Privacy policy

• Your email address and OAuth profile. When you sign in with Discord, Google or Apple we receive your email address, a display name and an avatar image URL from that provider, plus the provider's own account identifier. We never receive or ask for your password at any provider. If you use Sign in with Apple and choose to hide your address, we only ever see the Apple private relay address and that is all we store.
• What you save in the app. Bets you log or import, picks you track, filters and price alerts you set, and any public capper profile you choose to create.
• Marketing consent. Only if you tick the optional box: whether you opted in, the moment you did it, and where you did it (sign up or account settings). We store that so we can prove the opt-in was real.
• Basic usage analytics. Page views and aggregate traffic data collected by our hosting platform, plus standard server request logs. We do not run advertising trackers and we do not build advertising profiles.
• Outbound link clicks. If you follow a link to a sportsbook we record that a click happened, which book it was and which page it came from, so we can be paid correctly and audit our own rankings. See how we make money.
• A device and browser fingerprint. Once per browser per day we collect a detailed technical profile of your device and send it to a research dataset run by TBU Pro, a separate company. It is not linked to your account and nothing in Parlae reads it back. It is the most invasive thing on this page, so it has its own section below, including how to switch it off.

The email address and provider identifier exist so an account can exist: so your bets, filters and alerts follow you to another device, and so we can reach you about your account if something breaks. Saved bets and picks exist because they are the product. Analytics tell us which pages are worth keeping. Click records exist because that is how the site is funded, and because our honest ranking claim has to be auditable.

We send marketing email only to people who ticked the optional box. Signing in does not opt you in, and nothing in the app is gated on marketing consent.

Every visitor, signed in or not, has a detailed technical profile of their device and browser collected once shortly after the page loads, and sent to a public ingest endpoint run by TBU Pro at tbupro.com. TBU Pro stores it and a separate research project analyses it. Nothing in Parlae reads it back, it is never joined to your account, and it has no effect on the odds, prices or picks you see.

This is fingerprinting, and it is thorough: the combination of values below identifies a device without any cookie. We run TBU Pro's collector unmodified, so a device already recorded elsewhere is recognised as the same device instead of being recorded twice. The collection runs twice per capture, once on the page and once on a background worker thread, because the two report slightly different values.

It runs at most once per browser per day, only on a secure connection, and only in a browser that lets us save the setting below - if your browser blocks site storage we cannot record your choice or enforce that daily limit, so we do not collect at all.

What the capture contains

• Browser identity: user agent, platform, browser vendor, language list, and the client hints your browser exposes, including CPU architecture, device model, platform version and full browser version, plus the legacy app-version string and whether a Chrome extension bridge is present.
• Hardware: CPU core count, approximate device memory, maximum touch points.
• Display: screen and available screen size, colour and pixel depth, pixel ratio, orientation and window size.
• Graphics: WebGL vendor and renderer strings including the unmasked GPU identifiers, driver and shader versions, the full list of supported graphics extensions, and around twenty numeric capability limits. These are the most identifying values in the capture.
• A canvas rendering hash. Your browser draws a fixed test image off-screen and we send numeric hashes of the resulting pixels, plus the measured pixel width of the test string in a named font - a font-rendering signal in its own right. Small differences in how your GPU, drivers and fonts draw it are highly distinctive. The image itself is never sent and nothing appears on the page you are looking at.
• An audio rendering hash. Your browser renders a short tone through an audio compressor entirely in memory and we send a hash of the result, a sum of its sample values, the sample rate and the output latency. This is a rendering test, not a recording: your microphone is never accessed and no sound is played.
• Environment signals: whether the browser reports itself as automated, and a count and hash of the names defined in the browser's global scope, which changes with the extensions you have installed. We receive the count and the hash, never the names or any list of your extensions.
• Locale: time zone, resolved locale and winter/summer UTC offsets.
• Network: connection type, estimated round-trip time and downlink, data-saver flag.
• Storage: the storage quota your browser offers this site, how much is used, and the per-subsystem breakdown of that usage. Numbers only, never the contents.
• Display preferences: wide-colour support, reduced motion, dark mode, fine pointer, hover.
• Diagnostics: which of the above checks failed or were blocked, this site's origin, and whether the page was served securely and cross-origin isolated.
• Your IP address, recorded by the receiving endpoint from the connection itself.

What it does not contain

• No cookies or session data. The request is sent with credentials omitted.
• No account, profile, email or sign-in identifier, and no logged-in state.
• No page address, referrer or browsing history beyond this site's origin. It cannot show anyone which Parlae pages you viewed.
• No canvas or audio content, only the hashes described above, which cannot be turned back into an image or a sound.
• No microphone, camera, location, contacts, clipboard, battery or file access.
• No list of your installed fonts or extensions. Note that the canvas measurement above is still a font-rendering signal, even though we never enumerate your fonts.
• No bets, picks or anything you typed into the site.

TBU Pro derives a fingerprint by hashing nine of these values together - platform, CPU cores, device memory, language, the four unmasked GPU strings and time zone - and keeps one row per distinct fingerprint. A device already in the table is discarded rather than recorded again, so the dataset shows that a device has been seen, not how often you visit or what you did. Because those nine values describe a class of hardware rather than a person, two identical devices with identical settings become a single row, and changing your time zone or updating a graphics driver creates a new one.

We take no money for your personal data. We do not sell, rent or trade it, we do not share it with data brokers or advertising networks, and we do not use it to target advertising to you anywhere.

We do share two things, and we would rather name them than hide behind that sentence. First, the ordinary providers needed to run the site: our hosting and database provider, our email sending provider, and the sign-in provider you chose. Second, and more significant: the device fingerprint described above goes to TBU Pro, a separate company, which keeps it and provides it to a research project. That transfer is for their research purposes, not ours - we get nothing back from it and no money for it.

Some privacy laws, including California's, define selling or sharing broadly enough that a transfer like that one can count even where no money changes hands. We are not going to argue the point in a footnote. Treat the fingerprint transfer as something you can refuse: the switch above stops it, and we honour Global Privacy Control, which is the browser signal those laws use for opting out. Sportsbooks receive an anonymous tracking code when you follow a link, never your email address.

• Account data (email, profile, saved bets and picks): until you ask us to delete it.
• Marketing consent records: kept while the account exists, including after an opt-out, because the record of the opt-out is the proof that we stopped.
• Outbound click records: about 180 days, then purged automatically.
• Device fingerprints: no automatic expiry today. TBU Pro runs no retention window on that dataset, so rows persist until someone deletes them by hand. Ask us and we will have yours removed.
• Odds, scores and other market data: kept on rolling windows measured in hours to days and pruned automatically. It is not personal data.

• Device fingerprinting: use the switch in the section above, or turn on Global Privacy Control in your browser, which we honour automatically and which overrides that switch. We do not show a consent banner, and the capture runs a few seconds after a page opens - including this page - so by the time you read this, this browser has most likely already been recorded once. The switch stops every future capture, but it cannot recall that first one: to have it deleted, email hi@parlae.io.
• Marketing email: turn it on or off any time in account settings, or use the unsubscribe link in any email we send.
• Deletion: email hi@parlae.io from the address on the account and ask us to delete it. We remove the account, its profile and its saved bets and picks. We aim to do it within 30 days and we will confirm when it is done.
• A copy of your data: ask at the same address and we will send you what we hold.

Parlae is for adults only. The site is intended for people 21 and over and we do not knowingly collect data from anyone under 18. If you believe a minor has an account, tell us and we will remove it.

If we change what we collect or why, we change this page. Questions, deletion requests and privacy complaints all go to hi@parlae.io.

See also our terms of use and responsible gambling resources.