1. Who we are
Project Punt is operated by Project Punt Pty Ltd (ACN 701 641 698, ABN 99 701 641 698), of Sydney, New South Wales. That company is the entity responsible for the personal information described below.
2. What we collect
Account information
Your email address (used to sign you in and for essential account messages), and your subscription status.
Your research and bet tracker entries
The lines you type, the players you look up, and any bets you log in the tracker — including stake, price and your settlement (won / lost / void). This is stored so the tracker works across devices.
Slips you add from your bookie
When you track a slip you added from a screenshot or pasted text, we keep a copy of what the slip says: its legs, each leg's price, the multi's price, the bookie, the game and the date. We keep this for every slip you track that way, and use it to make Punt's prices closer to what bookies really pay. We don't keep the picture or its text, and we don't keep your stake. Screenshots are read on our own server. When it can't read them, or finds no leg in them Punt can check, every screenshot in that read (up to three) is sent to Anthropic's reader instead (section 5). The copy is kept against your account, so deleting your account deletes it too.
Settlement emails
When a pick you tracked settles, we email you the result — one per settlement run, with a permanent one-click unsubscribe.
Notebook emails
If you give us your email address on an article, we store it with the page you were on and send one confirmation. Nothing else is sent until you click the link in it. Every email after that has a link to stop them, and stopping deletes nothing you did in the app — it is a separate list from your account.
Usage data
Pages visited, features used, device and browser type — aggregated product analytics that help us improve the service. We use two analytics tools: a cookieless one built into our hosting provider, and Google Analytics, which uses cookies to recognise returning visitors (see section 8, Cookies). Neither receives the private part of a page's address: the legs and prices in a shared slip, the code in a link we emailed you, and anything you searched for are taken out before a page view is sent.
Questions you ask Tally
When you type a question to Tally, or tap one of its ready-made questions, we keep the words, the page you asked from (the player, stat and line on screen), and whether Tally could answer it. We do not store the answers. If you're signed in, the question is kept against your account, so deleting your account deletes your questions too. We never keep your IP address with a question, and an email address typed into the box is removed before it's saved. We keep the words of a question for 12 months; after that we delete them and keep only the count (that a question was asked, on which page, and whether Tally could answer it). The same goes for questions asked of Ask Punt, the assistant Tally replaced.
We read these questions each week as one list, with no names or email addresses on it: which questions come up most, and which Tally couldn't answer, so we know what to build next. Questions Tally can't read on the page itself are processed by our AI provider to work out what was asked, per section 5, Who we share it with.
Questions Tally sends to our AI provider cost us money, so they have a daily limit. To count your questions against that limit we keep a running total for the day — against your account if you are signed in, and otherwise against a one-way scrambled form of your IP address that cannot be turned back into the address. Those totals are deleted after a week and are never used for anything except the limit.
Tally's ready-made questions are free, and everyone gets some free typed questions each week before the subscription. To count them we keep one number and the week it is for: against your account if you are signed in, and otherwise in a cookie on your browser that holds only those two. It doesn't record which questions you asked, and it is used for nothing except that count.
Where you came from
If you first arrived through someone's share link, we keep a cookie for up to 30 days and, if you sign up in that window, record which link brought you — so the person who referred you can be credited. If the link carried campaign tags (the kind a post or a video description adds), we keep those the same way, so we can see which article or video brought you. On your first visit we also note the name of the site that sent you (just the site, such as “instagram” or “google”, never the page you were on or what you searched) and the first page you opened here, and record those the same way if you sign up. Those facts are all the cookies are for.
Moonshot, the daily game
The game gives your browser a random id; you never sign in to play. For each question we keep the answer you landed on, and any answer the game didn't accept, exactly as you typed it, so we can show how many players gave each answer and add the right answers we missed to our lists. These are kept against a scrambled version of that random id, never your account, email or IP address, so please don't type anything personal into the answer box. If you put a name up on the Hall of Fame, everyone who opens the game can see it.
Payment data
Payments are processed by our payment provider. We never see or store your full card number — only the last four digits and expiry for your records.
3. What we never collect
- Your bookmaker account credentials — we don't have them, don't ask for them, and you should never share them with anyone.
- Your actual wagers with operators. Bets in the tracker are self-reported by you.
- Precise location. We infer coarse region (e.g. state) from IP for analytics, nothing finer.
4. How we use it
- Running your account, subscription, and bet tracker.
- Sending essential service emails (sign-in links, receipts, renewal notices, material terms changes). Marketing email is opt-in and every one has an unsubscribe.
- Aggregated, de-identified analysis to improve the product — for example, which stat pages get used most.
5. Who we share it with
The minimum set of processors needed to run the service, named so you can look each one up:
- Supabase — sign-in and the database, hosted in Sydney.
- Vercel — the servers that build and serve the site, in Sydney, plus page-view analytics that set no cookie.
- Stripe — payments. Your card details go to Stripe directly and never touch our servers.
- Resend — the service emails in section 4, and the notebook emails if you asked for them.
- Sentry — error reports. When a page or a server request fails, Sentry receives the page's address, the browser type and the technical trace of what broke, so we can fix it. The address has the same private parts taken out as a page view (section 2). It never receives a stake, a line, a slip or your account details.
- Google — Google sign-in if you choose it, and Google Analytics per sections 1 and 7.
- Anthropic — for Tally, and as the backup reader for slip screenshots. For Tally it receives your question and the on-screen stats needed to answer it. When Punt's own reader can't read the screenshots you add, or finds no leg in them Punt can check, every screenshot in that read (up to three, each 6 MB or smaller) goes to Anthropic to be read. We allow ten backup reads a day per account. It receives the screenshots themselves and whatever they show: if one shows your bookie balance or username, that goes with it. It never receives your Punt account details, such as your email address, and does not train on what it receives. We keep only what the slip says, as above, never the pictures.
Each is bound by contract to process data only on our instructions. We never sell or rent personal information, and we never share your betting activity with bookmakers, advertisers, or data brokers.
6. Your rights
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you can:
- Access the personal information we hold about you.
- Correct anything that's wrong.
- Delete your account and associated data — self-serve from Settings, or by emailing us. Deletion is immediate and irreversible.
- Export your bet-tracker history as a CSV anytime, also from Settings.
7. Retention and security
Data is hosted in Sydney, Australia, with one exception: Google Analytics data is processed on Google's servers, which may be located overseas (including the United States). We keep account data while your account is active; after deletion, backups roll off within 30 days. The words of questions you ask Tally are kept for 12 months, then deleted (section 2). Access within the company is limited to what's needed to operate the service.
8. Cookies
We use a small number of functional cookies (keeping you signed in, remembering preferences, counting your free Tally reads), a cookieless product-analytics tool, and Google Analytics, which sets cookies to measure how the site is used — including recognising whether you've visited before. We don't use Google Analytics for advertising, and there are no third-party advertising trackers.
Two of the functional cookies remember players: the last three you opened, so the app can take you back to them, and, if you arrived through a link from our Instagram or from ChatGPT, the player that link opened, so that player stays open to you for a week. Each page reads them as it loads; we don't save them anywhere, and neither holds your name or anything you typed.
One more remembers that this browser has seen the short story we show on a first visit, so it shows once. It holds the word “seen” and nothing else, for a year.
9. Children
The service is strictly 18+. We don't knowingly collect information from anyone under 18 and will delete any we discover.
10. Contact and complaints
Privacy questions or requests: privacy@projectpunt.com.au. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).