Privacy Policy

What Predict26 collects, why, and how to delete it.

Last updated: 29 May 2026

1. Who we are

Predict26 is an independent fan project that runs a FIFA World Cup 2026™ prediction game for groups of friends, family, and offices. We are not affiliated with FIFA. The service is operated by an individual based in the European Union.

If you have any privacy questions, write to [email protected].

2. What we collect

From you, when you sign in

We use Google Sign-In as our only authentication method. When you sign in, Google sends us:

• Email address — your unique identifier.
• Display name — pre-filled into your group nickname (which you can change).
• Profile picture URL — shown on the leaderboard (optional, never stored as an image).

We do not request access to your Google Drive, contacts, calendar, or any other Google service. We only request the basic openid email profile scopes.

From you, while using the app

• Group memberships — which groups you joined, your nickname per group, when you joined.
• Match predictions — the scores you predicted for each fixture, when you last edited them.
• Award picks — your champion, top scorer, and similar tournament-level predictions.
• Scoring rules you set as a group admin — your group's custom scoring schema and prize copy.
• Corporate inquiries — if you submit a quote request via our Corporate form: company name, employee range, departments, contact email.

From your browser

• localStorage entries — your active group ID, currency preference, sign-in resume state. These never leave your browser. Clear them via your browser's "Clear site data" or by signing out.
• One auth cookie — a JWT issued by Supabase that proves you're signed in. It's httpOnly, scoped to predict26.app, and expires after a year of inactivity.
• We do not set marketing cookies, ad cookies, or any kind of tracking pixel.

What we don't collect

• We don't use Google Analytics, Meta Pixel, Mixpanel, Amplitude, Hotjar, or any third-party analytics.
• We don't log your IP address beyond what Cloudflare automatically retains for DDoS protection (deleted within 30 days).
• We don't read your location, contacts, or device hardware identifiers.

3. How we use it

What	Why
Email + name	Identify you in groups, surface your name on the leaderboard.
Predictions	Score them against actual match results.
Group memberships	Show you the right groups when you log in.
Corporate form data	Reply to your quote request. Nothing else.
Auth cookie	Keep you signed in between visits without re-entering credentials.

4. Where it lives

All persistent data is stored on Supabase (a managed Postgres database hosted in the EU, specifically Frankfurt, Germany — AWS eu-central-1). Supabase is a data sub-processor; their privacy policy is at supabase.com/privacy.

The static web app is served via Cloudflare Pages; Cloudflare may briefly log request metadata (IP, timestamp, user-agent) for security purposes — see Cloudflare's privacy policy.

Google Sign-In is provided by Google LLC; see Google's privacy policy.

5. Who can see what

Inside your group

Other members of a group you joined can see: your nickname, your predictions for already-finished matches (after kickoff), and your leaderboard score. Your predictions for upcoming matches are private by default; group admins may enable a "public picks" mode that reveals them before kickoff.

Outside your group

No one outside the groups you belong to can see anything about you. There is no public profile, no public ranking, no search by name.

Group admins

Admins can change scoring rules, remove members, and set the group's privacy mode. They cannot see your real email — only the nickname you chose for the group.

6. Sharing with third parties

We share data only with the strict service providers needed to run Predict26:

• Supabase — database + auth backend.
• Cloudflare — CDN + DNS.
• Google — only what Google already has, because they handle Sign-In.
• Stripe — payment processor, once we enable paid plans. Stripe receives your name + payment details directly; we never see your full card number. (Not yet active.)

We do not sell your data, ever. We do not send marketing emails. We do not share data with advertisers.

7. Your rights

Under the GDPR (and equivalent laws in your country), you have the right to:

• Access — request a copy of everything we have about you.
• Correction — fix anything that's wrong.
• Deletion — wipe your account and predictions. We act on deletion requests within 14 days.
• Portability — get your predictions exported as JSON.
• Withdrawal of consent — sign out and your auth cookie disappears immediately.

Exercise any of these by emailing [email protected] from the address tied to your Google account. We'll reply within 14 days.

8. Retention

• Active accounts — kept as long as you use the app.
• Inactive accounts — auto-deleted after 24 months of no sign-in. We email you 30 days before deletion.
• Cancelled or transferred groups — archived for 6 months for dispute resolution, then permanently deleted.
• Corporate leads — kept for 12 months, then permanently deleted unless you've become a customer.

9. Children

Predict26 is not directed at children under 13 (or 16 in the EU/UK). We don't knowingly collect data from children. If you believe a child has signed up, write to [email protected] and we'll delete the account.

10. Changes

If we change this policy materially, we'll show a banner inside the app the next time you sign in and give you 30 days' notice before the new policy takes effect. Trivial fixes (typos, clarifications) we'll just push.

11. Contact

Privacy questions, deletion requests, anything: [email protected]. We reply within 14 days, usually within 2.