Privacy
What we hold, and what we don't.
Last updated October 2026.
1. What we collect
The name and email address you register with, a hashed version of your password, and everything you do on the platform: the calls you place, how they settled and your balance movements.
If you deposit or withdraw, we also hold the M-Pesa number, the amount, the date and the receipt number Safaricom gives us. We need the number to send the prompt to it and to send money back to it.
We do not ask for identity documents to pay out ordinary withdrawals, so for most accounts we never hold any. Money only goes back to a number that paid in, and Safaricom identified that line already. Past a total set out in the terms, or if an account needs explaining, we do ask — and then we hold what you gave us, with a record of who checked it and when, and use it for nothing but that check.
2. What we never collect
Never a card number, a bank account, a CVV or an M-Pesa PIN. Payment happens as a prompt on your own phone: you type your PIN into the phone, never into this site, and it never touches our server. We hold no standing authority over your M-Pesa line — every deposit needs your PIN again, and we could not take money from you if we wanted to.
We run no analytics, no advertising pixels and no third-party tracking scripts of any kind. Fonts are served from our own server rather than fetched from Google, so loading a page does not tell anyone else you were here. We do not build a profile of you to advertise at, and we do not sell anything to anybody.
3. Your password
Stored only as a bcrypt hash, which cannot be reversed into the original. We cannot tell you your password, and neither can anybody who obtains the database. If you reuse passwords across sites, this is the one place we would ask you not to — this account can move money.
4. Cookies
One cookie, holding your signed-in session. It is not used for tracking, it is not shared, and signing out ends it. Your chosen settings are kept in your browser's local storage, which never leaves your device.
5. Who else sees it
We do not sell, rent or share your data for anybody else's purposes, and the database lives on a single server we control.
Safaricom see your number and the amount, because they are the ones moving the money. They handle that under their own terms, not ours. The Betting Control and Licensing Board, and other authorities entitled to ask, can require records of accounts and transactions — including under anti-money-laundering law, where we may be obliged to report a transaction and, in some cases, prohibited from telling you we did.
Platform administrators can see your email, role, balance, trade history, payment records and verification status, in order to run the platform, answer questions about a settlement, and clear a payment that did not go through.
We send withdrawal codes and password-reset links by email. The mail provider sees the address we send to, and nothing else about your account.
6. How long we keep it
For as long as your account exists, and then as long as the law says.
Ask us to delete your account and we will remove what we are free to remove. Three things outlive it, and none of them is our choice: financial records, which the law requires us to keep; transaction records, and any identity records we did hold, which anti-money-laundering law requires us to keep for years after an account closes; and the book's own record of what it paid out, which can be kept without your name attached. If you have self-excluded, we keep enough to honour it — an exclusion we deleted would be an exclusion we could not enforce.
7. Your rights
You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. Write to support@stakeoption.com and we will action it. There is no charge and you do not need to give a reason. Where we have to refuse a deletion because the law requires us to keep something, we will tell you which part and why rather than simply declining.
8. Breaches
If the database were ever exposed, we would tell everybody affected and the authorities we are required to tell.
Worth knowing what would be in it: your name, your email, a bcrypt password hash, your trading and balance history, the M-Pesa numbers and receipt numbers of your deposits and withdrawals, and identity documents only if we ever asked you for any. No card details and no bank details, because we never asked for either.