This Privacy Policy ("Policy") describes how the Family World Cup 2026 Prediction Pool ("Platform," "we," "us," or "our") collects, uses, stores, and protects the personal information of its participants ("you" or "your"). By accessing or using the Platform, you consent to the practices described in this Policy. This Policy is incorporated into and forms part of our Terms & Conditions.
2. INFORMATION WE COLLECT
We collect the following categories of information:
2.1 Information Provided by the Administrator
Email address — provided by the pool administrator when creating your account. Used as your login credential and for account-related communications.
Display name — set by the administrator or by you. Visible to other pool members on leaderboards and within the Platform.
Password — stored in hashed form by our authentication provider. We never have access to your plaintext password.
2.2 Information You Provide
Predictions — match score predictions and knockout stage winner selections you submit through the Platform.
Draft data — unsaved or draft predictions stored temporarily until you submit them.
2.3 Automatically Collected Information
Authentication tokens — session tokens generated when you log in, stored in your browser to keep you signed in.
Basic usage data — timestamps of when predictions are submitted or modified.
2.4 Information We Do NOT Collect
We do not use cookies for tracking, advertising, or analytics purposes.
We do not collect your IP address, device fingerprint, browsing history, or geolocation data for profiling.
We do not use any third-party analytics, advertising, or tracking services (e.g., Google Analytics, Facebook Pixel).
We do not collect financial or payment information. Token buy-ins are handled outside the Platform.
3. HOW WE USE YOUR INFORMATION
We use your personal information solely for the following purposes:
Authentication & Access: To verify your identity and provide secure access to the Platform.
Pool Functionality: To record your predictions, calculate scores, generate leaderboard rankings, and determine prize distribution.
Display to Participants: To show your display name and scores to other pool members on leaderboards, dashboards, and prediction comparisons.
Communication: To contact you regarding important changes to the pool, your account, or these policies (if necessary).
Platform Maintenance: To maintain, improve, and ensure the security of the Platform.
We will never use your information for marketing, advertising, profiling, automated decision-making, or any purpose unrelated to the operation of this prediction pool.
4. DATA SHARING & DISCLOSURE
Other Participants: Your display name, predictions (after lock), scores, and leaderboard position are visible to other pool members. Your email address is not displayed to other Participants.
Pool Administrator: The Organizer/administrator has access to all Participant data for the purpose of managing the pool.
Service Providers: We use Supabase as our backend infrastructure provider for authentication and data storage. Supabase processes your data on our behalf and is contractually obligated to protect it. For more information, see Supabase's privacy policy.
No Third-Party Sales: We do not sell, rent, trade, license, or otherwise disclose your personal information to any third parties for their commercial purposes.
Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Organizer, Participants, or others.
5. DATA STORAGE & SECURITY
Your data is stored securely on Supabase's infrastructure, which employs industry-standard security measures including encryption at rest and in transit (TLS/SSL).
Passwords are hashed using bcrypt and are never stored in plaintext. We cannot retrieve your password — only reset it.
Access to the database is restricted to the Organizer through authenticated, role-based access controls.
While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
In the event of a data breach that affects your personal information, we will notify affected Participants as soon as reasonably practicable.
6. DATA RETENTION
Your account data and predictions will be retained for the duration of the FIFA World Cup 2026 tournament and for a reasonable period afterward (up to 12 months) for record-keeping and dispute resolution purposes.
After the retention period, your personal data will be deleted or anonymized unless retention is required by applicable law.
You may request early deletion of your personal data at any time by contacting the Organizer (see Section 9). Upon such request, we will delete your personal information within 30 days, except where retention is required by law or necessary for legitimate purposes (e.g., resolving an ongoing dispute).
Aggregated, anonymized data (e.g., total number of participants, average scores) that cannot identify you may be retained indefinitely.
7. YOUR RIGHTS
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Right of Access: You may request a copy of the personal information we hold about you.
Right to Rectification: You may request correction of inaccurate or incomplete personal information.
Right to Deletion: You may request that we delete your personal information, subject to the exceptions noted in Section 6.
Right to Data Portability: You may request a copy of your data in a structured, commonly used, machine-readable format.
Right to Withdraw Consent: You may withdraw your consent to our processing of your data at any time. Withdrawal of consent may result in the inability to continue participating in the pool.
Right to Restrict Processing: You may request that we limit how we use your data under certain circumstances.
To exercise any of these rights, please contact the pool administrator. We will respond to all legitimate requests within 30 days.
8. CHILDREN'S PRIVACY
The Platform is not intended for use by anyone under the age of 18 (or the age of majority in your jurisdiction, whichever is greater).
We do not knowingly collect, solicit, or maintain personal information from anyone under 18 years of age.
If we learn that we have collected personal information from a person under 18, we will take immediate steps to delete that information and terminate the associated account.
If you believe that a person under 18 has provided personal information to us, please contact the Organizer immediately so that we can take appropriate action.
This Platform complies with the Children's Online Privacy Protection Act (COPPA) by not targeting, collecting data from, or knowingly permitting access to children under 13.
9. INTERNATIONAL DATA TRANSFERS
Your data may be stored and processed in any country where our service providers maintain facilities. Supabase may process data in the United States or other jurisdictions. By using the Platform, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws. We take reasonable steps to ensure your data is treated securely and in accordance with this Policy regardless of where it is processed.
10. CHANGES TO THIS POLICY
We reserve the right to update or modify this Privacy Policy at any time. The "Last updated" date at the top of this page will reflect the most recent revision.
Material changes will be communicated to Participants through the Platform or via email.
Your continued use of the Platform after any changes to this Policy constitutes your acceptance of the revised Policy.
We encourage you to review this Policy periodically to stay informed about how we protect your information.
11. CONTACT
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact the pool administrator directly. We will make reasonable efforts to address your inquiry promptly and thoroughly.
By accessing or using the Platform, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree with any part of this Policy, you must cease use of the Platform immediately and contact the Organizer to request account deactivation.