Privacy Policy
Last updated: June 2026
1. Who we are
Rival Picks (“we”, “us”, “our”) operates rivalpicks.co.uk — a free-play tipster tracking platform for UK horse racing. We are the data controller for personal data collected through this service.
We are not a bookmaker, betting exchange, or gambling operator. No real-money wagers are placed on this platform.
Contact: support@rivalpicks.co.uk
2. What data we collect and why
| Data | Purpose | Legal basis (UK GDPR) |
|---|---|---|
| Username, email, hashed password | Account creation and authentication | Contract (Art. 6(1)(b)) |
| Pick history, stakes, odds, results | Tipster record-keeping and leaderboard | Contract (Art. 6(1)(b)) |
| Derived stats (P&L, ROI, strike rate) | Public tipster profile and ranking | Contract (Art. 6(1)(b)) |
| Subscription tier and expiry date | Access control for Pro features | Contract (Art. 6(1)(b)) |
| IP address and request logs | Security, fraud prevention, debugging | Legitimate interests (Art. 6(1)(f)) |
| Follow relationships | Social features and notifications | Contract (Art. 6(1)(b)) |
We do not collect sensitive personal data (health, biometric, political or religious views). We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
3. Public profile data
Your username, tipster stats (total picks, P&L, ROI, strike rate, certification level), and pick history are visible to other registered users. This is core to the purpose of the service.
Your email address is never displayed publicly. Your password is stored as a one-way bcrypt hash and cannot be read by anyone, including us.
4. Who we share data with
We use the following third-party processors:
- Stripe — payment processing. We pass your email to Stripe to create a customer record; Stripe handles all card data. Stripe Privacy Policy.
- Neon — database hosting (EU West region). Your data resides in the EU.
- Vercel — application hosting (EU region).
- Resend — transactional email (e.g. pick notifications, password resets).
- Upstash — rate-limiting cache (no personal data is stored, only anonymised IP hashes with a 15-minute TTL).
We do not sell, rent, or trade your personal data to any third party.
5. Cookies
We use one session cookie set by NextAuth to keep you logged in. This cookie is:
- HttpOnly (not accessible to JavaScript)
- Secure (HTTPS only)
- Strictly necessary for the service to function
We do not use advertising, tracking, or analytics cookies.
6. Data retention
- Account data: held for as long as your account is active.
- Pick history: retained indefinitely as part of your verifiable tipster record (core to the service).
- Server logs: retained for up to 30 days then automatically deleted.
- Password reset tokens: expire after 1 hour and are deleted on use.
If you delete your account, your personal data (username, email, pick history) will be permanently deleted within 30 days.
7. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Restrict or object to processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time where processing is based on consent
To exercise any right, email support@rivalpicks.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).
8. Security
We use industry-standard measures including TLS encryption in transit, bcrypt password hashing, and strict access controls. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
9. Changes to this policy
We may update this policy. Material changes will be communicated by email or a notice on the platform. Continued use after the effective date constitutes acceptance.