Legal

Privacy Policy

This is a placeholder, not a legal document. Illinois has BIPA, one of the strictest biometric privacy laws in the country, and any identity verification flow touches it directly. This needs counsel before launch.
Status: Draft skeleton  ·  Version: 0.1  ·  Applies to: Pre-launch prototype

What this build actually stores

Be clear about the current state: this prototype stores everything in your own browser's localStorage and sends nothing anywhere. There is no server, no analytics, and no third party receiving your data. Clearing your browser data deletes your account entirely.

The one exception is the web font, which is requested from Google Fonts and therefore discloses your IP address to Google. Self-host the font to remove that.

What a live version would collect

  • Account data: name, handle, email, date of birth, state of residence.
  • Identity verification: government ID and, potentially, a selfie match — this is the BIPA-sensitive part.
  • Financial data: bank or card details, handled by a payment processor rather than stored directly.
  • Trading activity: every order, position and settlement, retained for regulatory record-keeping.
  • Technical data: IP address and device information, used for geolocation compliance and fraud prevention.

Why

  • To operate your account and settle your trades.
  • To verify you are 18+ and in a permitted jurisdiction — a legal requirement, not a preference.
  • To detect manipulation, fraud and money laundering.
  • To meet record-keeping obligations that may run years past account closure.

Who would see it

[To be drafted: identity verification vendor, payment processor, cloud infrastructure, and lawful disclosure to regulators. Each needs a named processor and a data processing agreement.]

What will not happen: selling personal data, or sharing it with advertisers.

Retention

[To be drafted. Regulatory retention periods for financial records typically exceed what a user would expect, and that gap has to be stated plainly.]

Your rights

Depending on where you live you may have rights to access, correct, delete or export your data, and to opt out of certain processing. Requests would go to a contact address published here once one exists.

Note that deletion rights are limited where records must be retained for regulatory compliance — that limit needs to be spelled out honestly rather than buried.

Cookies

This build sets no cookies. It uses localStorage for your session, your theme preference, and the demo data. A live version would need a session cookie at minimum, and a consent mechanism if anything beyond strictly necessary storage is added.

Children

NapBet is not for anyone under 18. We do not knowingly collect data from minors, and accounts found to belong to one are closed.

Contact

A privacy contact address goes here before launch. Under some state laws this has to be a monitored channel with a response deadline, not a form that disappears into nothing.

See also Terms of Service and Responsible trading.