Privacy Policy

Information We Handle

Account information includes your Firebase account identifier, email, display name, sign-in providers, age-18 and gambling-content acknowledgements, and recorded acceptance versions and times when provided. Firebase handles sign-in credentials. We do not receive your Google password.

Competition records include memberships, entry/payment status, virtual balances, bets, results, rankings, referral relationships and rewards, friend/group activity, notifications, support messages and administrative decisions. A permission-based push subscription stores a notification token, account association and basic platform category.

Optional boost requests store the account screenshot you upload, its submission reference and review decision. A screenshot can contain additional personal information: crop or redact irrelevant balances, transactions, addresses and identifiers, and never submit passwords, full card details or security codes.

Article comments store your account identifier, display name, text, timestamps, moderation status, review flags and decisions. Approved comments and display names are public; pending or rejected comments are not publicly listed. Removing a public comment hides it; it does not by itself erase moderation records.

Why We Use It & What Is Public

We use information to authenticate accounts, administer entries and prizes, calculate results, manage referrals and social features, moderate comments, provide notifications and support, investigate errors or abuse, and meet applicable legal obligations.

Competition names, player display names, ranks, fantasy balances, strikes and permitted competition activity may be visible in public standings or to other entrants. Betting selections are restricted during open betting windows according to the app’s privacy controls. Do not use a display name that reveals information you want kept private. Contact and verification records are not public leaderboard fields.

If necessary account or entry information is withheld, the relevant account, entry, support or prize process may not be available. Boost evidence and push notifications are optional; refusing them means those optional features are unavailable, not that a prize is automatically forfeited.

Phone Verification & Google Processing

Johnathon (CagePunters) collects your mobile number to verify control of it and help prevent duplicate competition entries. If you choose Send Code, your number is sent to and stored by Google through Firebase Authentication; Google also uses it to improve spam and abuse prevention across Google services, including Firebase. Firebase phone verification uses reCAPTCHA and related security processing. Your number is linked to your existing account. CagePunters stores a private, competition-specific keyed reference for duplicate checks; this is personal information, not anonymous data. This is an app requirement where enabled, not a statement that Australian law requires SMS. Verification is not consent to marketing. Accounts that existed at the fixed SMS activation cutoff are permanently exempt, including future competitions and payouts. If you are a new account subject to verification and decline, you cannot complete an entry that requires it; contact admin@cagepunters.com.au for recovery or review. Read the Privacy Policy for overseas processing, retention, access and complaints.

Google/Firebase holds the full linked phone number in Authentication. Where a competition check applies, CagePunters creates a private keyed phone reference (HMAC) scoped to that competition and associates it with the account and verification/review records. The reference is pseudonymous, not anonymous. It is not shown in public player records. A phone number is evidence of control at a time, not proof of one unique person.

CagePunters does not use verification numbers as a marketing subscription or collect device fingerprints for this verification scheme. Google, reCAPTCHA and hosting providers may process IP addresses, browser/device information and security logs for their own delivery and abuse-prevention functions. This is separate from CagePunters deciding that a person is fraudulent.

Usage Measurement & Browser Storage

Signed-in usage measurement records account-linked login/page counts, competition context, app-install/standalone observations and use of social features. Partner-link measurement can include your account identifier, email and click timestamps. These are not described as anonymous analytics. Limited performance measurements record timing and page context.

Browser local/session storage supports sign-in, theme preferences, saved stories, notification ownership, cached account views and measurement deduplication. Browser controls can clear or restrict storage, but sign-in or some features may then stop working. No blanket claim is made that all provider logs or cookies are disabled.

Service Providers, Public Content & Overseas Handling

Google/Firebase supplies authentication, the database and push messaging; Vercel hosts the website and server functions. Authorised administrators access information needed for support, competition operation and private review. Information may also be disclosed where required or authorised by applicable law, or to resolve a complaint or protect legal rights.

The app is configured for Sydney compute and its default Firestore database has been confirmed in Sydney. That does not mean every service processes data only in Australia. Google documents Firebase Authentication as operating from US data centres; phone verification also uses Google’s spam/abuse systems. Vercel describes processing in the United States and other places where it and its service providers operate.

External links such as Unibet, Instagram and Facebook open services with their own privacy practices. Opening a link may disclose ordinary web connection/referral information to that service. The boost-review flow does not automatically send your uploaded evidence to Unibet. Overseas provider arrangements must be considered when personal information is handled; the phone checkbox is not a blanket waiver of privacy rights.

Security, Retention & Removal

We use access controls and private server-side verification/review records to limit access. No online service can guarantee absolute security. Keep credentials secure and report a suspected problem to admin@cagepunters.com.au without including passwords or SMS codes.

Records are retained for account and competition operation, support, disputes, integrity and any applicable legal recordkeeping requirements. There is not yet an automatic deletion schedule covering all account, screenshot, comment, analytics and verification records. We do not promise deletion within a fixed period that the service cannot currently deliver.

You can request access, correction or removal through the privacy contact. We assess identity proportionately, what information is held, what can be removed and whether a limited record must remain for an active competition, dispute or legal obligation. We will explain the outcome and any applicable limits. Deleting a phone reference without reviewing active entry claims can undermine duplicate-entry checks. Provider backups and provider-held Authentication data have their own lifecycle; deleting one app record does not instantly delete every provider copy.

Contact, Complaints & Marketing

Contact admin@cagepunters.com.au to request access or correction, ask about retention or overseas handling, raise a privacy concern or seek an explanation of a verification decision. Give enough information to locate your account and describe the issue, but do not send unnecessary identity documents.

We will consider requests and complaints and explain the outcome. Where the Privacy Act applies, access, correction, security and complaint obligations continue to apply; this policy does not limit them. If unresolved, you may contact the Office of the Australian Information Commissioner where it has jurisdiction. The OAIC generally asks people to complain to the organisation first and allow 30 days for a response.

SMS verification consent is not marketing consent. No marketing subscription is created by accepting these terms, entering a competition or verifying a phone. Any future marketing choice must be separate and voluntary, with appropriate sender identification and a working unsubscribe process. Browser permission for notifications is also separate from agreement to receive marketing.

Policy Versions

This policy states the handling described for this release. Material changes will be explained and a new version identified. Changes do not turn an earlier acknowledgement into acceptance of a new version or retrospectively remove an existing account’s SMS exemption.