Privacy Policy

Last updated 23 May 2026

This Privacy Policy explains what personal information Wazza collects, why we collect it, how we use and share it, and the choices you have. It is written to be consistent with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. Who we are

Wazza is operated by Matt Jones, based in Sydney, Australia. For privacy questions, email hello@wazza.racing.

2. What we collect

When you sign up and use Wazza, we collect:

Account information — your name, email address and profile picture, via Google OAuth when you sign in.
Betting history — when you upload account statements from bookmakers (e.g. Sportsbet PDFs, TAB CSVs), we parse and store individual bet records: venue, race, runner, odds, stake, outcome, and timestamps. This is sensitive financial data and we treat it as such.
Chat messages — what you say to Wazza in chat, and Wazza's replies.
Preferences and feedback — any tipping preferences, persona choices, voice settings, and the “remember this” notes you ask Wazza to keep.
Session and technical data — a session cookie (required for login), your IP address in request logs, and basic error telemetry from our error monitoring system. We do not run third-party advertising or analytics trackers.

3. Why we collect it

To create and secure your account.
To personalise predictions and ratings — your bet history tells Wazza what kinds of races and runners you do well at, which informs what gets recommended to you.
To calculate your personal performance metrics, ROI, and pick accuracy.
To generate chat responses you ask for (which requires sending some of your data to Anthropic — see §5).
To improve our underlying prediction models in aggregate, anonymised form.
To detect and prevent fraud, abuse, and security incidents (using the error monitoring system).

4. Who we share it with

We do not sell, rent, or trade your personal information. We share data with a small number of service providers that are essential to running Wazza:

Google (Australia / United States) — for Google Sign-In and email delivery (Google Workspace). Google receives your email address when you authenticate.
Anthropic, PBC (United States) — when you use Wazza's chat interface, your messages and the relevant context (which may include your bet history, preferences and stored notes) are sent to Anthropic's Claude API to generate responses. Anthropic's API processes inputs to produce outputs but does not use your data to train its models when accessed via API. See Anthropic's Commercial Terms and Privacy Policy.
Hetzner Online GmbH (Germany) — hosts our application servers and database. Your data is stored on Hetzner's infrastructure in Germany.
The Racing API and Betfair — we receive racing data and odds from these services. We send them no personal information about you; we receive only public racing and market data.

We will also disclose personal information where required by Australian law (for example in response to a valid law-enforcement request or court order).

5. Cross-border data flows

Wazza is hosted on infrastructure in Germany (Hetzner) and uses Anthropic's API in the United States for AI chat. Some Google services we use are based in the United States. By using Wazza you consent to your personal information being transferred to and processed in these jurisdictions. Each of these providers offers protections we consider equivalent to Australian privacy standards under their contractual terms.

6. How long we keep your data

We keep your account and associated data for as long as your account is active. If you delete your account, we remove your personal data within 7 days from our live database and within 30 days from backups. Aggregated and anonymised model-improvement data may be retained indefinitely (it cannot be linked back to you).

7. Your rights

You have the right to:

access the personal information we hold about you;
correct anything that's inaccurate;
delete your account and all associated data — type “forget me” to Wazza in chat or email hello@wazza.racing;
opt out of any non-essential processing (currently there is none — everything we do is either for the service you asked for or required to operate it).

If you have a privacy concern we haven't resolved, you can contact the Office of the Australian Information Commissioner (OAIC).

8. Cookies

We use a single first-party session cookie to keep you signed in. We do not run advertising cookies, marketing pixels, or third-party analytics that track you across sites.

9. Security

Your data is stored in our PostgreSQL database on Hetzner's German infrastructure, behind HTTPS-only access. Nightly encrypted backups are pushed to a separate Hetzner Storage Box. Authentication is via Google OAuth — we never see or store your Google password.

10. Children

Wazza is for adults only. You must be 18 or older to use the Service. We do not knowingly collect personal information from anyone under 18; if you believe a minor has signed up, please email us and we will delete the account.

11. Changes to this policy

We may update this Privacy Policy. The “Last updated” date at the top reflects the most recent change. Material changes will be flagged to active users when they next sign in.