doddo.Back to doddo ↗

doddo Privacy Policy

Production draft — not yet effective. This draft describes the intended public consumer service with accounts. Complete the bracketed fields, confirm the production data flows and retention periods, and implement the described controls before publication. These drafting notes are not part of the final published policy.

Effective date: [TO COMPLETE]
Operator responsible for your information: [LEGAL NAME]
Business address: [ADDRESS, COUNTRY]
Privacy and deletion requests: [PRIVACY CONTACT EMAIL]

1. Scope

This Policy explains how doddo (“we,” “us” or “our”) handles personal information when you use our website, app and related consumer services. doddo helps you discover potential claims, refunds and promotional opportunities. It does not operate sportsbooks or administer claims.

This Policy does not cover websites you visit through our links. Their operators handle information under their own policies. Separate arrangements may apply to business partners and creators.

2. Information we collect

Information you provide

  • Account information: email address, display name and password when you create an account. We store a salted password hash, not your plaintext account password.
  • Profile and matching information: age in years, selected state and answers about products or services you have used, approximate purchase quantities and other eligibility questions you choose to answer. Some questions can be skipped or answered “not sure.”
  • Planning information: amounts, selections and progress you enter into an opportunity calculator or plan. Certain plan information may be stored in your browser, as described below. If you track a bank or card bonus, we also store the dates you enter (such as when you opened the account or met a requirement), your chosen hold period and your reminder preference. We do not ask for account numbers, card numbers or balances.
  • Communications: messages and information you choose to send to our support or privacy contact.

We do not request your date of birth, Social Security number, bank account or payment-card details, sportsbook credentials, or precise GPS location to use this version of doddo. Please do not include these in messages to us. Age is entered as a number of years; a selected state is not a verification of your physical location.

An official claim administrator or provider may separately request identity, payment or tax information on its own website. Information you enter there is provided to that third party, not through a doddo claim-submission service.

Technical information

When you use doddo, our hosting infrastructure receives information needed to deliver and protect the service, such as your IP address, request time, requested path, browser or device information provided by the request, response status and error or security events. We use IP-based controls to limit abusive requests. These technical records may be processed even if you do not create an account.

We also process session identifiers, browser storage described below, and the state or other parameters needed for requests you make to our services. We do not use precise-location permissions in this version.

Information from other sources

We obtain opportunity information from public sources and data providers. If you use a partner link, an affiliate partner may provide referral identifiers, qualifying-action status or commission information for attribution. [BEFORE PUBLICATION: confirm whether this referral reporting is enabled, name the actual networks/providers, and remove or narrow this paragraph if it is not.] We do not need your sportsbook login or full betting history to identify a referral.

3. Why we use information

We use information to:

  • create and secure accounts, maintain sessions and provide saved profiles;
  • match opportunities to your age, state and answers and provide requested calculations;
  • deliver the website and its content, diagnose problems and prevent abuse;
  • respond to questions, support requests and privacy requests;
  • meet legal obligations, resolve disputes and protect lawful rights;
  • send reminder emails you have turned on about bonus requirements, expected payments and closure dates you are tracking;
  • measure qualifying referrals and account for partner compensation, if the referral reporting described above is enabled.

We do not make the final eligibility or payment decision for a claim, refund or sportsbook offer. Our matching is informational; the relevant administrator, agency or provider decides under its own rules.

We use Resend to deliver reminder emails you have turned on. Resend receives your email address and the message content (institution, reminder type and dates). Reminder emails are service messages, not marketing; every one includes an unsubscribe link, and reminders can be turned off in your profile. No third-party product analytics SDK or advertising pixel is currently included in this production draft's confirmed vendor list. We will update the Policy and provide any required notice or choice before enabling new uses of personal information. Marketing messages, if introduced, will provide an unsubscribe option and use consent where required.

4. Cookies and browser storage

We use an essential first-party session cookie to keep you signed in. It is marked HttpOnly and Secure on HTTPS and uses SameSite controls. The current account session lasts up to 30 days unless ended earlier, such as when you sign out. Browser cookie controls let you delete or block it; blocking it prevents features that require a signed-in session.

We use browser local storage for unfinished onboarding answers and certain opportunity-plan selections or progress. These entries are separate from your server account and may remain on that device until cleared, replaced or removed by the relevant flow. Clearing browser data removes local copies; it does not by itself delete information saved to your account. Signing out may not clear every locally stored opportunity plan, particularly on a shared device.

This version does not include third-party analytics or advertising cookies in the confirmed implementation. Third-party websites may use their own cookies after you follow a link. If non-essential tracking is introduced on doddo, we will describe it and provide legally required consent or opt-out controls before it operates.

