Privacy Policy
Last updated: 8 October 2026
This policy explains what personal data Moneyball Odds collects when you use the website, why, who else handles it, how long it is kept and what your rights are. It is written for the Indonesian Personal Data Protection Law (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, "UU PDP"), and it also describes the rights readers in the European Union and the United Kingdom have under the GDPR.
1. Who we are
Moneyball Odds is an independent football statistics and odds-analysis website, run from Indonesia. It is the controller of the personal data described here.
Moneyball Odds is not a bookmaker. It takes no bets, holds no money and has no account with any betting operator. Its prices come from its own statistical model, the Dixon-Coles · xG fusion model: a Dixon-Coles goal model fed with expected goals (xG), shots, big chances, pressure and other match statistics, which turns them into probabilities, fair odds and expected value. The model is about matches and teams, never about you.
2. The data we collect
When you create an account
- Email address and password, if you sign up with email. The password is handled by Google Firebase Authentication; Moneyball Odds never sees or stores it.
- Your Google name, email address, profile photo and Google account ID, if you sign in with Google. We receive only what Google shares for sign-in.
- Your username, the public name shown with your comments.
- Your email alert choices (football news, new odds, announcements), if you turn any on, with the confirmed email address they are sent to.
- Account details: your email address and whether you have confirmed it, how you sign in (Google, or an email and password), when you last visited, and, only if you add them under My account, your first and last name, a profile photo, what describes you (for example fan, scout or analyst), the organisation you work for and your job title or the club you support, your country and city, phone number, website or LinkedIn, and how you heard about us. They are used to run your account and to set up club licences, and only you and the Moneyball Odds team can see them. We never see your password.
- Payment proofs and messages: if your plan is not switched on after you paid, you can send us a screenshot of the PayPal receipt, the transaction ID and a note; and you can write to us from My account > Help and support. We keep them with your account ID and email so we can answer, and only you and the Moneyball Odds team can see them.
- Premium: whether your account is Premium and until when, and, if you reserve the launch price, the billing period you chose. Payments are taken by PayPal (earlier ones by Midtrans); card, bank and PayPal account details are handled by them and Moneyball Odds never sees or stores them. They tell us the name, email address, amount and status of each payment so we can switch Premium on; with PayPal we also pass your account number, so the payment reaches the right account.
- Your choices at sign-up: whether you want match previews and the latest stats by email, your confirmation that you are over 18 and have read these documents, and the time your account was created.
When you take part
- Comments and replies you post, the likes you give, and the time of each. These are public.
- User Predictions votes (three-way result, correct score, man of the match). Totals are shown publicly; your own ballot is stored with your account ID.
- Reports you file about a comment, with the reason. Only moderators can read them.
Stored in your browser
- Preferences (light or dark theme, decimal, fractional or American odds, the board view you chose) are kept in your browser's local storage. They never leave your device.
- Sign-in state: Firebase keeps you signed in using your browser's storage.
- The human check: when you pass the check that you are a person (at your first visit, then once a week), the time you passed it is kept in your browser so you are not asked again for a week.
Moneyball Odds uses no advertising cookies, no analytics or tracking tools and no third-party advertising.
Technical data
The services that run the site (section 5) see the technical details any website receives: your IP address, browser and device type, and the time of each request. They use them to deliver pages, keep accounts secure and prevent abuse.
Keeping robots out
To stop automated accounts, spam and scraping, the site checks that visitors are people: at the first visit, on the sign-up form and before a comment. The check looks at how the button is pressed and whether the browser is controlled by a program; if we switch on Cloudflare Turnstile or Google reCAPTCHA (through Firebase App Check), those services see technical details of your browser and device to tell people from robots, under their own privacy policies. Commenting also needs a confirmed email address, and the database accepts at most one comment every 20 seconds from an account.
What we do not collect
We do not collect card or bank details, identity documents, your location, your contacts, or any betting history. We do not buy personal data from anyone, and we do not sell it.
3. Why we use it, and on what basis
| Purpose | Legal basis (UU PDP Article 20; GDPR Article 6) |
|---|---|
| Creating and running your account, showing your username with your comments, counting your votes | Performing our agreement with you (the Terms and Conditions) |
| Sending match previews, the latest stats and the email alerts you choose | Your consent, given by ticking the box at sign-up. You can withdraw it at any time. |
| Moderating comments, handling reports, preventing spam, abuse and fraud, keeping the site secure | Legitimate interests: a safe and usable community |
| Answering your requests and complying with the law | Legal obligation |
We make no automated decisions about you that have legal or similarly significant effects. Three reports from different members hide a comment until a moderator reviews it; a person makes the final decision.
