How current DeePicks features handle data.

Accounts and authentication

Supabase provides account authentication. When you register or sign in, Supabase processes account details such as your email address, authentication credentials, verification and recovery activity, and session information. DeePicks uses authentication storage to keep you signed in and to protect account-only routes.

Optional email subscription and controlled testing

The email feature is in controlled testing, with recipient restrictions enforced in the application. No automatic daily newsletter schedule is enabled. Email consent is separate from creating an account; existing users are not enrolled automatically, and any offered signup checkbox is off by default. A subscription becomes active only after its dedicated confirmation link is accepted.

For this feature, DeePicks stores the account email, consent wording and version, signup source, status and relevant request, confirmation, unsubscribe, bounce and complaint timestamps. The configured SMTP mailbox provider processes controlled confirmation and test deliveries. The application also supports a separately configured provider, but does not automatically switch providers after a failed send. Consent, confirmation, unsubscribe and suppression are controlled by DeePicks, independently of that provider. Delivery request/recipient mappings, delivery timestamps and provider-event identifiers are retained for a configurable period (30 days by default), including after account deletion with the account link removed, so late delivery failures can still be processed. The expiry maintenance process is currently disabled, so this configured window must not be read as a promise of automatic deletion after 30 days. Consent and address-level suppression are excluded from that expiry cleanup. Suppression records remain to prevent unwanted re-enrollment, subject to reviewed privacy-request handling. Every newsletter must provide an unsubscribe link that works without signing in; unsubscribes, delivery bounces and spam complaints suppress further newsletter sends without changing account access, authentication emails or paid subscriptions.

Private Bet Tracker

Signed-in users can save their own bets, stakes, odds, selections, results, settlement history, notes, and related records in Supabase. Uploaded bet-slip screenshots are stored in a private Supabase Storage bucket under the authenticated user's identifier. Database and storage access rules are scoped to that user.

Private does not mean anonymous: the records are linked to the user account so the service can retrieve the correct tracker data. The application can create short-lived signed links so the user can review an uploaded screenshot.

Referral attribution

If a new account is created through an invitation link, DeePicks may store the inviter and new account identifiers to record that attribution. The inviter sees only an aggregate signup count, never the referred user's email address or identity. Referral links provide no rewards or access, and attribution does not change authentication, subscription, or prediction-access rules.

Optional OpenAI screenshot extraction

When screenshot extraction is configured and a user uploads or retries a supported bet-slip image, the application sends that image to OpenAI's Responses API to extract visible ticket fields. The API request sets store: false; provider-side handling remains subject to OpenAI's applicable terms and account controls. Users must review extracted values before saving a bet.

The extracted response is temporarily kept in that browser tab's session storage for the review flow. Confirmed tracker details are then saved to the user's Supabase records. If OpenAI configuration is absent, automatic extraction is unavailable; the application does not silently replace it with another provider.

Stripe sandbox billing

DeePicks currently integrates only with Stripe test mode. Test checkout and the test customer portal can process the account email supplied to checkout plus sandbox customer, subscription, price, and payment-status information. Signed test webhook events are used to update access records in Supabase. No live payment should be collected through the current configuration.

Public prediction data

The public landing page reads the validated football snapshot and publishes only a limited free-tip view. Full prediction data remains behind server-verified access checks. Account and Bet Tracker data are not included in the public free-tip response.

Advertising and analytics

Verified Pro subscribers and owner accounts never load advertising or Funding Choices scripts. If authentication or subscription status cannot be verified, advertising is blocked. Dashboard, predictions, Today, Picks, Parlay, Results, Bet Tracker, Account, billing, authentication, Privacy, Cookies, and API routes remain ad-free.

Google AdSense publisher ca-pub-9383931334339710 is used for paused Google consent-message verification on approved public content pages, including the landing page, for logged-out visitors and server-verified Free accounts. The publisher tag can load there, but advertising requests remain paused even after acceptance. Auto ads and both application advertising activation gates remain off; live advertising is not enabled and approval is unconfirmed. Direct sponsor banners on the homepage are separate advertisements linked to the sponsor website; they are not evidence that Google ad serving is active.

Any future advertising is restricted to approved public content routes, including the landing page. Authentication, signup and login, billing, API, match predictions, and Bet Tracker pages are excluded. Analytics acceptance does not authorize advertising; Google advertising consent signals remain denied. The separate Google Privacy & messaging consent flow must pass real browser verification before activation. Personalized ads to EEA, UK, and Swiss visitors require a Google-certified consent management platform integrated with IAB TCF. Google may process request IP addresses, browser information, public editorial context and consent choices while providing the message; no private application data or analytics preference is passed to that flow.

If activated after the required setup, Google and its advertising partners may process IP addresses, browser and device information, public page context, cookies or similar identifiers for ad delivery, measurement, fraud prevention, and personalization where permitted by the visitor's choices. Advertising choices and withdrawal must be available separately from analytics. See how Google uses information from sites that use its services.

Google Analytics 4 is optional and uses measurement ID G-NDJQJHQ7E9. DeePicks does not load the Google script or send analytics requests unless the visitor accepts analytics. After acceptance, the application manually sends allowlisted public-page views and public sign-up-link clicks using canonical public paths. Automatic page views are disabled, and Enhanced Measurement must remain disabled in the GA4 web data-stream settings.

Analytics events exclude query strings, fragments, authentication tokens, email addresses, application user IDs, private Bet Tracker data, billing details, private-page URLs, and referrers. Google may process browser or device information, the request IP address, and analytics identifiers as part of providing GA4. The persistent Cookie settings control supports rejection and withdrawal; withdrawal clears recognizable GA cookies and reloads the page without analytics.

Privacy and Cookies pages never load analytics or advertising scripts, even after acceptance. Navigation between editorial, disclosure, and application pages loads a fresh document so executed third-party scripts cannot follow into private or disclosure pages. Google's European regulations message has been published in the AdSense account, and its paused bootstrap is prepared for verification; its advertising controls are separate from analytics preferences. Advertising privacy settings on eligible editorial pages supports reopening when the Google API is ready. Advertising requests remain paused while consent acceptance, rejection and withdrawal are verified.