Privacy Policy

We collect information in three ways: what you give us directly, what's created by using the Service, and what our service providers pass back to us.

We never ask for or store your bookmaker login details, card number, or bank details. Card payments for your KCT membership are handled entirely by Stripe, our billing partner — see clause 4.

• —To run your account — authenticate you, remember your display name, and show you the tips your membership entitles you to.
• —To manage membership — link your Stripe subscription to your KCT account and reflect your current access level.
• —To operate chat — display your messages and reactions to other members, and let admins moderate the room (see clause 3).
• —To send notifications — only if you've explicitly turned them on, to let you know when new tips or races are posted.
• —To keep the Service secure — detect abuse, enforce our Terms & Conditions, and investigate issues.
• —To meet legal obligations — where we're required to by law.

We do not sell personal information to third parties.

Chat is a shared space — anything you post is visible to every other signed-in member, shown against your display name, never your email.

Admins are the exception: to moderate the community and act on abuse reports, admins can see the real email address behind each member's display name from within the admin view. This is used for moderation purposes only (e.g. deciding who to mute) and is never shown to other members.

KCT is built on a small number of specialist providers, each of whom processes a slice of your data on our behalf, under their own privacy and security terms:

These providers only receive what they need to perform their function for us — they don't get to use your data for their own unrelated purposes.

We use a small number of strictly necessary cookies to keep you signed in (set by Supabase). We also use the Meta Pixel to measure how our Facebook and Instagram ads perform.

We keep your account and chat data for as long as your account is active. If you ask us to delete your account (clause 8), we'll remove your personal information within a reasonable time, except where we're required to retain certain records by law (for example, billing records Stripe is required to keep).

Passwords are stored as salted hashes, never as plain text. Data in transit is encrypted (HTTPS). Access to admin tooling and the underlying database is restricted to authorised roles. No system is completely immune to risk, but we take reasonable, industry-standard steps to protect your information.

Under Australian privacy law, you can ask us to:

• —Access the personal information we hold about you.
• —Correct anything that's inaccurate or out of date (you can also update your own display name any time from your Profile).
• —Delete your account and associated personal information, subject to the retention exceptions in clause 6.

To make any of these requests, contact us using the details in clause 10. We'll respond within a reasonable timeframe.

The Service is restricted to members aged 18 and over (see our Terms & Conditions). We don't knowingly collect personal information from anyone under 18. If we learn that we have, we'll delete it.

If you have a question about this policy, or want to make a privacy complaint, contact us first — we'll aim to resolve it directly. If you're not satisfied with our response, you can escalate a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this Privacy Policy as the Service, our providers, or the law change. We'll update the effective date above whenever we do, and flag material changes on the Service where practical.