Privacy Policy

Summary

• We collect the minimum needed to produce your report.
• API keys must be read-only. Without an account, a key is used for a single import and never stored. If you sign in and save a connection, the key is encrypted at rest (AES-256-GCM), never logged or shown back to you, and deleted as soon as you disconnect or delete your data.
• We do not sell personal data and do not use your trading data for advertising.
• Email privacy@oddsfile.com to have your data deleted.

What we collect

• Public wallet data. When you run a P&L check or import an address, we fetch public on-chain and venue API data for that address. Results of the free check are cached for about 15 minutes so share links load quickly.
• Exchange data via API keys. If you connect a venue with a read-only API key (for example Kalshi), we fetch your fills and settlements. Without an account the key is used only for that request; if you save the connection to your account, it is stored encrypted so we can re-import on request.
• Uploaded files. CSV files you upload are processed to produce your report.
• Account and billing data. If you create an account or subscribe: your email, authentication data from our login provider, and billing records from Stripe. We never see full card numbers.
• Technical data. Standard server logs (IP address, user agent, timestamps) for security and abuse prevention. Logs never contain API keys or uploaded file contents.

Where your report data lives

Without an account, imported data is kept in your browser's local storage on your device; delete it any time with "Clear all data" in the app. If you sign in, your connected accounts and imported data are stored in our database (hosted in the US), encrypted in transit and at rest, and removed by "Delete all my data" in Settings.

How we use data

To provide the Service (imports, reports, exports), to secure it, to provide support, and to comply with law. We do not make automated decisions with legal effects about you.

Sharing

With service providers acting for us (hosting, database, authentication, payments, email), under contracts that limit their use of the data, and when required by law. Never sold.

Retention and deletion

We keep account data while your account is active and delete it within 30 days of a deletion request, except records we must keep by law (for example billing records). API keys are deleted immediately on request or when you disconnect a venue.

Your rights

Depending on where you live, you may have rights to access, correct, delete or port your data and to object to processing. Email privacy@oddsfile.com; we respond within 30 days.

Security

TLS everywhere, least-privilege access, read-only keys, and encryption of stored keys. No system is perfectly secure; tell us at support@oddsfile.com if you find an issue.

Children

The Service is not for people under 18.

Changes

We will post changes here and update the date above.