Privacy Policy

1. About this policy

TippingMates is a social sports-tipping service for private groups. Members can create or join tipping competitions, submit tips and predictions, receive reminders, and compare results on a group leaderboard. TippingMates does not offer wagering, odds, entry-fee prize pools or betting services.

TippingMates is operated by WebSupreme Pty Ltd (ABN 76 612 460 536) of Level 4, Shop 4023/17 Patrick St, Blacktown NSW 2148 ("TippingMates", "we", "us" or "our").

This policy explains how we collect, hold, use and disclose personal information through:

• the TippingMates iOS and Android apps;
• the TippingMates website and waitlist;
• invitations, notifications and support communications; and
• any related services that link to this policy.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other privacy laws that apply to us.

2. Personal information we collect

The information we collect depends on how you use TippingMates.

Waitlist and contact information

We may collect:

• your email address when you join the waitlist;
• the content of messages and support requests you send us; and
• records of our communications with you.

Account and identity information

When you create or use an account, we may collect:

• your email address and display name;
• your date of birth or an age-status or age-band derived from it;
• an optional profile photo;
• identifiers supplied through Sign in with Apple or Google Sign-In;
• authentication, session and account-security information; and
• your account status, preferences and subscription entitlement.

TippingMates uses passwordless sign-in. We do not ask you to create a TippingMates password. Email one-time codes are short-lived and are used to verify control of an email address.

Competition, invitation and tipping information

We may collect:

• competitions you create or join, membership roles and membership status;
• competition names, settings, cover selections and, if enabled, uploaded cover images;
• invitations you send or receive, invitee email addresses, join requests and approval decisions;
• your tips, score or margin predictions, submission times and lockout status;
• points, rankings, bonuses, streaks, round results and season results;
• scoring changes, result corrections and related audit history; and
• notification-inbox activity, including whether a message has been read.

Device, usage and diagnostic information

We may automatically collect:

• IP address, device type, operating system, app version, browser type and language;
• approximate location inferred from IP address, such as country or city, rather than precise GPS location;
• app interactions and product events, such as creating a competition, joining a competition or submitting a first tip;
• crash reports, performance data and diagnostic logs;
• security and authentication events; and
• a push-notification token if you enable push notifications.

We do not need your precise device location to operate TippingMates and do not intend to collect it unless a future feature clearly requires it and you are told before collection.

Information stored locally on your device

The app may store limited preferences on your device, such as:

• the competition you last viewed; and
• whether you accepted, denied or dismissed a notification-permission prompt.

This information is used to restore your app experience. It is not necessarily sent to us unless the app needs to synchronise it with our systems.

Subscription information

If paid access is introduced, Apple or Google will process your payment. We may receive a transaction or receipt identifier, subscription status, product purchased, renewal or expiry status, and limited information needed to verify your entitlement. We do not receive your full payment-card details from the app store.

3. How we collect personal information

We collect personal information:

• directly from you when you join the waitlist, register, update your profile, upload a photo, submit a tip, configure a competition, contact us or adjust a preference;
• from another user when they enter your email address to invite you to a competition;
• from a competition owner or co-owner when they review or decide a join request;
• from Apple or Google when you choose their sign-in or app-store services;
• automatically from the website, app, servers and security systems; and
• from service providers that help us operate authentication, hosting, email, notifications, analytics, crash reporting and subscriptions.

If a competition owner gives us another person's email address, they should only do so where they reasonably believe that person would expect the invitation. We use an invitee's email address to deliver or surface the invitation, prevent it being accepted by the wrong account, and protect the competition's membership controls.

If you receive an invitation before creating an account, we will give you a link to this policy in the invitation or as soon as reasonably practicable.

4. Why we use personal information

We may use personal information to:

• create, authenticate, secure and support your account;
• confirm that you meet the minimum age and apply age-appropriate protections;
• operate private competitions, memberships, invitations and join requests;
• record and lock tips, calculate scores, settle results and maintain leaderboards;
• show members how scores were calculated and notify them of scoring or result changes;
• send one-time sign-in codes, invitations, tip reminders, results and other service messages;
• provide an in-app notification inbox and, if enabled, push notifications;
• process and verify subscription entitlements;
• respond to questions, access or correction requests, complaints and account-deletion requests;
• monitor reliability, diagnose crashes, measure product performance and improve the service;
• prevent fraud, abuse, unauthorised access and attempts to bypass tipping rules;
• comply with law, enforce our terms and protect users, TippingMates and others; and
• send product news or promotional communications where you have agreed to receive them or where applicable law otherwise permits them.

Where European, UK or similar privacy law applies, we rely on one or more of the following legal grounds:

• performance of a contract, to create an account and provide the service you request;
• legitimate interests, to secure, maintain, analyse and improve TippingMates, prevent misuse and communicate essential service information;
• consent, for optional marketing or another activity where consent is required; and
• legal obligations, where we must retain, use or disclose information to comply with law.

