Privacy policy
Updated 16 October 2026
Who is responsible
Giorgi Badagadze, Berlin, Germany, operates StatsGem and is the controller of the personal data described here. For privacy questions or requests, email contact@statsgem.com. This notice covers the website, accounts, subscriptions, optional email and connected Telegram features.
Data and purposes
Accounts: email address, name, account ID, language, access role, subscription state and requested settings. Sign-in and security: hashed one-time codes and session tokens, expiry times, sign-in attempts, IP addresses and user-agent information. These support account access, service delivery, abuse prevention and troubleshooting.
Age and terms: the country or territory you declare, declaration time and wording version are stored in a signed browser cookie. This is self-certification; no date of birth, identity document or independent age verification is collected in this flow. It is not an account-level proof of identity or age.
Payments: Stripe customer, subscription, invoice and payment-event identifiers, plan, status, trial and service-credit records. Stripe collects payment details on its hosted payment pages; our application does not store full card numbers. Contact requests include the message you send, email correspondence and delivery metadata.
Connected Telegram: Telegram user/chat identifiers, linked account, preferences and message/interaction delivery records, only when you connect or use the feature. We record first-party prediction usage counts by channel and tier, with an account ID when signed in, to measure delivery and service use. These operational records are separate from optional Umami browser analytics.
Legal bases and optional tracking
We process data needed to provide requested accounts, subscriptions and notifications under GDPR Article 6(1)(b); security, fraud prevention, necessary operational usage measurement and support under Article 6(1)(f), balancing our legitimate interests against your rights; and legally required billing or compliance records under Article 6(1)(c). Required account fields are necessary to supply the relevant feature.
Optional Umami audience analytics and promotional email rely on separate consent under Article 6(1)(a). Analytics is disabled until you allow it in Privacy settings; rejecting it does not restrict the service. Promotional email is off until separately enabled in your profile. Sign-in, billing and security messages are service messages and do not depend on marketing consent.
When allowed, self-hosted Umami measures page URLs, referrers, browser/device information and coarse location. It is configured for cookieless measurement, not advertising or cross-site profiling. Privacy signals (Do Not Track and Global Privacy Control) suppress the tracker. We do not sell your personal data or use automated decisions with legal or similarly significant effects on you.
Recipients and international transfers
The application and self-hosted analytics are hosted with IONOS in Germany. Authorised service operators and processors may access data needed for hosting, backups, transactional email, support and payment processing. Stripe handles billing, and Telegram processes information when you choose its features. Plunk delivers transactional email; contact us for current processor and data-processing details.
External providers may process information outside the EEA under their applicable terms. Where we arrange restricted international transfers, GDPR safeguards such as an adequacy decision or standard contractual clauses are required as applicable. You may request information about recipients and the safeguards relevant to your data. Opening an external support or bookmaker website is subject to that site’s privacy notice.
Retention and deletion
Account data is kept while the account exists. Account deletion removes linked sessions, account preferences and related account records; historical prediction-usage records lose their account link. Detailed prediction-usage records are scheduled for pruning after 90 days, while aggregate totals remain. Sign-in codes expire after 10 minutes; expiry prevents use but does not itself delete a security record.
Privacy and age-declaration cookies last up to 180 days; requested language, timezone and appearance settings up to one year; session cookies expire with the account session. Support correspondence, security logs and delivery records are retained for resolving the request, investigating abuse or establishing and defending legal claims; legally required financial records are retained for the applicable statutory period. Backup copies disappear through backup rotation rather than immediate individual deletion.
Promotional-email preference records include account ID, current choice, wording version, time and source of changes, and are removed with account deletion. You can withdraw email consent through your profile or each promotional email’s unsubscribe link. You can withdraw analytics consent at any time in Privacy settings; this stops future browser analytics without affecting earlier lawful processing.
Your rights and complaints
Subject to the conditions in data-protection law, you can request access, correction, erasure, restriction and data portability, object to processing based on legitimate interests, and withdraw consent at any time. You may object to direct marketing at any time. Email contact@statsgem.com; we may need proportionate information to verify that a request relates to your account.
You may complain to a data-protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information or the authority in your country of residence, work or the alleged infringement. We update this notice when processing changes.