Privacy

What agatha.gg actually stores, plainly.

Last updated October 11, 2026.

Accounts and payments

Accounts are open on agatha.gg. You do not need one to use the site. An account lets you sign in and get the emails you ask for. There are still no payments: Agatha Pro is free during early access, and we do not ask for a card.

What we store today

Your account: When you finish joining, we store your username; your email address and when it was confirmed; your plan (Agatha Pro during early access) and when it started; how you signed up (email, Google, Apple, Discord or X); the country your connection came from; and when you joined. There is no password to store, and no IP address is kept with your account. Your username is shown to you on your account menu and account page, and in public when you play Beat Agatha: on your Beat Agatha page and, when you rank, on the weekly board. The page's address uses a short code, never your username, and Hide my name shows only its first and last letter.
What you agreed to: When you join, we record that you confirmed you are 21 or older, or of legal gambling age where you live, that you accepted the Terms (and which version), and whether you ticked the box for picks and updates by email, including whether that box was already ticked for you. Each record keeps the wording you saw (by version), the time and your country. These records stay after an account is deleted, with no email address attached, so we can show what was agreed.
Sign-in methods: For each way you sign in (your email, Google, Apple, Discord or X), we keep the ID that service uses for you, the email address it last gave us and whether it had verified it (X gives none), when you added it and when you last used it. The section below says what each service sends us.
Signed-in browsers: Each browser you sign in on gets a session record: when it started, when it was last used, your browser's user agent string and the country it signed in from, but no IP address. Logging out ends it, and Log out everywhere on your account page ends them all.
Sign-in emails: When you ask for a sign-in email, we store the address and the country and time of the request. While you finish joining, what the sign-in gave us (the service's ID for you, your email and any name or handle it sent) is held with your sign-up. Codes and links stop working after 15 minutes and an unfinished sign-up after an hour, and expired ones are cleared out automatically.
Newsletter email: If you tick the picks and updates box when you join, or leave your email in a sign-up box such as the one in the footer, we store the address, where it came from and when. From the join form we also note which account it belongs to and which wording you agreed to. If our country check places you in the United States, the join form's box starts ticked and you can untick it; everywhere else it starts unticked. Nothing else.
Pick alerts: If you tap the bell on a pick while signed in, we store the email on your account against that one pick (its key, label and game date) and the time you asked, so we can send one message to that email if the pick is withdrawn before its game. Nothing else.
Beat Agatha: When you thumb a pick up or down, we store the pick, your side and the time; when the pick seals we add the odds your thumb was priced at, then its result. Your record, units and recent thumbs show on your Beat Agatha page and the weekly board. Your page also shows the thumbs still waiting to seal.
Presence heartbeat: While you are on the site, your browser checks in every 30 seconds with a random id made up for that browser tab, plus your country (and region and city, where available) and your browser's user agent string. This is kept on our server for 30 days, then deleted. No IP address is stored.
Analytics: We count visits with a privacy-friendly analytics tool that we host ourselves, to see how the site is used: page views, the referring site, browser, operating system, device type, screen size, language and country (and region and city, where available). It sets no cookies and never stores your IP address. No third-party trackers, no advertising cookies.
Agree and disagree votes: Voting on a pick sets one anonymous cookie (a random id, kept for two years) and stores your vote against that pick together with a one-way hash of that cookie combined with your IP address, so we can count one vote per person per pick. The IP address itself is never stored, only the hash, and a hash cannot be turned back into it.
Device settings: Things like the sportsbooks and sports you have hidden, your odds format (American or decimal) and the slips you build on the board or in The Book are saved only in your browser's local storage. They never reach our server. Until you choose, your sportsbooks and odds format start from the country your visit comes from: your browser asks our server, which answers with the country (and region, where available) and keeps nothing, and your browser keeps that answer as a starting point until a week passes without a visit.
How you found us: When you first land on agatha.gg, your browser keeps a small note in its own local storage of how you got here: the page you landed on (without anything after the question mark), the site that sent you, if one did, and the campaign labels on the link (utm_source, utm_medium, utm_campaign and utm_content, the way every ad link is built). The note stays in your browser for 30 days, is never kept by a signed-in browser, and never holds an email address: a label or an address that contains one is dropped. If you create an account within those 30 days, the note is sent once with Create account and stored on your account, so we can tell which ad or site brought you. It is not sent at any other time. No cookie, no IP address, no click id and no fingerprint are stored by this.

Signing in with Google, Apple, Discord or X

If you choose one of these, it sends us some details about you. We keep the ID it uses for you and the email address it gives us. Your name or handle is only used to suggest a username while you join.

Google: your Google ID, your email address and whether Google has verified it, your name and basic profile details such as your profile picture link.
Apple: an ID Apple makes for you, your email address (an Apple relay address if you choose to hide yours) and, the first time only, your name.
Discord: your Discord ID, username, display name, email address and whether Discord has verified it, and basic profile details. If you add Discord to an account that already exists, we may also keep your Discord username.
X: your X ID, handle and display name. X does not share an email address, so we ask you to confirm one.