You may withdraw consent at any time, but this will not affect processing that occurred before withdrawal.

5. What other TippingMates users can see

TippingMates competitions are private and are not publicly searchable at launch. Information is nevertheless shared within a competition so the game can work transparently.

Depending on your role and the competition's status:

• competition members can see your display name, profile photo or initials avatar, membership role, points, rank, bonuses and relevant results;
• your tips and feature-game predictions remain hidden from other members until the relevant match locks;
• after lockout, competition members can see members' submitted tips and predictions;
• after settlement, competition members can see the points awarded for each match and round;
• owners and co-owners can see and manage membership, invitations and join requests;
• a person opening a valid share link or QR code may see limited competition-preview information, such as the competition name, sporting competition and creator's display name, before requesting access; and
• removed or blocked members lose access to the competition.

Do not use a display name, photo or competition name that reveals information you do not want the relevant group to see.

6. Invitations and information about other people

TippingMates supports two invitation paths:

1. An owner may enter a friend's email address. The invitation is matched to that email address and appears as an in-app invitation for the matching account. If no matching account exists, we may send a transactional email asking that person to download TippingMates and sign in with the invited email.
2. A person may open a shared link or scan a QR code and request to join. The competition's owner or co-owner then approves or rejects the request.

We do not use an invitee's email address for unrelated marketing merely because another user invited them. We retain pending and completed invitation records only for as long as reasonably needed to operate the invitation, maintain security and resolve disputes.

7. Notifications and marketing

Important service information may be delivered through the app, by email or through the in-app notification inbox. This can include sign-in codes, invitations, join-request outcomes, security notices, scoring changes and result corrections.

Push notifications are optional. You can manage them through the app's settings and your device settings. Turning off push notifications does not remove messages from the in-app notification inbox.

You can unsubscribe from promotional email using the link in the message or by contacting us. Unsubscribing from marketing will not stop essential account, security, invitation, subscription or service messages.

We do not sell personal information. We do not use personal information for targeted gambling advertising, and TippingMates does not carry bookmaker advertising or betting promotions.

8. Website cookies, analytics and crash reporting

The TippingMates website uses strictly necessary technologies to operate the site, prevent spam, maintain security and remember choices.

We use analytics and crash-reporting tools to understand whether key features work, diagnose failures and improve performance. The providers we use, and the information they receive, are:

• App analytics provider: Firebase Analytics (Google)
• Crash-reporting provider: Sentry
• Website analytics provider: Google Analytics 4 (Google). It records the pages viewed, the site that referred you, an approximate location derived from a truncated IP address, your device and browser type, and any campaign tags attached to links we publish. It sets first-party cookies so a repeat visit is not counted as a new person.

We have configured Google Analytics with IP anonymisation on, and with Google Signals and advertising personalisation switched off, so this information is not used to build an advertising profile of you. You can opt out of Google Analytics on every website using Google's browser opt-out add-on, or by using your browser's tracking-protection settings.

We do not use third-party advertising trackers. TippingMates does not carry bookmaker advertising or betting promotions, and we do not use your personal information for targeted gambling advertising. If our tracking practices materially change, we will update this policy and obtain consent where required.

9. When we disclose personal information

We may disclose personal information:

• to other TippingMates users as described in section 5;
• to cloud-hosting, database, storage, authentication, email, push-notification, analytics, crash-reporting, support and security providers that process information for us;
• to Apple and Google where you use their sign-in, app-store, subscription or notification services;
• to professional advisers, auditors and insurers where reasonably necessary;
• to regulators, courts, law-enforcement bodies or other parties where required or authorised by law, or where reasonably necessary to protect rights, safety or security; and
• in connection with an actual or proposed merger, acquisition, financing, reorganisation or sale of all or part of the business, subject to appropriate confidentiality and privacy safeguards.

Our core infrastructure is currently intended to use Render for application hosting and Supabase for database and object-storage services. Our sports-data suppliers provide fixtures and results; we do not intend to give them TippingMates account information unless this becomes necessary and is disclosed in an updated policy.

Service providers may use personal information only to perform services for us or as otherwise permitted by their contracts and applicable law.

10. Overseas processing and disclosure

Some service providers may store or process personal information outside Australia. The countries in which recipients are likely to be located currently include:

• Singapore — application hosting (Render) and database/file storage (Supabase);
• United States — Google (Firebase Analytics, Firebase Cloud Messaging push notifications, Google Sign-In) and Apple (Sign in with Apple, Apple Push Notification service);
• United States — Sentry (crash and error reporting); and
• United States — Zoho Corporation (ZeptoMail, transactional email delivery).

Where Australian Privacy Principle 8 applies, we take reasonable steps before disclosing personal information overseas to ensure that the recipient handles it consistently with the Australian Privacy Principles. Depending on the circumstances, these steps may include due diligence, contractual protections, access controls, data minimisation and security review.