4. Football data
Match, team and player statistics (expected goals, ratings, lineups, live events and the rest) come from our licensed data provider, Sportmonks. They describe professional players' public sporting performance. We send Sportmonks no data about you.
5. Who handles your data
- Google (Firebase Authentication and Cloud Firestore) stores accounts, profiles, comments, votes and reports for us, as our processor. The Firestore database is in Google Cloud's Jakarta region (asia-southeast2), in Indonesia.
- GitHub (GitHub Pages) hosts the website and receives the technical data of each page request.
- Midtrans (PT Midtrans) takes payments for Premium as our payment provider and shares with us the name, email address, amount and status of each payment.
- PayPal takes subscriptions for Premium in US dollars and shares with us the name, email address, amount and status of each payment and of the subscription.
- Cloudflare (Turnstile) and Google (reCAPTCHA, through Firebase App Check), when switched on, check that visitors and requests come from people in real browsers.
- Google Fonts delivers the site's typeface, which shows your IP address to Google.
- Moderators appointed by Moneyball Odds can read reports and remove comments.
- Authorities, only when Indonesian law requires us to disclose data, or to protect someone's safety.
Each of these providers has its own privacy policy for the data it handles as a controller.
6. Transfers outside Indonesia
Our database is in Indonesia, but Google's sign-in service and GitHub operate worldwide, so some data (for example sign-in records and page requests) may be processed in other countries, including the United States. We rely on these providers' data protection terms and contractual safeguards, as UU PDP Article 56 requires for transfers abroad.
7. How long we keep it
- Account and profile: until you ask us to delete your account.
- Comments: until you delete them, a moderator removes them, or your account is deleted.
- Votes: until your account is deleted.
- Reports: until reviewed, and no longer than 12 months.
- Payment proofs and messages: as long as needed to deal with them, and no longer than 24 months (payment records may be kept longer where tax law requires).
- Marketing consent and email alerts: until you withdraw them or turn them off.
- Browser preferences: until you clear your browser's storage.
8. Your rights
Under UU PDP (Articles 5 to 13) you have the right to:
- be told who is processing your data, why, and on what basis;
- have inaccurate or incomplete data corrected;
- access your data and get a copy of it;
- end the processing and have your data deleted or destroyed;
- withdraw consent you have given, such as for marketing emails;
- object to decisions based only on automated processing;
- delay or restrict processing;
- receive your data in a commonly used, machine-readable format, or have it sent to another controller;
- sue and claim compensation if your data is processed unlawfully.
Readers in the European Union and the United Kingdom have the equivalent rights under the GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawing consent.
To use any of these rights, write to us (section 12) from the email address on your account. We answer within the time UU PDP sets, which is 3 × 24 hours for most requests. We may ask you to confirm it is your account before we act.
Deleting your account. Email [email protected] with the subject “Delete my account”, from the email address you signed in with, on the website or in the app. We delete your account, profile, comments, votes and alerts within 3 × 24 hours and confirm by email. Records of payments are kept for as long as Indonesian tax law requires; nothing else is kept.
9. Security
The site is served only over HTTPS. Passwords are handled by Firebase Authentication and are never stored by Moneyball Odds. Database rules allow members to write only as themselves and only within fixed limits, and moderator access is granted by hand. No system is perfectly secure; if a personal data breach happens, we will tell affected members and the authority within 3 × 24 hours, as UU PDP Article 46 requires.
10. Age
Moneyball Odds is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account.
11. Complaints
Please contact us first; we would like the chance to put things right. You may also complain to the Indonesian personal data protection authority: UU PDP establishes a dedicated agency, and until it is fully operating, complaints are handled by the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, Komdigi). Readers in the European Union or the United Kingdom may complain to the data protection authority where they live.
12. Contact
Moneyball Odds, Indonesia.
Email: [email protected]
13. Changes to this policy
When this policy changes, the date at the top changes too. If a change affects how we use your data in a significant way, we will tell signed-in members on the site before it takes effect.