Privacy notice

World Cup Predictor is operated by Juan Arboleda Polo. Juan is the controller responsible for the personal information described in this notice.

For privacy questions or requests, email juan@alzeck.dev.

Predictor may collect and process:

• Account information: your name, email address, profile image, account identifiers, and authentication and session information. Passwords are protected by the authentication provider and are not stored in plain text.
• Group information: groups you create or join, membership roles, group names and images, invite codes, and sweepstakes assignments.
• Prediction information: score predictions, submission times, points, ranks, and leaderboard results.
• Feedback information: questionnaire answers, feature and pricing preferences, optional written comments, and whether you agree to a follow-up conversation. Draft answers are saved automatically as you complete the form.
• Technical information: security and service logs and aggregated information about pages, device type, browser, approximate country, and site performance.

You provide account details and predictions directly. Technical information is collected automatically when you use Predictor. Group administrators may provide information about your membership role and sweepstakes assignment.

Your name, email address, and login credentials are required to create an account. A profile image is optional. Without the required account information, Predictor cannot provide its account, group, or prediction features.

Personal information is used to:

• create and secure your account;
• let you create, join, and manage prediction groups;
• save predictions and calculate points and leaderboards;
• show group members' predictions after a match locks;
• research future features and pricing and, where you agree, contact you about your feedback;
• operate, maintain, troubleshoot, and protect the service;
• understand aggregated site usage and improve performance.

Predictor does not sell personal information or use it for third-party advertising.

Scores and rankings are calculated automatically from predictions and match results. This only determines game leaderboards and is not used to make decisions that have legal or similarly significant effects on you.

Where UK or European data protection law applies, the main lawful bases used are:

• Contract: processing needed to provide the account, prediction, group, and leaderboard features you request.
• Legitimate interests: keeping Predictor secure, administering the service, diagnosing problems, and using anonymous or aggregated analytics to improve it. These interests are considered against your privacy rights.
• Legal obligation: processing required to comply with applicable law or valid legal requests.

Predictor uses service providers that process information on its behalf:

• Convex: database, application backend, and authentication infrastructure.
• Vercel: website hosting, delivery, security, web analytics, and performance measurements.

Information may also be disclosed when required by law, to protect the rights and security of Predictor or its users, or as part of a transfer of the service to a new operator. It is not otherwise shared with independent third parties for their own marketing.

Predictor's Convex deployment stores and processes account and application information in the United States. Vercel is also based in the United States and may process information there and in other locations used by its subprocessors.

Convex's Data Processing Agreement incorporates the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum for relevant transfers. Vercel states that it uses standard contractual clauses or other appropriate legal mechanisms for international transfers; its Data Processing Addendum describes the safeguards for plans covered by that agreement. You can review the Convex Data Processing Agreement, the Vercel Privacy Notice, and the Vercel Data Processing Addendum. Email juan@alzeck.dev to request more information or a copy of the relevant safeguards.

Account and prediction information is generally kept while your account remains active and Predictor continues to operate. Group information is kept while the relevant group remains active.

You can permanently delete your account from account settings. This removes your profile, authentication records, predictions, memberships, and sweepstakes assignments. Groups you own are also deleted, including their memberships and sweepstakes assignments. References showing that you previously assigned a sweepstakes team are anonymised in groups owned by someone else.

Authentication and session information is kept for as long as needed to keep accounts secure. Limited information may remain in restricted backups or security logs until it expires through the service providers' retention cycles. Anonymous and aggregated statistics that no longer identify anyone may be kept. Other information may be retained where needed to secure the service, resolve a dispute, or meet a legal obligation.

Predictor uses authentication and security storage needed to keep you signed in and protect your account. It also stores your theme preference on your device.

Vercel Web Analytics and Speed Insights collect aggregated page-view and performance information without third-party advertising cookies. Before analytics information is sent, Predictor removes query strings and replaces group IDs, match IDs, and invite codes in page URLs with generic placeholders. The tools are not used to follow you across other websites.

Where Predictor relies on legitimate interests, you can object to that processing at any time by emailing juan@alzeck.dev. The processing will stop unless there are compelling legitimate grounds to continue or it is needed for legal claims.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of your personal information. You may also have rights to restrict or object to certain processing and to complain to your local data protection authority.

To exercise a right, email juan@alzeck.dev. Enough information may be requested to confirm that the account belongs to you. UK users may also complain to the Information Commissioner's Office.

Predictor is not directed at children and does not ask users for their age. If you are a parent or guardian and believe a child has provided personal information, email juan@alzeck.dev so it can be reviewed and deleted where appropriate.

This notice may be updated if Predictor's data practices or legal obligations change. The updated version will be published here with a revised date, and significant changes will be brought to users' attention in the app where appropriate.