Privacy Policy

Who is responsible for your data

The data controller is Ved Ghosh, San Diego, California 92037, United States. For any privacy question or request, contact support@thearbradar.com.

Arb Radar is operated from the United States and is not directed at the EU or UK, so no EU/UK representative or Data Protection Officer is appointed. If that changes, this policy will be updated before it does.

What we collect

Account data

• Email address — your identifier and the only way to sign in.
• Account created date.

Billing data

• Stripe customer and subscription identifiers, your subscription status, and the date your current paid period ends.
• Card numbers, billing addresses, and tax details are collected and held by Stripe, not by us. We store only the identifiers above.

Sign-in and session data

• Sign-in link tokens, with their creation, expiry, and use time. Links expire after 15 minutes and work once.
• Session records — a random session identifier, which account it belongs to, and when it was created and expires. Sessions last 30 days. A maximum of three are kept per account; older ones are deleted.

Technical data

• IP address, used only in memory to rate-limit sign-in requests so nobody can flood a stranger's inbox. It is never written to disk and is discarded within the hour.
• Standard hosting logs kept by our hosting provider — see section 5.

Your dashboard preferences — bankroll, selected venues, filters — are stored in your own browser and are never sent to us.

Why we use it, and our lawful basis

• To sign you in and keep you signed in — necessary to perform our contract with you.
• To take payment and manage your subscription — necessary to perform our contract, and to comply with tax and accounting law.
• To enforce the device limit and rate limits — our legitimate interest in preventing account sharing and abuse of the service.
• To send service messages about your account, billing, or material changes — necessary to perform our contract.
• Marketing email — we don't send any. The only email you will ever receive from us is your sign-in link and messages about your own account or billing. If we start sending anything promotional, we will ask your permission first and every message will carry an unsubscribe link.

Who we share it with

Only the providers needed to run the service. Each acts on our instructions:

• Stripe — payment processing and subscription management. Receives your email and card details. Stripe's privacy policy.
• Resend — delivers sign-in emails. Receives your email address. Resend's privacy policy.
• Render — hosting. Processes traffic and keeps standard server logs. Render's privacy policy.

Odds and market data providers receive no personal data — we request public prices, not anything about you.

We may also disclose data where legally required, or in connection with a sale of the business. We do not sell your personal information, and do not share it for cross-context behavioural advertising.

Our providers are US-based and your data is processed in the United States. If you are outside the US, using the service means your data is transferred there, where privacy law differs from your own country's.

Cookies

One cookie: arbradar_session. It holds a random session identifier — nothing about you — and exists so you stay signed in. It is HttpOnly (unreadable by scripts), SameSite=Lax, sent only over HTTPS in production, and expires after 30 days or when you sign out.

It is strictly necessary for the service to function, so no consent banner is required. There are no analytics, advertising, or tracking cookies. If that ever changes, this policy changes first and we will ask for consent where the law requires it.

How long we keep it

• Sign-in tokens — deleted once expired; automatically pruned.
• Sessions — deleted at expiry, at sign-out, or when displaced by the device limit.
• Rate-limit records — held in memory only, cleared within the hour.
• Account and billing records — kept while your account is open, then 12 months after closure. Records needed for tax and accounting are kept for the statutory period, typically 6–7 years.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our use of your data, to receive a portable copy, and to withdraw consent. Because we hold so little, most requests are quick to satisfy.

To exercise any of these, email support@thearbradar.com from your account address. We respond within 45 days. We will not discriminate against you for exercising a right.

California residents: you may complain to the California Attorney General at oag.ca.gov. Outside California, your local data protection or consumer authority is the right place.
California: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use sensitive personal information for inferring characteristics.

Security

Traffic is encrypted with HTTPS. There are no passwords to steal. Session cookies cannot be read by page scripts. Sign-in links are single-use and short-lived. Card data never reaches our servers.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.

Children

The service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will delete it.

Changes

If we change this policy we will update the date above, and give notice by email or in the product for material changes before they take effect.