Information processed in another country may be subject to that country's laws and lawful government-access requirements.

11. How long we retain personal information

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the service, keeping competitions accurate, resolving disputes, maintaining security and complying with law.

Our retention approach includes:

• Waitlist information: until we have notified you about launch and completed related communications, unless you ask us to delete it earlier or agree to receive ongoing updates.
• One-time sign-in codes: only for their short validity period. Limited security logs about issuance and attempts may be retained longer to prevent abuse.
• Account and profile information: while your account is active and for a limited period afterwards where reasonably required for security, legal or dispute purposes.
• Competition and tipping records: for the life of the competition and any archive period made available to members. If you delete your account, information needed to preserve the integrity of other members' historical results may be de-identified rather than removed.
• Notification inbox: generally the latest 90 days or the current season to date, whichever is longer, subject to technical and legal requirements.
• Invitations and join requests: until accepted, declined, cancelled or expired, plus a limited period for security, audit and dispute resolution.
• Subscription and transaction records: for the period required for entitlement verification, accounting, tax, fraud prevention and consumer-law compliance.
• Support, security and diagnostic records: for a period proportionate to the issue, risk and legal requirements.
• Backups: until they are overwritten through our ordinary secure backup-rotation process.

When information is no longer required, we take reasonable steps to delete it or de-identify it.

12. Account deletion

You can request deletion within the app or contact us. Subject to any information we must retain by law or for a permitted purpose, account deletion will:

• remove or de-identify your account and profile information;
• remove your profile photo from active use;
• end your membership of active competitions; and
• remove or de-identify associated personal information.

We may retain de-identified competition records so that historical scoring and ladders for other members remain coherent. Limited records may also be retained where reasonably necessary to prevent fraud, establish or defend legal claims, comply with law or complete our backup cycle.

13. Security

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps may include:

• encryption in transit and, where supported, at rest;
• role-based access controls and restricted administrative access;
• authentication controls, short-lived one-time codes and session management;
• monitoring, logging, rate limiting and abuse prevention;
• secure development, dependency management and vulnerability remediation;
• provider due diligence, backups and incident-response procedures; and
• deletion or de-identification when information is no longer required.

No online service can guarantee absolute security. Please contact us promptly if you believe your account or information has been compromised.

If an eligible data breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

14. Age requirements and younger users

TippingMates is intended for people aged 18 and over. People under 18 must not create or use an account.

We collect an affirmative 18-and-over declaration (and, on some servers, date-of-birth or age-status information) to enforce this rule and to apply age-appropriate privacy protections. Where practical, we will retain an age-eligibility result rather than more detailed date-of-birth information when the detailed information is no longer needed.

Australian privacy law treats a person under 18 as a child for the Children's Online Privacy Code. Because TippingMates does not knowingly permit anyone under 18 to hold an account, we do not intend to collect or handle a child's personal information in the ordinary course of the Service. If that ever changes for a particular feature, our approach would include private-by-default competitions, no behavioural advertising or sale of personal information, clear notices, data minimisation, proportionate age assurance and controls appropriate to the risks of the service.

If we learn that a person under 18 has created an account or that we collected their personal information contrary to this policy, we will take reasonable steps to close the account and delete or de-identify the information. A parent, carer or affected person can contact us using the details below.

15. Access, correction and privacy rights

You may access and update certain profile information in the app. You may also contact us to:

• ask what personal information we hold about you;
• request access to or a copy of that information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information or your account;
• object to or ask us to restrict certain processing;
• withdraw consent where processing is based on consent; or
• make a privacy complaint.

Depending on where you live, you may have additional rights, including data portability and the right to complain to your local privacy or data-protection regulator.

We may need to verify your identity before completing a request. In limited circumstances, applicable law may allow or require us to refuse a request. If that happens, we will explain the reason where we are legally permitted to do so.

We will not discriminate against you for exercising an applicable privacy right.

16. Privacy complaints

Please contact us first if you have a privacy concern:

Privacy contact: TippingMates Team
Email: tippingmates@websupreme.com.au
Postal address: Level 4, Shop 4023/17 Patrick St, Blacktown NSW 2148

Please describe the issue and provide enough information for us to investigate. We will acknowledge the complaint and aim to provide a substantive response within 30 days. If we need more time, we will tell you why and provide an expected response date.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (oaic.gov.au) or, where applicable, the privacy regulator in your country.

17. Changes to this policy

We may update this policy as TippingMates develops, our providers change or legal requirements evolve. The "Last updated" date shows when the policy was most recently revised.

If a change materially affects how we handle personal information, we will take reasonable steps to notify you through the app, by email or by another appropriate method before the change takes effect where required.

18. Contact us

For privacy questions, requests or complaints, contact:

WebSupreme Pty Ltd trading as TippingMates
ABN: 76 612 460 536
Email: tippingmates@websupreme.com.au
Address: Level 4, Shop 4023/17 Patrick St, Blacktown NSW 2148