Privacy policy

Last updated: 19 September 2026 · Version: 1.0

1. About this policy

This policy explains how Magic Multi (we, us) collects, uses, stores and discloses your personal information when you use magicmulti.com (the Service). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Magic Multi is not a bookmaker. We do not accept bets or hold funds, and we never see your bookmaker account. When you send a bet to a bookmaker you deal with that bookmaker directly, and it handles your information under its own privacy policy, not this one.

By using the Service you agree to this policy. If you do not agree, do not use the Service.

2. What we hold

If you have an account, we hold:

  • your first name;
  • your mobile number, encrypted at rest, together with a keyed hash of it that lets us recognise the number without storing it in the clear;
  • your answers to the two signup questions — that you are 18 or over, and that you are not on BetStop or another self-exclusion register;
  • the bookmakers you told us you hold an account with, if you chose to tell us;
  • whether you ticked the marketing box;
  • the IP address you signed up from, and a hashed device identifier set by a cookie;
  • the multis the Wizard generated for you, their legs and prices, when they were generated, and whether you opened the bookmaker link; and
  • a log of login codes sent — the hashed number, the IP address and the time — used to limit how many codes can be requested and to detect abuse.

We do not hold your date of birth, email address, password, home address, or any payment or bank details. There is no password: you sign in with a code sent by SMS. We collect no sensitive information as defined in the Privacy Act, and ask that you do not send us any.

If you contact us, we hold what you send us, including the email address you write from.

If you visit without an account, we hold only the cookies and analytics described in clause 8.

3. Why we hold it

We use this information to:

  1. run your account — sign you in, show you your own history, save your preferences;
  2. send you login codes and account notices by SMS;
  3. keep out anyone who told us they are under 18 or self-excluded (clause 5);
  4. limit how many bets an account can generate in a period, and detect misuse of the Service;
  5. understand how the Service is used and improve it, using aggregated statistics such as which presets are popular;
  6. send you product updates and offers, only if you ticked the marketing box (clause 7); and
  7. meet our legal obligations, including any lawful request from a regulator such as ACMA or a state or territory gambling regulator.

We have no affiliate, referral or lead-generation arrangement with any bookmaker and we do not use your information for any such purpose. If that changes we will update this policy and our Terms and give you notice before it applies to you.

4. How long we keep it

We keep your account information for as long as your account exists. When you delete your account, or we close it, we erase or de-identify your personal details straight away (clause 6).

What remains after deletion is de-identified: the keyed hashes described in clause 5, the multis generated for you with no link to any person, and counts of generation events. The login-code log (a hashed number, an IP address and a time) is a security record. We keep de-identified and security records for as long as the Service operates.

5. Blocked identities

If you answer at signup that you are under 18, or that you are on BetStop or another self-exclusion register, we refuse the account. We keep only a keyed hash of your phone number and/or device identifier, the reason, and the date. A keyed hash cannot be turned back into your number; it lets us recognise the same phone or device if it tries again, and nothing else.

These records survive account deletion so that a person who told us they are self-excluded cannot simply re-register. As our Terms say, this is a best-effort speed bump, not a compliance control.

6. Deleting your account

You can delete your account at any time in Settings, or by emailing [email protected]. When you do:

  • your first name is erased and your encrypted mobile number is deleted; the keyed hash of the number remains on the deleted record so that clause 5 keeps working;
  • the bookmakers you listed are deleted and marketing consent is switched off;
  • the multis generated for you are kept, with no link to you, for aggregate statistics; and
  • we send one SMS to the number confirming the deletion.

If you sign up again later with the same number, you start a new account with no history.

7. Messages we send

We send login codes and account notices by SMS. These are service messages and are sent whether or not you have opted in to marketing. They come from a shared number supplied by our SMS provider and may not show our name.

We send product updates and offers by SMS only if you ticked the marketing box. Every marketing message tells you how to opt out, and you can also opt out at any time in Settings or by emailing [email protected]. We will not send marketing while your account is on a break, or after you have told us you are self-excluded or want to be excluded from the Service.

We do not email account holders, because we do not hold your email address.

8. Analytics and cookies

The Service sets these cookies:

  • mm_session — keeps you signed in;
  • mm_dev — a random device identifier, kept for up to two years, used for the block list in clause 5 and for rate limits;
  • mm_age — remembers that you passed the 18+ gate; and
  • mm_admin — used by our own staff only.

The sign-up and sign-in pages also use your browser's local storage to keep a half-finished form while you complete it.

We use PostHog for product analytics. Events are identified by a random internal account id, never by your phone number or name, and include which pages and features you used, your browser type, and an approximate location derived from your IP address by the analytics provider. You can block cookies in your browser settings, but you will not be able to sign in.

9. Public feed and share links

Multis generated by the Service may appear on the site's public "recently conjured" feed and on share pages. These show the preset name, the legs, the odds and the time — never who generated them.

10. Who else sees it

We use these providers to run the Service, and they receive only what they need for their part:

  • Cloudflare — hosting and content delivery (global, including the United States);
  • Supabase — our database (Sydney, Australia);
  • MobileMessage — SMS delivery (Australia);
  • PostHog — product analytics (United States); and
  • Resend — email delivery for our own staff sign-ins.

We may also disclose information where required or authorised by law, to establish or defend a legal claim, or to a purchaser if the Service or the business is sold or restructured.

We do not disclose your personal information to bookmakers. We do not sell it, and we do not share it with advertisers, affiliate networks or lead-generation partners.

Because Cloudflare, PostHog and Resend process data in the United States, some of your information is disclosed to overseas recipients. By using the Service you consent to that disclosure. We take reasonable steps to ensure those recipients handle it consistently with the APPs, but APP 8.1 may not apply to every such disclosure.

11. Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure — including encryption in transit, encryption of your mobile number at rest, and limiting who can see your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

12. Your rights

You may ask us to give you access to the personal information we hold about you, to correct anything inaccurate, to delete your account, or to stop marketing. You can change your first name, your bookmakers and your marketing choice, and delete your account, in Settings yourself.

For anything else email [email protected]. We will respond within 30 days and may need to verify that you are the account holder first. Access is free. If we refuse access or correction, we will tell you why in writing.

Complaints. If you think we have mishandled your personal information, contact us first at [email protected] and we will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

13. Under 18s

The Service is strictly for people aged 18 and over. We do not knowingly hold personal information about anyone under 18. If someone tells us at signup that they are under 18 we refuse the account and keep only the keyed hash described in clause 5. If you believe a minor has an account, tell us at [email protected] and we will close it and erase their details.

14. Changes and contact

We may update this policy from time to time. The current version is always published on the Service with the "Last updated" line at the top. Where a change materially affects how we use your information, we will notify you by SMS or an on-site notice before it takes effect.

Contact us: Magic Multi · [email protected]