Bantasy

Legal · Last updated October 20, 2026

Privacy policy

Plain English version. We collect the minimum we need to make Bantasy work, we don't sell your data, and you can ask us to delete your account at any time.

What we collect

  • Account info. Email, display name, password hash, and when you signed up.
  • Gameplay data. Comps you join, lineups you set, tips you submit, and the messages you post in comp chat.
  • Device and usage. Basic logs (IP, user agent, error traces) so we can keep the service up and debug issues.
  • How you use the app and the site. The handful of things that tell us whether Bantasy is working: that you signed up, joined a comp, built a squad, started a trial, or made a purchase, and for a purchase the amount and the currency. Alongside each one we record the device you are on and the version of the app or site you are using. Your card numbers are never part of this, because we never hold them. Where one of these events has to be tied to a person outside Bantasy, it is your email address and user id in scrambled (hashed) form, never in the clear. The services that receive this, and how to turn them off, are listed under Cookies and the sections after it.
  • Billing and payments. If you subscribe or buy a Bantasy Bucks top-up, your payment is processed by our payment providers (Stripe and Chargebee). We never store your card numbers; we keep your billing history (what you bought, when, and for how much).
  • Prize verification. If you win a prize, we may collect what we need to verify your identity, age and location, and the bank details needed to pay you.

Why we collect it

  • To run your account and gameplay.
  • To show you the right ladders, comps and notifications.
  • To prevent abuse and fix bugs.
  • To see which parts of the product people actually use, and which ones quietly fail them.
  • To work out whether our advertising is worth paying for.
  • To send you product updates if you opt in.

Who we share it with

We don't sell your data. We use a small number of processors to deliver the service (hosting, analytics, transactional email, and payment processing: Stripe and Chargebee). We also use Google Analytics to measure site traffic, and Meta (Facebook) for ad measurement and targeting through the Meta Pixel, both described under Cookies below. We also use tawk.to (tawk.to Inc., United States) to run our support chat, both on this site and in the app. On this site it receives what you type into it, along with your IP address, your rough location, the pages you are on here and basic details about your browser, which is how it shows us who is on the site right now. In the app, when you open Help it also receives your name, your email address and some context about what you were doing, such as the screen you were on, your gameweek, your team and competition, your plan and whether you are on a trial, any error message showing on the screen and a reference number for it, the version of the app you are using, and, if you came to Help from the assistant, the last question you asked it and the answer it gave. We keep the chat transcripts so the team can pick your question back up later and follow up properly. To measure the product and our advertising we use PostHog, AppsFlyer, Google (Google Analytics, Firebase Analytics and Google Ads), Meta and Sentry, each described in the sections below. They only see what they need to do their job. Some of these providers (including Google, Meta, Stripe, tawk.to, PostHog, AppsFlyer and Sentry) store and process data outside Australia, mainly in the United States.

Your rights

  • Access: ask us for a copy of what we hold.
  • Correction: tell us to fix anything wrong.
  • Deletion: ask us to wipe your account. See delete your account for the steps, what we remove and what we have to keep.
  • Portability: get your data in a structured format.

Email admin@bantasy.co with any of the above and we'll respond within 30 days.

Cookies

We use a session cookie to keep you signed in and a small handful of first-party cookies for preferences and basic analytics.

If you are in the UK, Ireland or elsewhere in Europe, we ask before using any of the tracking and measurement tools described below: the Meta Pixel and Google Analytics on our websites, and PostHog, AppsFlyer, Firebase Analytics, Meta's app events and session recordings in the Bantasy app. None of them starts on bantasy.co, at app.bantasy.co or in the app until you choose Accept, and if you choose Reject, or make no choice, they stay off. Once you have an account your answer is kept with it, so after a Reject our own servers also stop sending Meta, PostHog and AppsFlyer anything about you, including the scrambled email described below when you sign up. Wherever you are, you can change your answer at any time from Cookie settings in this site's footer or Cookies and tracking in the app's settings, and a cookie shared by bantasy.co and app.bantasy.co remembers it for six months.

