Google password.
When you accept the Terms and confirm you are 18 or older, we record when you accepted, which version of the Terms, and the IP address you accepted from — in full, because this record is our evidence of your acceptance and age confirmation. It is used for nothing else.
When you visit (with or without an account)
Our own server records, for each page you open:
- the page address and, for the first page of a visit, the site you came from;
- your IP address shortened before it is stored (the last part is removed: the last number of an IPv4 address, the last 80 bits of an IPv6 one), so the full address is not kept;
- your browser's user-agent (browser and device type) and the time;
- campaign tags in the link you arrived on, if any (
utm_source,utm_medium,utm_campaign) — for example the share buttons add the name of the network the link was shared on; - a few actions, such as starting or completing sign-in;
- your account ID, if you are signed in.
Page views in one tab are grouped into a visit by a random identifier that lives only in the page's memory: it is not stored in a cookie or on your device and is gone when you reload. We use this data to see how the site is used, to improve it, and to protect it from abuse. We do not build profiles or target advertising.
Your country, for the language
Our network provider (Cloudflare, Section 5) tells our server which country a request comes from, derived from your IP address. We use it only to open the site in your language, and we do not store it.
We do not collect payment details (there is nothing to pay for), identity documents, precise location or any special-category data (GDPR Article 9). The AI that writes the forecasts never receives any data about you.
3. Why we use it, and on what legal basis
- Running your account — signing you in and showing you forecasts for upcoming matches. Basis: performance of our agreement with you (Art. 6(1)(b)).
- Proof of acceptance and age confirmation — the Terms-acceptance record. Basis: our legitimate interest in being able to show that readers accepted the Terms and confirmed they are adults, because the content concerns betting (Art. 6(1)(f)).
- Analytics, security and abuse prevention — the visit data above. Basis: our legitimate interest in understanding and protecting a free service, using shortened IPs and no cross-site tracking (Art. 6(1)(f)). You can object at any time (Section 8).
- Your preferences — remembering the language and theme you chose. Basis: strictly necessary to provide what you asked for.
- Legal obligations — where the law requires us to keep or disclose data (Art. 6(1)(c)).
4. What we do not do
- No newsletters or marketing emails. We only write to you if you write to us first, or if the law requires us to (for example after a data breach).
- No advertising, no advertising cookies, no third-party analytics, no tracking pixels.
- No bookmakers or other partners receive your data.
- No automated decisions with legal or similarly significant effects on you.
5. Who else processes data
We share personal data only with these providers, and only as far as needed:
- Google — handles sign-in. Google's own processing during sign-in is covered by the Google Privacy Policy.
- Cloudflare — every request to the site passes through Cloudflare's network, which provides encryption (HTTPS), caching and protection against attacks. Cloudflare processes your IP address and request details as our processor under its data processing addendum; see also the Cloudflare Privacy Policy.
- Authorities — if a law, court order or competent authority requires it, or to protect the rights and safety of our readers or the Service.
Our database is on a server we operate ourselves in Greece. Team crests and other images are fetched by our server, so your browser does not contact those image providers. The share buttons are plain links: nothing is sent to a social network unless you click one, and then that network's own privacy policy applies.
6. How long we keep it
- Account data and the Terms-acceptance record — for as long as you have an account. When you ask us to delete it, we delete your account, your acceptance record and all visit data linked to your account, within 30 days at the latest.
- Visit data (shortened IPs, user-agents, pages, actions) — deleted automatically after 90 days.
- Emails you send us — as long as needed to deal with your request.
7. Cookies and local storage
We use no advertising or analytics cookies, so there is no cookie banner. What we store in your browser:
| Name | Purpose | Duration |
|---|---|---|
next-auth.session-token | Keeps you signed in (only if you sign in) | 30 days |
next-auth.csrf-token, next-auth.callback-url, next-auth.state, next-auth.pkce.code_verifier | Security of the sign-in process (names may carry a __Host- or __Secure- prefix) | Session / minutes |
lang | Remembers the language you picked (set only when you pick one) | 1 year |
theme (local storage) | Remembers light or dark mode (set only when you switch) | Until you clear it |
Cloudflare may set its own strictly necessary security cookies (such as __cf_bm) to tell people from bots. All of these are needed for the site to work or to do what you asked, so they do not require consent.
8. Your rights
Under the GDPR you can ask us to:
- access the data we hold about you and receive a copy (portability);
- correct inaccurate data;
- delete your account and data;
- restrict processing in certain cases;
- and you may object at any time to processing based on our legitimate interests, including analytics.
Write to [email protected] from the email address of your account. We answer within one month. You also have the right to complain to a data protection authority — in Greece the Hellenic Data Protection Authority (dpa.gr), or the authority of the EU country where you live.
9. Security
- All traffic is encrypted with HTTPS.
- The sign-in cookie is HTTP-only — page scripts cannot read it.
- We never handle passwords or payment details.
- Visit data is stored with shortened IPs and deleted after 90 days.
No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the Hellenic Data Protection Authority within 72 hours and inform you without undue delay (GDPR Articles 33–34).
10. Age
The Service is only for adults (18+). We do not knowingly process data of anyone under 18. If you believe a minor has created an account, write to [email protected] and we will delete it.
11. Transfers outside the EU
Google and Cloudflare are based in the United States and may process data there. Such transfers rely on the EU–US Data Privacy Framework, for the companies certified under it, and on the European Commission's Standard Contractual Clauses included in their data processing terms.
12. Changes to this policy
We will update this policy when what we do with data changes; the date at the top shows the latest version. If a change is significant, we will say so on the site.