Privacy Policy

• Account details — your name (optional), email address, password (stored only as a secure hash), country, and timezone. Country is used for the age gate and to apply the right regional rules.
• What you post — predictions, picks, takes, comments, counter-picks, and (if you record one) voice pitches with their automatic transcripts.
• Play activity — points, streaks, badges, follows, reactions, and club or group memberships, which together form your public track record.
• Notifications — if you turn on push notifications, your browser gives us a delivery subscription for your device, and delivery runs through your browser vendor's push service (for example Google, Apple or Mozilla). You can turn this off any time.
• Product analytics — first-party events (like "signed up" or "locked a pick") so we can see which features work. These stay on our servers.
• Abuse prevention — IP addresses are used transiently to rate-limit signups and actions. We don't build profiles from them.

• No advertising, no ad trackers, and no selling or renting your data — to anyone, ever.
• No real-money anything, so we never ask for payment details, bank information, or IDs.
• Managed child accounts (the guardian-controlled Family Mode, coming later) are never publicly discoverable, and their data is handled only under a guardian's control. Any adult account can also switch its profile to private in settings.

To run the game (score your calls, build your track record, show feeds), to send the notifications and emails you've opted into (reveals, lock reminders, digests, password resets), to keep the community safe (moderation, rate limits, blocking), and to improve the product through our own analytics. That's the whole list.

We use a small set of infrastructure providers who process data on our behalf: Vercel (hosting and file storage), Neon (database), Resend (email delivery), Upstash (rate limiting), and Cloudflare (the Turnstile bot check on signup, where enabled). If you sign in with Google, we receive your name and email address from Google — nothing else. If you pick a different language, the translation runs through the Google Translate widget in your browser, which sets a language-preference cookie.

International transfers: these providers host primarily in the United States, so if you play from the EU/EEA, UK, India or elsewhere, your data is processed in the US under our providers' standard data-protection safeguards (such as EU Standard Contractual Clauses).

Why we're allowed to process your data: to provide the service you signed up for (running the game), our legitimate interest in keeping it safe (moderation, abuse prevention), and your consent where we ask for it (notifications, optional features).

We use a session cookie to keep you signed in and a language-preference cookie if you change languages. No advertising or cross-site tracking cookies.

You must be over your country's digital-consent age to hold your own account — that's 13 in the US and many countries, 16 across much of the EU, and 18 in India and some others; the signup age check applies your country's threshold. A guardian-controlled Family Mode for younger players is coming later; until then, under-age accounts are held and their data is not used. Where a parent registers a child, the parent controls that child's data, visibility, and deletion.

From Manage Your Account → Your data & account you can export a copy of your data as a file (your account details, picks, stats, comments, reactions, counter-picks, voice pitches, follows, memberships, share cards and reports), or delete your account (7-day grace period, then permanent removal of your picks, comments, reactions, follows, stats, and voice pitches — including the audio files). Predictions you authored that other people played stay, with your name removed. You can also correct your profile details any time. Depending on where you live (for example the EU/EEA, UK, India, or California), these are also your legal rights — we honor them for everyone, everywhere, we never discriminate for exercising them, and if you're in the EU/EEA or UK you can also complain to your local data-protection authority.

We keep your data while your account exists and remove it on deletion as described above; abuse-prevention IP checks are transient, and product-analytics events are kept only as long as needed to understand feature usage. Passwords are hashed, connections are encrypted, and access to production data is restricted.

If this policy changes, we'll update the date above and note meaningful changes in the app. Questions or requests? Open a ticket from Manage Your Account → Submit Service Tickets.