These documents are a draft and are not in force.

They have been written to be reviewed by an Australian lawyer, not to be relied on. Some details are still blank, shown as [ — ], and the points that need a lawyer's judgement are marked in the margin. Nothing here limits your rights under the Australian Consumer Law, and nothing here is legal advice.

Privacy Policy

What we collect, why, who else sees it, and how to get it back or get rid of it. This describes what the service actually does — we have deliberately not claimed collection we do not perform.

Not yet in force — see the notice above. Last revised 2026-08-04.

1.Who Handles Your Information

[ — ], ABN [ — ], of [ — ], Western Australia, Australia, trading as The Stat Lab. Privacy questions and requests go to [ — ].

FOR LEGAL REVIEW

Whether the Privacy Act 1988 (Cth) applies at all. The small business exemption in s6C/s6D generally excludes businesses with annual turnover of A$3m or less, subject to exceptions — including where the business discloses personal information about an individual to someone else for a benefit, or provides a benefit in order to collect personal information. The exemption is also under active reform following the Privacy Act Review.

Draft position: This policy is written to comply with the Australian Privacy Principles voluntarily, and does not rely on the exemption. That is the safer commercial posture and it costs nothing here, since collection is already minimal — but the operator should know whether compliance is a legal obligation or a choice, because it changes the consequences of getting it wrong and it determines whether the Notifiable Data Breaches scheme applies.

2.What We Collect

Only what the service needs to work:

Your account. Your email address, and your name and profile picture if you sign in with Google or another provider. Handled by our identity provider, Clerk.
Your pass. The expiry date of your Season Pass, stored against your account. That is the entire record of your purchase that we hold.
Your payment. Taken by Stripe. Stripe collects your name, email and card details, and tells us only that a payment succeeded and which account it belongs to. We never receive, see or store your card number.
Server logs. Our hosting providers record IP address, browser, and the pages requested, as an automatic part of serving a website. We use these only to keep the service running and secure.

We hold no database of our own about you. Our database contains AFL statistics and bookmakers' prices — there is no user table in it. Your account lives with Clerk and your payment lives with Stripe.

3.What We Don't Collect

No analytics, of any kind. No Google Analytics, no tag manager, no advertising pixel, no session recording, no heatmaps, no third-party tracking scripts. We do not know which pages you visit.
No betting data. We do not know whether you bet, what you bet on, how much, or with whom. We have no connection to any bookmaker and no way to find out.
No location beyond what an IP address implies in a server log.
No sensitive information as the Privacy Act defines it — health, race, political or religious views, sexual orientation, criminal record.

4.Why We Hold It

To let you sign in, to know whether your pass is current, to take the one payment, to answer you when you write to us, to keep the service secure, and to meet our record-keeping obligations. That is the complete list. We do not profile you and we make no automated decisions about you.

5.Who Else Sees It, and Where They Are

We use four service providers. Each holds only what its job requires, and each is bound by its own contract with us.

Clerk — accounts and sign-in. United States.
Stripe — payments. United States and Ireland.
Vercel — website hosting. United States.
Railway — data and API hosting. United States.

This means your personal information is stored and processed overseas, principally in the United States. We tell you that plainly because Australian Privacy Principle 8 requires it and because you should know before you sign up, not after.

We do not sell your information, ever. We do not share it with bookmakers, data brokers, advertisers or marketers. We would disclose it if a law or a court required us to, and we would tell you unless we were prohibited from doing so.

6.Cookies and Browser Storage

We set no tracking cookies, so there is no cookie banner to dismiss. What is stored in your browser is:

Sign-in cookies, set by Clerk. These keep you logged in. The site cannot work without them.
Your 18+ acknowledgement, stored locally in your browser so we do not ask again on every page. It never leaves your device and we never read it on our servers.
Stripe's fraud-prevention cookies, during checkout only.

Clearing your browser storage signs you out and makes the age prompt appear again. Nothing else is lost.

7.How Long We Keep It

Your account details for as long as you have an account, and your pass record until it expires. Payment records are kept for seven years, because tax law requires it. Server logs are kept for a short period by our hosting providers under their own retention settings and are not something we archive.

When you close your account we delete it. We keep the payment record, because we have to, and that record is a transaction — not a profile.

8.Your Rights

Email [ — ] and you can:

ask for a copy of everything we hold about you;
have anything wrong corrected;
have your account and its data deleted;
ask how a particular piece of information is being used.

We will respond within 30 days, and we will not charge you for asking. If we refuse a request we will tell you why in writing.

If we handle it badly, complain to us first — then to the Office of the Australian Information Commissioner, at oaic.gov.au or 1300 363 992.

9.Security, and What Happens if It Fails

Sign-in is handled by a specialist provider, card data never touches our systems, traffic is encrypted, and administrative access is restricted. That is a genuine reduction in risk, not an absence of it — no system is impenetrable and we will not pretend otherwise.

If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as quickly as we can. We will tell you what happened and what to do about it, in plain language.

10.Marketing

We currently send no marketing email. If that changes, we will ask you to opt in first, every message will carry a working unsubscribe link, and unsubscribing will take effect immediately. Emails about your own account — a receipt, an expiry reminder, a change to these terms — are not marketing and will still reach you.

11.Changes to This Policy

If we change how we handle your information in a way that matters, we will email you before it takes effect. The revision date at the top of this page always reflects the current version.