Data we process
We process the data you provide when creating an account (email, optional name and password, which we store only as a cryptographic hash and never in readable form), your plan and two-factor status, the technical security data described below, and communications sent to support.
Sessions and devices
To protect your account and enforce the one-active-session rule, for each session we record the browser and system type (for example, "Chrome on Windows"), an approximate network location (your truncated IP address, never the full one) and the start and last-renewal dates. We recognise your browser with a random identifier stored in a first-party cookie: it is not a device fingerprint and cannot track you outside Choco Bets. If you sign in on another device, we show you the open session so you can decide to close it and, when email is enabled, we notify you by email. You can view and close your sessions in Settings.
Security logs
We log failed sign-in attempts (the email entered and the IP address) and apply temporary attempt limits to detect and stop unauthorised access and automated attacks. These logs are used for security purposes only.
Breached-password check
When you create or change your password, we check whether it appears in public breaches using Have I Been Pwned with k-anonymity: only the first 5 characters of a cryptographic hash (SHA-1) of the password are sent. Neither the password nor its full hash ever leaves our servers.
Purposes
We use this information to create and protect your account, provide the service, handle requests and meet applicable obligations. We do not describe providers, purposes or transfers that do not exist in the live service.
Providers processing data on our behalf
Cloudflare (network and attack protection; processes your IP address), Vercel (website hosting), Render (application servers), Supabase (database), Upstash (temporary storage for security and performance), Mailtrap (account emails) and Mercado Pago (payment processing; we do not store card data). The website loads fonts from Google Fonts, so your browser connects to Google servers. We do not send your personal data to the artificial-intelligence providers we use to analyse matches.
Security and retention
We apply reasonable safeguards (encryption in transit, hashed passwords, short-lived renewable and revocable sessions) and retain information only as long as needed for the stated purposes or applicable obligations. Your session data is deleted together with your account.
Your rights
You may request information about your data, its correction or the handling of other applicable rights by writing to [email protected].
Changes
This policy will be updated when actual data processing changes or its terms need clarification. Version 1.1 added sessions and devices, security logs, the breached-password check and the provider list.