duban is a sports-analytics service. We hold the minimum needed to run your account:
Account: email address, display name, an optional avatar you upload, and your sign-in method (email/password, Google or Apple).
Security: whether two-factor authentication is on (the authenticator secret is held by our auth provider, never shown to us again after setup), and hashed, non-reversible sign-in attempt counters kept for 15 minutes to stop password guessing.
Billing: if you subscribe, your Stripe customer and subscription identifiers and the subscription status. Card details go straight to Stripe; we never see or store them.
Preferences: theme, default sport, preferred bookmaker, and any saved strategies you create.
Discord: only if you link it — your Discord user id and username, so the bot can recognise you. We do not store Discord tokens.
Server logs: request logs held by our hosting provider for a short window, and security events (failed sign-ins, lockouts, two-factor changes) recorded with hashed identifiers rather than your email or IP address.
We do not collect betting-account credentials, payment-card numbers, government identifiers, or precise location.
How we use it
To sign you in, keep your session, and show your own preferences and saved strategies.
To bill your subscription and unlock the features you pay for.
To prevent abuse: rate limiting, lockouts after repeated failed attempts, and refusing passwords that appear in known breaches.
To answer support requests you send us.
To understand which pages are used, in aggregate, through cookieless analytics.
We do not sell personal data and we do not run advertising.
Who processes it
A small set of providers process data on our behalf, each only for the purpose listed:
Vercel — web hosting, request logs, and privacy-friendly analytics.
Upstash — the short-lived rate-limit counters (hashed keys only).
Have I Been Pwned — when you set a password, the first five characters of its hash are checked against the breach corpus. The password itself never leaves our server.
Google, Apple, Discord — only if you choose to sign in with or link those accounts.
Cookies & analytics
We set strictly necessary cookies only: your sign-in session and your theme choice. There are no advertising or cross-site tracking cookies. Page analytics are cookieless and aggregated.
Retention & deletion
Account data is kept for as long as your account exists. You can delete your account yourself at any time from Settings → Danger zone. Deletion cancels any active subscription, removes your avatar, profile, preferences, saved strategies and Discord link, and deletes the account record itself. Stripe retains billing records for the period its legal obligations require. Rate-limit counters expire within 15 minutes and server logs roll off on the hosting provider's schedule.
Your rights
Depending on where you live (including under the GDPR, UK GDPR and CCPA) you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Most of this you can do directly in Settings. For anything else, contact us and we will respond within 30 days. You may also complain to your local data-protection authority.
Security
All traffic is encrypted in transit and data is encrypted at rest by our providers. Per-user data is protected with database row-level security, so one account cannot read another's. Passwords are hashed by our auth provider and checked against breach lists; optional two-factor authentication is available in Settings. Sign-in endpoints are rate limited and audited.
Found a vulnerability? Please report it privately through the contact page (also listed in our /.well-known/security.txt). We aim to acknowledge reports within two business days.
Age
duban covers sports betting markets and is not directed at anyone under 18, or under the legal age for gambling-related content where you live. We do not knowingly hold data about minors; if you believe we do, contact us and we will delete it.
Changes & contact
When this policy changes materially we will update the date above and note the change in the app. Questions go to our contact page or support@duban.xyz.
