Privacy policy
Teacher’s Bet runs no analytics, no advertising trackers and no third-party scripts of any kind — the security header the server sends forbids them outright. The calculators need no account and keep nothing. This page lists every value the site stores, where it stores it, and how to have it deleted.
The short version
- Every calculator, the whole Learn course and the formula sheet work with no account, no email and no cookie.
- No analytics product, no advertising pixel, no third-party script. The
Content-Security-Policyheader allows scripts and network connections from this origin only, so a tracker could not run here even if one were added by accident. - Nothing is sold, rented or shared for marketing.
- The only personal data the site can hold is an email address — if you sign in, or leave one on the pre-launch list — plus what Stripe holds once billing opens.
Everything below is the long version, written against the code rather than from a template. Where something cannot be verified from the code, it says so.
What stays in your browser
Most of what the site remembers never leaves your device. It is kept in localStorage under the origin teachersbet.com, which is readable only by this site and is cleared the moment you clear site data.
Every key, and what is in it
tb-age-ok— set once you confirm you are of legal betting age. A single character. Never sent anywhere.tb-report— the Report Card: prices you chose to log, each with the event, the side, the moneyline, the market and line, an optional stake and bankroll, the book, and when you logged it.tb-bankroll— the last bankroll typed into the bet sizer, so it does not have to be retyped.tb-bellandtb-bell-seen— the in-app alert setting (which ships switched off) and the ids already shown, so the same flag does not fire twice.tb-tour-done— whether the one-time guided tour has already run.tb_pro— after a subscription purchase, the signed entitlement token. It carries the subscriber’s email or Stripe customer id, the tier and an expiry, and it goes back to the server to unlock the paid board.
An operator-only admin page also keeps an access key in sessionStorage. It is not part of any visitor’s use of the site.
The Report Card is worth a note. Grading sends the logged entries to /api/report/grade, which compares them against stored closing prices and returns the grades — the entries themselves are not written to the database. The consequence is honest but unhelpful: clear your browser cache and the history is gone. Server-side storage with an export path is planned, and when it ships this page changes before the feature does.
Cookies
Two, both first-party, both functional. Neither is for advertising and neither follows you anywhere else.
tb_session— set when a sign-in completes. An opaque 256-bit random id; the server stores only its SHA-256 hash, never the value in the cookie.HttpOnly,Secure,SameSite=Lax, with a 90-day expiry that slides forward as you use it.tb_auth_nonce— set the moment a sign-in link is requested and dead 15 minutes later. It binds the emailed link and the six-digit code to the browser that asked for them, so a forwarded email, or a mail scanner that opens links, cannot sign anyone in. Cleared as soon as sign-in completes.
tb_pro, the entitlement token in the list above, is not a cookie: it is kept in localStorage and sent to the server in an Authorization header. The server will also accept it as a cookie if some client chooses to send one, but nothing on this site sets it that way — no code here writes document.cookie at all.
There is no consent banner because there is no tracking cookie to consent to.
What the server stores
Server-side data lives in a Cloudflare D1 database (SQLite at the edge). These are all of the rows that can contain anything about a person:
- Accounts — created only if you sign in. The email address, lower-cased and trimmed; the entitlement tier; the Stripe customer id once billing is connected; and created, updated and last-login timestamps.
- Sign-in tokens — the SHA-256 of the emailed link token, of the browser nonce and of the six-digit code, never the values themselves; the email address; when it was issued and when it expires; how many code attempts have been made; and the IP address that requested it. A scheduled sweep deletes them after expiry.
- Sessions — the SHA-256 of the session id, the account it belongs to, timestamps, the first 256 characters of the browser’s user-agent string (so a device list is legible), and the IP the session was created from. Three devices maximum; a fourth sign-in drops the least recently used. Signing out of all devices deletes every row instantly.
- Pre-launch list — only if you enter an address: the email, which tier you asked about, the timestamp, and a short label for the page it came from.
- Market snapshots — venue prices with timestamps. No user is attached to them and none can be.
Every credential is stored only as its SHA-256 hash, so a copy of the database yields nothing usable: the raw session id, the link token and the sign-in code exist only in your browser and in your inbox. The link token, the browser nonce and the session id are 256-bit random values. The six-digit code is short by design, because it has to be typed, and it is protected instead by the browser binding, a five-attempt cap and a 15-minute expiry.
What is never collected
- No name, postal address, phone number, date of birth or government ID. The age gate asks for a confirmation, not a birthday — see responsible gambling.