5. Who receives information

We limit disclosure to the purposes described in this Policy:

  • Hosting and infrastructure: Railway hosts the application and its storage. Application records are held in a database managed by doddo on Railway infrastructure. Railway may process technical information needed to provide and secure hosting. Its Privacy Policy describes its own practices.
  • Service providers: providers engaged to support the service may process information on our behalf under appropriate contractual restrictions. [BEFORE PUBLICATION: list any additional actual providers and their functions. Supabase and an analytics provider are not confirmed as deployed and must not be listed as existing recipients without verification.]
  • Email delivery: Resend, Inc. sends reminder emails on our behalf and processes your email address and message content under its Privacy Policy. [BEFORE PUBLICATION: confirm the Resend data processing terms and processing location.]
  • External sites you choose to visit: following a link sends a request to that site, which ordinarily receives your IP address, browser information and any referral parameters in the link. Its own policy applies. We do not send your entire doddo profile or claim answers merely because you click an external link.
  • Affiliate attribution: where enabled and described above, referral partners may exchange the limited referral and conversion information needed to attribute qualifying actions. [Confirm actual fields and recipients before publication.]
  • Legal and security recipients: we may disclose information when required by law or when reasonably necessary to investigate abuse, establish or defend legal claims, or protect people and the service, subject to applicable law.
  • Business transfers: information may be transferred as part of a merger, acquisition or sale of the relevant business, subject to applicable protections and any required notice.

We do not sell your profile answers as a mailing list. [BEFORE PUBLICATION: separately assess whether any actual advertising or affiliate data flows constitute a “sale,” “sharing” or targeted advertising under applicable state law; do not publish an unqualified statutory no-sale/no-sharing claim until that assessment is complete.]

6. Retention and deletion

We retain personal information for the purposes described above, taking into account the type of information, whether it is needed to provide an active service, security needs and applicable legal requirements. We do not intend to keep personal information indefinitely without a continuing purpose.

Account and saved profile

While the account is active, subject to [INACTIVE-ACCOUNT PERIOD]. Following a verified deletion request, remove from active systems within [DELETION PERIOD], except information lawfully retained as described below.

Account sessions

Valid for up to 30 days; ended earlier on logout or revocation. Expired records are cleaned during session maintenance.

Bonus trackers and reminders

While your account is active or until you delete the tracker. Records of sent reminders are kept for [CONFIRMED PERIOD] to prevent duplicate sending.

Browser drafts and plans

Until removed by the relevant flow or cleared from the device; not necessarily deleted when a server account is deleted.

Request, error and security logs

[CONFIRMED APPLICATION AND HOSTING LOG RETENTION], with limited extensions where needed to investigate an incident or comply with law.

Support and privacy correspondence

[CONFIRMED SUPPORT / REQUEST RECORD RETENTION] after resolution, unless a legal obligation or dispute requires longer retention.

Referral records, if enabled

[CONFIRMED RETENTION] for attribution, reconciliation and applicable accounting obligations.

Backups

Deleted information may remain until backups expire under [CONFIRMED BACKUP EXPIRY, INCLUDING HOSTING SNAPSHOTS]. We restrict backup use to recovery and security and apply outstanding deletion instructions if a backup is restored.

We may retain limited records after deletion where required by law or necessary for a specific security, fraud-prevention or legal-claims purpose. Those records remain subject to appropriate restrictions. We may retain information that has been de-identified so that it cannot reasonably be linked to you, where legally permitted.

7. Your choices and requests

You can update supported profile fields in the service, turn reminder emails off in your profile or through the unsubscribe link in any reminder email, delete a bonus tracker, choose not to answer optional questions, clear browser storage, and stop using the service. Leaving out information may reduce the relevance of results.

Contact [PRIVACY CONTACT EMAIL] to request access, correction or deletion of your personal information. Depending on where you live and which laws apply, you may also have rights to obtain a portable copy, object to or restrict processing, withdraw consent, opt out of certain uses, appeal a decision, use an authorized agent, or complain to a competent authority. We will handle requests within applicable legal timeframes and will not unlawfully discriminate against you for exercising a privacy right.

We may need to verify your identity using information reasonably necessary for the request, preferably through your existing account or email. Do not send an SSN, bank details or sportsbook credentials to verify a request. Withdrawing consent does not affect processing that was lawful before withdrawal. Deleting information from doddo does not delete information you independently submitted to a provider or administrator; contact them directly for that request.

[BEFORE PUBLICATION: confirm the intended launch markets and applicable privacy statutes. Add required jurisdiction-specific notices, appeal contact, opt-out links and recognition of applicable browser signals if the final data flows or legal thresholds require them.]

8. Security and processing location

We use safeguards designed to protect information, including HTTPS, salted password hashing, access controls and protected session cookies. No method of storage or transmission is completely secure. Protect your credentials and contact us if you suspect an account security issue.

The current hosting setup processes application data in the United States. Service-provider support and subprocessors may involve other locations. [Confirm provider processing locations and any required international-transfer safeguards before offering the service outside the intended US launch market.]

9. Age restrictions

doddo is intended for adults aged 18 or older. Sportsbook-related features are restricted to adults aged 21 or older and locations where their use is lawful. We do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact [PRIVACY CONTACT EMAIL] so we can investigate and take appropriate action.

10. Changes and contact

We may update this Policy as our service and practices change. We will update the effective date and provide notice of material changes and obtain consent where required. A policy update does not by itself authorize a materially different use of previously collected information where notice or consent is required.

For privacy questions or requests, contact [LEGAL NAME], [ADDRESS], [PRIVACY CONTACT EMAIL].