We also run the Meta (Facebook) Pixel on this site and in the Bantasy web app at app.bantasy.co. It sets cookies and tells Meta which pages you visited, so we can measure our ads and show them to people like you. It never sees your password or the contents of your posts, but it does see the page title in your browser tab.

When you create an account, we also send Meta a scrambled (hashed) version of the email address you signed up with. Hashing only works one way: Meta can check it against addresses it already holds to work out whether you have a Facebook or Instagram account, but it cannot read your address back out of it. We do this so we can tell which of our ads actually led to people joining, rather than guessing. Your password is never sent to Meta in any form.

To opt out, choose Reject under Cookie settings in this site's footer, turn off ad personalisation in your Facebook or Instagram settings, or use a browser or extension that blocks tracking scripts. Blocking third-party cookies limits what Meta can link across other sites, but it won't stop this pixel; its cookie is set by bantasy.co. If you would rather we didn't share your hashed email with Meta at all, email admin@bantasy.coand we'll handle it.

We also run Google Analytics, on this site and in the Bantasy web app at app.bantasy.co. It sets cookies and tells us how people find and move around the site: which pages you land on, what you click, and whether you head off to download the app. We use it to understand traffic patterns; we never send Google your name, your email or the contents of your posts, though as with the Meta Pixel it does see your browser-tab page title. Google receives your IP address to work out your rough location, and says it doesn't log or store it. Because these cookies are set on bantasy.co they are shared with app.bantasy.co, so moving from here into the app is counted as one visit rather than two.

Where you reached us by clicking one of our ads, Google Ads and Meta are also told when that click led to you creating an account, so we can tell which ads are worth paying for. What they receive is that a signup happened and which ad click it followed, not your name, your email or anything you go on to do in the app.

On a desktop browser you can opt out of Google Analytics with Google's official opt-out add-on. That add-on doesn't exist for mobile browsers, so on a phone you'd need a browser or extension that blocks analytics scripts, or your device's tracking-protection setting. We don't currently offer an in-site toggle.

Our support chat is run by tawk.to. On this site the chat bubble loads on every page, so tawk.to sets its cookies as soon as a page opens: they are what keep a conversation going as you move between pages and let it recognise you if you come back with a follow-up. It receives what you type into it, plus your IP address, your rough location, the pages you visit on this site and basic details about your browser. In the Bantasy app at app.bantasy.co the same chat only loads when you open Help, so if you never open Help it never runs there and sets nothing. Opened from the app it also receives your name, your email address, the support context described above and, if you came to Help from the assistant, the last question you asked it and the answer it gave. It never sees your password or your card details. If you would rather we didn't keep your chat transcript, email admin@bantasy.coand we'll remove it.

Product analytics and session replay

We use PostHog (PostHog, Inc., United States) to understand how people move through Bantasy, on this site, in the web app and in the phone apps. It receives the things you do rather than the things you write: that you signed up, joined a comp, built a squad, started a trial, or made a purchase, with the amount and the currency for a purchase, plus the device you are on and the version of the app or site. We use it to work out which parts of the product help and which get in the way, which is the difference between fixing what is actually broken and guessing.

PostHog also records session replay: a playback of how you moved through a screen, where you tapped, and what you scrolled past. Every piece of text and every image is masked before it leaves your device, so a replay shows the shape of a screen and your path through it, not your squad, your chat messages, your email address, or anything you typed. We keep replays for 30 days, after which they are deleted. PostHog stores this data in the United States.

Measuring our advertising in the phone apps

The three services in this section apply only to the Bantasy apps you install from the App Store or Google Play, not to this site or the web app. They exist so we can tell which adverts are worth paying for rather than guessing, and they are the reason you see Apple's tracking prompt described further down.

