ARBIE

Privacy Policy · v1.1 · in force 4 September 2026 · amended 5 September 2026

Privacy Policy

Arbie is a small members-only service operated from Australia. We collect the minimum we need to run it, and we don't sell or share your data with anyone for marketing.

1. What we collect

• Account: your email address, a display alias you choose, and a password verifier — your actual password is never stored anywhere.
• Activity you enter: betting positions you log or track, bookmaker balances you record, and settings you choose.
• What the browser extension reads (optional): if you install Arbie Slip Assist, it reads pages you already have open in your own logged-in bookmaker session and sends what it reads to Arbie. That is: the account balance the book shows you, and the bonus-bets balance where the page shows one; bets from your own bet history page; the confirmation shown after you place a bet, on the books where that reader runs; promotion cards on a promotions page; and race prices. The balance and bet readers send only the figures they are built to read. The promotions reader is the one exception: it sends the offer's title and up to 500 characters of the offer's own wording, because the terms of an offer are the thing worth sharing. No reader sends your username or your account number. One thing to know about the promotions reader in particular: what it captures is shared with the rest of the crew, under your alias, so everyone can see the same offers. That is deliberate and it is the only reader whose output other members see. Your balances and your bets are yours alone. Nothing is requested from a bookmaker and no bookmaker sends us anything about you: the extension reads what your own screen is already showing.
• Betfair connection (optional): to connect, you enter your Betfair username, your Betfair password and your own Betfair application key into Arbie, and all three are sent to our server. We use the password once, then and there, to log in to Betfair as you, and then discard it: your Betfair password is never stored, and there is nowhere in Arbie it can be read back from. What we keep is your Betfair username, your application key, a session token sealed with server-side encryption (refreshed in the background so you do not have to log in again), and the available-balance and exposure figures we read from your Betfair account in order to size and check your bets. Arbie has no deposit or withdrawal function — money moves into and out of Betfair only through Betfair's own site or app.
• Billing: membership is billed either by bank transfer (PayID), which the owner records against your membership by hand, or by a PayPal subscription where that is set up. For a PayPal subscription we receive confirmation that a payment happened (amount, date, a transaction reference); for a bank transfer we record the amount and date ourselves. Either way Arbie never receives or stores your card or bank account details.
• Technical: ordinary server logs (timestamps, requests) kept briefly for security and debugging.

2. How we use it

To provide the service: showing you your own data, computing the numbers you asked for, sending you the notifications you switched on (in-app, email, push, or Telegram — all configurable), and administering membership and billing. That's it.

3. Who can see what

Your dollar profit-and-loss is private to you. Crew-visible surfaces (leaderboards, activity feeds) show your alias and non-dollar measures; crew-wide totals are aggregates. The owner can see membership and billing records needed to run the service. We do not sell, rent, or share personal information with third parties except the processors below.

4. Processors we rely on

• Fly.io — hosting (servers and database).
• PayPal — subscription billing, where a PayPal subscription is used.
• Resend — transactional email (dues reminders, receipts).
• Anthropic — if you use the screenshot-reading assist, the image you submit is processed to extract the numbers and is not stored by us.
• Telegram — only if you connect Telegram alerts yourself. Once you do, the alerts we send you through it carry the same content the in-app alert does, which includes event names and dollar figures. Telegram is a third party and this is the one channel where your own figures leave our systems; disconnect it in Notifications and the sending stops.
• A web push service (Google, Apple or Mozilla, depending on your browser) — if you turn on push notifications, the notification is delivered through whichever service your browser uses.

Added 2026-09-10 after an internal security review found that Telegram and web push were in use and not listed here.

5. Retention, and what deleting your account actually does

Your data is kept while your membership exists. When you leave you can ask us to delete your account — email hello@arbie.com.au from the address on the account, or ask the owner in-app. We do it within 30 days and tell you when it is done. You can ask for a copy of your records first.

What is erased. Your email address, the display name you chose, your password verifier, your Betfair username, application key and stored session, your bookmaker accounts and their balances, every position, bet and bonus you recorded, your deposits and withdrawals, your settings and stake caps, your notification preferences, push and Telegram links, your notifications and alert history, your sign-in sessions, and anything you posted in the crew chat or in comments. Those records are deleted outright, not hidden.

What is kept, and why. Four things survive, and none of them names you afterwards:

• The record of payments you made to us — the date, the amount, the currency, whether it came by PayPal or bank transfer, the payment processor's own transaction reference, and the period it covered. Australian law requires a business to keep records that explain its transactions, so we cannot delete these. Your email address is removed from them.
• Referral records. If you introduced someone, or someone introduced you, the link between the two memberships is what the commission owed to them is calculated from. The link is kept; the addresses on it are removed.
• The security log — the record that a sign-in, an invite or a connection happened, kept so we can look into misuse. Your email address and the network addresses recorded against your account are removed from it.
• Promotions you posted to the crew feed. Other members are still using those offers, so the offer itself stays. Your name on it is replaced with “former member” and your email address is removed from it.

What those four are attached to is an empty account record we keep in place of you: a membership number and nothing else — no name, no address, no password, and no way to sign in. It exists so the payment and referral records still add up. We do not use it to contact you, because it holds nothing to contact you with.

What we cannot reach. PayPal keeps its own record of a payment under its own policy, and we cannot delete it. Anything already delivered elsewhere — an email in someone's inbox, a notification another member has already received — is not recalled. Database backups rotate, so an erased record can persist in a backup until those roll over; we do not restore one to bring an erased account back.

6. Security

Passwords are never stored (Argon2id verifiers only); third-party tokens are sealed with server-side encryption; access is over HTTPS; the database is not publicly reachable. No system is perfect — if a breach affecting your data ever occurs, we will tell you promptly and plainly.

7. Your rights

You can access, correct, or export your information, or ask questions about this policy, by contacting the owner in-app or at the address on the site. If you're not satisfied with our handling of a complaint you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Arbie · arbie.com.au · Terms of Service · Refund Policy