Arbistake Privacy Notice

Arbistake is a free tool built and operated by an individual developer for users in Nigeria. This notice explains what personal data Arbistake handles, why, who helps us handle it, how long we keep it, and what you can ask us to do with it.

Contact for anything about your data: arbistakeworks@gmail.com

Account details. If you sign up with email and password, your email address and password. We never see your password in readable form; our authentication provider stores it in a protected format. If you sign in with Google, we receive only your name, email address and profile picture from Google. We do not access anything else in your Google account.

Profile details. A display name taken from your sign-up details, the time you accepted the Terms, the time you completed onboarding, your subscription tier, and your last login time. A preferred name you enter in the app is stored only on your device.

What you enter into the app. The bets you log (bookmaker, market, stake, odds, outcome, return, optional notes, closing odds), and your bookmaker wallet balances and thresholds. You control these and can edit or delete them in the app.

Invite codes. If you sign up with an invite code, we record which account used it.

Push notification subscriptions. If you turn on browser notifications, we store the notification endpoint and encryption keys your browser gives us, linked to your account, so we can send alerts to that browser.

Session and preference data in your browser. Your sign-in session is kept in your browser’s local storage so you stay logged in. A few small preferences (such as whether you have visited before, your alert mute setting, and your preferred name) are also kept in local storage on your device.

Request and bot-check data. Our server uses your IP address to limit how many requests it accepts, so that one source cannot overwhelm it. The sign-in, sign-up and password-reset forms use Cloudflare Turnstile to detect bots. Turnstile may process your IP address and browser signals to do this.

Admin records. If an administrator blocks or restricts an account, we store the block, its end time, and the reason entered.

Telegram (historical). From May to July 2026 we offered arbitrage alerts through Telegram. If you set them up, we stored your Telegram chat ID and whether alerts were turned on, on your profile. Access to these alerts was approved by an administrator. The Telegram feature was removed in July 2026. A database check on 6 October 2026 found no remaining Telegram data. The leftover profile columns are unused: no part of the app reads or writes them.

You can sign in with an email address and password, or with Google. We do not currently take card or payment details inside the app. If that changes, this notice will be updated before the change takes effect.

• To create and secure your account and keep you signed in.
• To show you your bets, wallets and profile, and to show the arbitrage opportunities you are allowed to see.
• To send push notifications to browsers you have chosen to subscribe.
• To keep the service running fairly, including rate limiting and blocking accounts where needed.
• To respond to your requests and to meet our own legal obligations.

We use these providers and services to run Arbistake. We only share what each one needs for its job.

• Supabase — our database and sign-in service. Stores your account, profile, bets, wallets, invite-code and push-subscription records.
• Cloudflare — hosts the Arbistake website. Requests to the site pass through Cloudflare. Cloudflare Turnstile on the sign-in forms may process your IP address and browser signals to detect bots.
• Google — if you choose “Continue with Google”, Google confirms your identity and shares your name, email address and profile picture with us.
• Our application server — runs the odds scanner and the notification sender, on a server located in Lagos, Nigeria.
• Your browser’s push service — the service your browser maker runs to deliver notifications. It receives the notification and the endpoint it was sent to.
• Telegram — used only for the alerts described in section 2, between May and July 2026. Messages are handled by Telegram under its own privacy policy.
• TheSportsDB — a public sports data service we query to check match results. We send only event names and dates; no personal data.

Arbistake does not send your personal data to any bookmaker. When you click through to a bookmaker website, that bookmaker handles anything you do there under its own privacy notice.

We keep your account, profile, bets and wallet records for as long as your account exists. We do not currently run an automatic schedule that deletes old bets or profile records; they stay until you ask us to delete your account.

A database check on 6 October 2026 found no remaining Telegram chat IDs or alert settings. The unused profile columns that held them are not read or written by the app.

Push subscriptions are removed when your browser reports them as no longer valid, or when you turn notifications off. Some short-lived market data is cleared automatically once it expires, but that data is not linked to you.

When an account is deleted, the profile, bets, wallets, roles and push subscriptions linked to it are deleted with it. We will also remove any other records we hold about you, except where we are required by law to keep them.

Under the Nigeria Data Protection Act 2023, you have the right to:

• Access — ask us what personal data we hold about you and receive a copy.
• Correction — ask us to correct personal data that is wrong. You can edit your bets and wallets directly in the app.
• Deletion — ask us to delete your personal data. Account deletion is currently handled on request by email, not by a button in the app.

To make a request, email arbistakeworks@gmail.com from the address on your account so we can confirm it is you. If you are not satisfied with how we handle a request, you may complain to the Nigeria Data Protection Commission.

Access to your records is restricted by database access rules. Apart from administrators, each account can only read and change its own bets and wallets. Administrator access is limited to accounts with the admin role. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you think your account has been used without your permission.

We will update this page when what we collect, or who we share it with, changes. The date at the top shows when it was last changed.