AppsFlyer (AppsFlyer Ltd., servers worldwide) handles install attribution and the links that open the right screen in the app. It tells us which advert, if any, led to an install, and whether the person who installed went on to join a comp or pay, so we can judge our advertising. It receives those events along with your device and the app version. On iPhone and iPad it only uses your device advertising identifier if you allow tracking at the Apple prompt; if you decline, the app still works in full and our attribution simply becomes less exact.

Firebase Analytics, part of Google (Google LLC, servers worldwide), records the same kind of app usage events, which Google Ads then uses to measure the app adverts we run there. It receives the events, your device and the app version. It does not receive your name, your email address, or anything you post.

Meta app events and the Meta Conversions API.The same short list of events, that you signed up, joined a comp, started a trial, or made a purchase with its amount and currency, is sent to Meta (Meta Platforms, servers worldwide) from two places: from the app on your phone, and from our own servers. We send it twice on purpose, so that one event is neither missed nor counted as two. Where an event has to be tied to a person, your email address and your Bantasy user id are scrambled (hashed) first, the same one-way scrambling described under Cookies above, so Meta can match you against records it already holds but cannot read either value back out. Meta uses this to measure and improve the adverts we run. Because the half we send from our servers does not pass through your phone or your browser, blocking scripts on your device does not stop it; the tracking prompt below and Meta's own ad settings are how you limit it.

Crash reporting and error replay in the phone apps

We use Sentry (Functional Software, Inc., United States) to find out when Bantasy breaks. When the app hits an error it sends Sentry the error itself, where in our code it happened, your device, the version of the app, and your Bantasy user id, so we can tell whether one person hit a problem fifty times or fifty people hit it once.

From today Sentry also captures a short replay of the moments around an error in the phone apps: the last little while before it broke, masked the same way as a PostHog replay, so we can see what you were doing instead of asking you to make it happen again. It is kept as part of the error report and nothing else, and only an error produces one. Ordinary use of the app does not.

The tracking prompt on iPhone and iPad

On iPhone and iPad, Apple requires us to ask before AppsFlyer or Meta may use your device advertising identifier. The app shows Apple's own prompt, which reads "Allow Bantasy to track your activity", and you can allow it or decline it.

Declining changes nothing about how the app works. Every comp, every squad, every chat and every prize behaves exactly the same either way, nothing is locked, and we will not ask you again or nag you about it. The only thing that changes is that our advertising measurement gets blurrier, which is our problem and not yours. You can change your answer whenever you like under Settings, Privacy and Security, Tracking on your device.

Turning analytics and ad measurement off

None of the services in the sections above ever receives your card numbers, your password, or the contents of your posts and chat messages. We do not hold your card numbers at all, so there is nothing there for us to pass on to anyone.

To limit the rest of it:

  • On iPhone and iPad,decline Apple's tracking prompt, or change your answer later under Settings, Privacy and Security, Tracking.
  • On Android, turn off ad personalisation under Settings, Google, Ads, which switches off the advertising ID the apps would otherwise use.
  • For Meta specifically, turn off ad personalisation in your Facebook or Instagram ad settings. That governs what Meta may do with what it receives from us, including the events we send from our own servers.
  • For all of it at once, email admin@bantasy.co and ask us to delete your analytics data. We will delete what we hold, ask these providers to delete their copy, and stop sending them anything further about you.

If you are in the United Kingdom or Ireland: we rely on our legitimate interests in running, fixing and improving Bantasy and in judging our own advertising for the analytics described above, and on your consent where Apple's tracking prompt asks for it. If you are in Australia or New Zealand, this notice is how we tell you about the same handling. Either way, if you would rather be in none of it, the email address above is enough.

Children

Bantasy is for users 18 and over. If you believe a minor has signed up, contact us and we'll remove the account.

Changes to this policy

If we make material changes we'll notify you in-app and via email. Otherwise the "last updated" date at the top tracks edits.

Contact

The entity responsible for your data is Bantasy Pty Ltd (ABN 84 698 879 677), Australia. Questions, complaints, or right requests: admin@bantasy.co.

This policy is governed by the laws of Australia. Last updated October 20, 2026.