Privacy notice
Last updated: 1 August 2026
This notice explains what personal data Oddrail processes and why. It is written to meet the GDPR and Türkiye's KVKK. The short version: an email address, a display name, and little else — no analytics, no advertising, no tracking across sites.
Oddrail is run by an individual, not a company. Wherever this page says [OPERATOR], the operator's registered name and address will be inserted once a company is formed; until then requests reach the same person at the contact address below.
1. Who is responsible
The controller is [OPERATOR], reachable at [OPERATOR CONTACT EMAIL]. There is no data protection officer; the operator answers requests personally.
2. What is collected
Account: your email address, your display name, and a one-way hash of your password. The password itself is never stored and cannot be read back.
Trading: your orders, positions and virtual credit balance, tied to your account.
Waitlist: if you ask for API access — your email address, optionally a company name and a sentence about what you would build, and the time you gave consent.
Security log: for account creation, sign-in, sign-out and waitlist signup we record the action, the time, the email involved and the originating IP address. Short-lived per-IP counters enforce rate limits.
Held only in your browser and never sent to us: your appearance choice, your session reminder, and your age confirmation.
3. Why, and on what legal basis
To provide the account and the exchange you asked for — performance of a contract with you.
To keep the service secure and prevent abuse of an unauthenticated write path — our legitimate interest in a service that stays up and is not manipulated.
To email you about API access — your consent, given by ticking the box on the waitlist form. You may withdraw it at any time; that does not affect anything done before you withdrew.
To meet legal obligations, where they apply.
4. What is not done
No analytics, advertising or social media scripts run on this site. There are no third-party cookies and no cross-site tracking.
Your data is not sold, rented or shared for marketing, and there is no automated decision-making that produces a legal or similarly significant effect on you.
5. How long it is kept
Account data: until you delete your account, then removed within 30 days except where a record must be kept by law.
Waitlist entries: until API access opens and you have been contacted, or until you ask to be removed — whichever comes first.
Security log entries: 12 months, then deleted.
Rate-limit counters: two minutes.
6. Who else sees it
Hosting is provided by Hetzner Online GmbH on servers in Germany, acting as a processor on our instructions.
Match, odds and result data comes from API-Football and football-data.co.uk. Team and league crests load directly from API-Football's image host, which — like any image host — sees your IP address when your browser fetches them; no other personal data reaches either provider.
No personal data is transferred outside the European Economic Area.
7. Your rights
You may ask for a copy of your data, ask for it to be corrected or deleted, ask us to restrict or stop processing it, ask for it in a portable form, object to processing based on legitimate interest, and withdraw consent you have given.
Write to [OPERATOR CONTACT EMAIL]. Requests are answered within 30 days.
If you believe your data has been handled badly you may complain to your supervisory authority — in Türkiye the Personal Data Protection Authority (KVKK), or in the EU the authority where you live or work.
8. Children
The service is for adults aged 18 or over and is not directed at children. If you believe a child has created an account, write to us and it will be removed.
9. Changes
If this notice changes materially, the new version appears here with a new date.