We use the permission you give the service once, to read those details, and do not keep it, so we cannot post or act for you later. We never see your password for any of these services. If the service's verified email address, or the email you confirm while joining, matches an account that already exists, we add the sign-in to that account, sign the account out on its other devices and email it to say so.

Emails we send

Sign-in emails: a link and a 6-digit code, each good for one use within 15 minutes. Each one says, where it can tell, which country and browser asked for it, so you can spot a request that was not yours.
Account notices, for example when a new sign-in method is added to your account.
Picks and updates, only if you opted in. You can stop them at any time by emailing [email protected].
Pick alerts, only for a pick you asked about.

Our emails carry no tracking pixels and no tracked links. Apart from these and our replies when you write to us, we send you nothing.

Cookies and browser storage

agatha.gg sets no advertising cookies and runs no third-party trackers. The cookies it does set:

__Host-agatha_sid keeps you signed in. It lasts 400 days from your last visit, or until you log out.
agatha_in only marks that you are signed in, so pages know to load your account. It lasts as long as the sign-in cookie.
A few short-lived cookies carry a sign-in or a sign-up from one step to the next. Each lasts an hour or less.
agatha_vid, the vote cookie described above (two years).

Your browser's own storage also holds your device settings and slips, the country answer described above, the picks you are watching with the bell, your agree and disagree votes, a random id for each tab for the presence heartbeat, and small markers such as whether this tab has seen the intro or this browser has signed in before. Clearing your browser's site data removes all of it.

Why we use it

To run your account and what you ask for: signing in, your plan, pick alerts.
To keep accounts and the site safe, for example by limiting sign-in attempts.
To send picks and updates, only if you said yes. You can change your mind at any time.
To keep a record of what you agreed to and when.

We do not sell your information, and we do not use it for advertising.

Services we use

The companies that host agatha.gg and protect it from attacks. Every visit passes through them, so they see your IP address, and they tell us which country a visit comes from.
The security check on the log in and join card, which runs in your browser to confirm you are a person. Its provider receives your IP address and basic browser details for that check.
The service that delivers our sign-in emails and account notices, which keeps a record of each message for a limited time.
Our email provider, which holds the emails you send us and our replies.
Google, Apple, Discord and X, only if you choose to sign in with one of them.
On a pick's verify page, the check button asks a public blockchain service directly from your browser (the page names which one), and that service sees your IP address like any site you visit.
Pick seals are written on chain in public. They hold Agatha's picks only, never anything about you.

Our hosting, security and email providers handle your information on our behalf, to run and protect the site; the security check's provider also uses what its check sees to improve how it spots bots. The sign-in services and the blockchain service on the verify page handle what they receive under their own privacy policies. Your information may be stored or handled outside the country where you live, and while it is there, the courts and authorities of that country may be able to access it under its laws.

How long we keep it

Your account and its sign-in methods: until you delete the account.
Sessions: until they end (400 days after your last visit, or when you log out). Ended ones are cleared out automatically.
Sign-in codes, links and unfinished sign-ups: cleared out automatically after they expire.
Newsletter emails and pick alerts: until you ask us to remove them.
Presence heartbeat: 30 days.
Analytics and votes: kept with no set end date, to compare traffic and count votes over time. Neither holds an IP address or anything tied to your account.
What you agreed to: kept after an account is deleted, with no email address attached.
Backups: deleted information can stay in our backups for up to about two weeks.

Your choices

Your account page shows your username, your email address (partly hidden), your plan, your sign-in methods and your choice about picks and updates, and lets you log out or log out everywhere.

To get a copy of what we hold about you, correct it, stop picks and updates, or delete your account, email [email protected] from the address on your account. We reply within 30 days.

Deleting your account removes your email address, sign-in methods and sessions, takes your address off our email list and deletes pick alerts sent to it. We keep a closed record with your retired username (so no one can register it again), when you joined, how you signed up, your plan and what you agreed to, with no email address attached.

Email [email protected] and we will delete the newsletter email or pick-alert emails tied to you. Presence records carry nothing that identifies you and are deleted after 30 days on their own. Device settings are already only on your device: clearing your browser's site data removes them.

Depending on where you live, you may also have the right to complain to your data protection authority.

Age

Accounts are only for people who meet the age rule in our Terms. We do not knowingly collect information from anyone younger; if you think someone younger has given us information, email [email protected] and we will delete it.

Who is responsible

Agatha.gg is responsible for the information described on this page. You can reach the person in charge of protecting it at [email protected] with any question or request about your information.

Changes

This page describes what the site does today. We will update it before anything new starts collecting data, such as payments or pages that show your username in public, and the date at the top changes when we do.