- No card number, expiry or CVC. Those go to Stripe and never touch this site’s servers.
- No location beyond the country and region code Cloudflare attaches to every request, which is read only by the availability gate described in the terms and is not stored.
- No bets, balances or sportsbook credentials. The site has no connection to any book or exchange account, because it places nothing.
- No calculator inputs. Each calculator posts to a stateless endpoint that computes an answer and returns it; nothing about the request is written down.
- No fingerprinting, no session recording, no heatmaps, no A/B cookies.
Who else is involved
Four processors, each doing one job:
- Cloudflare — hosts the site, runs the server code and stores the database. As the host it necessarily sees each request’s IP address, user agent and URL, as any web host does.
- Stripe — payments, once checkout opens. Card details are entered on Stripe’s own page. From Stripe this site learns the billing email, the customer id and the subscription status. Nothing else.
- Resend — delivers the sign-in email, and therefore receives the address and the message. The email deliberately contains no link tag and no image, so there is nothing in it to wrap in a click tracker and no pixel to load; provider-side click and open tracking are kept off for this domain as a standing rule.
- Kalshi and The Odds API — the market-price sources. Data flows one way, inbound. Nothing about you is sent to either.
There is no advertising network, no data broker, no analytics vendor and no CDN-hosted font or script. Everything the browser loads is served from this origin, including the maths typesetting.
Logs
The server writes short diagnostic lines: sign-in outcomes (whether it worked, why not, and the first 80 characters of the user-agent string — never the token or the code), unmatched URLs (the method, the path, the length of the query string rather than its contents, a truncated referrer and a truncated user-agent), and payment-webhook errors. Those exist so a broken sign-in can be diagnosed while a user is reproducing it.
No log-drain, Logpush destination or analytics dataset is configured for this application, so it keeps no request log of its own. Cloudflare’s platform-level logging and retention apply as they would to any site it hosts, under Cloudflare’s policy rather than this one.
Deleting your data
- The browser half. Clear site data for
teachersbet.comand every key listed above is gone. Instant, no request, nobody to ask. - Sessions. “Sign out of all devices” in the app deletes every session row immediately and invalidates any that were missed.
- The account itself. To delete the account row — the email address, the tier and the Stripe customer id — or an entry on the pre-launch list, email alex@teachersbet.com from the address in question. The request is honoured wherever you live; no legal-regime test is applied first. Expected response times are on the contact page.
- Payment records. Stripe keeps its own under its own policy. Deleting an account here does not reach into them.
Age
This site is built for adults and is not directed at children. No data is knowingly collected from anyone under the legal betting age, and there is no mechanism here that could collect a child’s data other than an email address typed into a form. If you believe a minor has entered one, email the address above and it is deleted.
What this page does not claim
It describes what the code does, checked against the code. It is not a compliance certificate for any particular privacy regime and it is not legal advice. A pre-launch legal review is under way; if it changes anything here, this page changes and the date at the top moves with it.
Material changes get described rather than quietly substituted — the same corrections rule the rest of the site runs on, set out in the editorial policy.
Frequently asked questions
Does Teacher’s Bet track me?
No. There is no analytics product, no advertising pixel and no third-party script. The Content-Security-Policy header allows scripts and network connections from this origin only, so a tracker could not run even if one were added by mistake. There is no advertising cookie and no cross-site identifier.
Do the calculators store what I type?
No. Each calculator posts its inputs to a stateless endpoint that computes an answer and returns it; nothing about the request is written to the database. The only values kept are ones you deliberately keep — the Report Card and the last bankroll — and those live in your own browser.
Do I need an account?
No. Every calculator, the full Learn course and the formula sheet work with no account, no email and no card. An account exists only for the paid tier and for keeping a subscription attached to an address.
What cookies does the site set?
Two, both first-party and functional: tb_session for a signed-in session, stored server-side only as a hash, and tb_auth_nonce, a 15-minute value that binds a sign-in link to the browser that asked for it. The paid entitlement token tb_pro is not a cookie — it is kept in localStorage and sent in an Authorization header. No advertising or analytics cookie.
How do I delete my data?
Clearing site data removes everything held on your device. Signing out of all devices deletes every session row. To delete the account row or a pre-launch-list entry, email alex@teachersbet.com from the address in question.
Does Teacher’s Bet sell data?
No. Nothing is sold, rented or shared for marketing. The only third parties are infrastructure: Cloudflare for hosting and the database, Stripe for payments once checkout opens, and Resend to deliver the sign-in email.