Privacy Policy and Consent to Data Processing

1.1 The controller of personal data is the operator of the Tikkit service (the “controller” or “we”), the operator of the Tikkit service at tikkit.pro.

1.2 For all matters of personal data protection, contact us at support@tikkit.pro. We were not required to appoint a data protection officer and have not done so.

2.1 By ticking the box “I consent to the processing of my personal data” when registering, you give the controller your consent under Art. 6(1)(a) GDPR to process personal data for these purposes:

• community profile – showing your nickname, avatar, country, betting statistics (profit, ROI, win rate, rating) and shared slips to other signed-in users on the leaderboard, your profile, Picks and the forum, to the extent set in your privacy settings;
• AI slip reading – passing a screenshot or text of a slip that you paste yourself to the provider of an AI model (sections 6 and 7) so that it can prepare a draft bet.

2.2 Consent is voluntary and valid until withdrawn. You can withdraw it at any time by e-mail to support@tikkit.pro; for the community profile also by hiding amounts and slips in Settings → Privacy, and for AI slip reading simply by not using it. Withdrawal does not affect the lawfulness of processing before it. Without consent to the community profile it is not possible to share slips or take part in the leaderboard, so this consent is a condition of registration; closing the account ends the processing entirely.

2.3 The other processing described below does not require your consent because it is necessary to provide the service under the Terms of Service, to comply with legal obligations, or is our legitimate interest. We inform you about it in accordance with Art. 13 GDPR.

• Account data: username, and if you register by e-mail, your e-mail and password (we store only its cryptographic hash, never the password itself), registration date and the version of the accepted terms.
• Sign-in with X: if you register or sign in through X (formerly Twitter), or connect an X account in Settings, we store the numeric identifier of your X account and your X username (@handle). We need the identifier to recognise you the next time you sign in; the @handle can change, so we only show it in Settings. We receive no e-mail, password, posts, followers or other content of your account from X. We use the access token from X once to read the identifier and @handle and do not store it.
• Profile: display name, avatar, country, language, time zone, currency and other settings.
• Your records: slips, bets, odds, deposits, withdrawals, bankroll, limits, tags, notes, sportsbooks and statistics derived from them.
• Community content: forum posts, shared slips, information about who copied a slip.
• Technical data: IP address at registration and sign-in, push notification subscription data (the subscription address at your browser’s provider), server logs.
• Content for AI reading: the screenshot or text of a slip that you paste into the service.
• Payment data (once paid services are introduced): order details, amount and status of the payment and billing details. You enter your card number directly with the payment gateway; the controller does not receive it.

Betting data may indirectly reveal your habits. We do not process special categories of data (e.g. health data) and ask you not to put them in notes or the forum.

You may object to processing based on legitimate interest (section 11). We do not carry out automated decision-making or profiling with legal effects; the community rating and badges are calculated only from your slips and do not affect your rights.

• account data, profile, records and community content for as long as the account exists; after it is closed we delete them within 30 days, and from backups within 60 days at the latest;
• the X account identifier and @handle for as long as the account exists, or until you disconnect X in Settings (an account created through X without a password cannot disconnect X; the data ends when the account is closed);
• unconfirmed registrations (name, e-mail, password hash, IP address) for at most 45 days;
• IP addresses from registrations (including through X), for protection against mass account creation, for at most 45 days; from sign-ins only briefly in the server’s memory;
• we do not store screenshots and texts for AI reading; after reading, only the bet you save yourself remains;
• accounting and tax documents for paid services for the period required by law (usually 10 years);
• data needed to establish legal claims for the duration of the limitation periods.

We do not sell data. We make it available only to these processors and recipients, and only to the extent necessary:

• Hostinger – rental of the server on which the service and its database run, and sending e-mails from support@tikkit.pro;
• OpenRouter, Inc. (USA) and the AI model provider it selects – only the content you paste for AI slip reading;
• operators of your browser’s push services (e.g. Google, Apple, Mozilla) – the encrypted content of a notification, if you turn them on;
• a payment gateway and accounting services – once paid services are introduced, to the extent needed to process payments and keep accounts;
• public authorities where required by law.

If you choose to sign in with X, we redirect you to X Corp. (USA), where you sign in and allow Tikkit access. X thereby learns that you are signing in to Tikkit; X carries out this processing as an independent controller under its own privacy policy. We pass no data from your Tikkit account (bets, statistics, e-mail) to X.

Providers of sports data and odds (NHL.com, hokej.cz, API-Football, API-Sports, The Odds API) receive no personal data of yours from us.

AI slip reading and push notifications may involve transferring data to the USA. When you sign in with X, our server communicates with X Corp. (USA), but passes it only the one-time authorisation code from the sign-in, none of your Tikkit data. This is done on the basis of the European Commission’s adequacy decision (EU–US Data Privacy Framework) for certified recipients, or on the basis of standard contractual clauses approved by the European Commission. We make no other transfers outside the European Economic Area.

Community features are available only to signed-in users. Other users see your nickname, avatar, country, rating and statistics; by default amounts are shown in betting units, not in currency. In Settings → Privacy you can hide amounts and the slips on your profile. Slips you share yourself (Picks, forum, share image) are visible to others until you stop sharing them. Private notes on slips are visible to no one else. Your e-mail address is never shown. We do not show your connected X account or its @handle to other users; they see only the nickname you choose in Tikkit.

We use only strictly necessary cookies and browser storage, which do not require consent under Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications:

• a sign-in cookie (keeps you signed in, valid for at most 30 days);
• cookies with your choice of language and odds format (1 year);
• temporary cookies during sign-in with X, which protect the sign-in against forgery (at most 10 minutes) and hold an unfinished registration (at most 30 minutes);
• local browser storage for appearance (light/dark mode), sounds and similar preferences, which never leaves your device.

We use no third-party advertising, tracking or analytics cookies. If we ever introduce them, we will ask for your consent first.

Communication with the service is encrypted (HTTPS), passwords are stored only as hashes using a robust hashing function, access to the server is protected by cryptographic keys and data is backed up regularly. Registration and sign-in are protected by a captcha and attempt limits, and sign-in with X by X’s own verification and registration limits. If a security breach is likely to result in a high risk to you, we will inform you without undue delay.

Under the GDPR you have the right:

• of access to your personal data and to a copy of the data we process about you (Art. 15);
• to rectification of inaccurate data (Art. 16) – you can correct most data yourself in Settings;
• to erasure (Art. 17) – by closing your account on request sent to the controller’s e-mail;
• to restriction of processing (Art. 18);
• to data portability (Art. 20) – a CSV and JSON export is in Settings → Data;
• to object to processing based on legitimate interest (Art. 21);
• to withdraw consent at any time (Art. 7(3));
• to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.

Send requests to support@tikkit.pro, ideally from your account’s e-mail address so that we can verify you. For accounts created through X, which have no e-mail, state your Tikkit nickname and your X @handle and we will verify you in another suitable way. We handle them without undue delay, within one month at the latest, free of charge.

We may update this document, for example when introducing paid services or new features. We will inform you of material changes in advance by e-mail or in the service; if a change concerns processing based on consent, we will ask for your consent again.