Privacy Policy

We're a small, self-funded UK team. We collect only what we need to run the game — an email address, a password (hashed), a display name, your prediction, and which mini-leagues you're in. We do not sell your data. We don't run advertising. You can download or delete your data at any time from Account settings.

Predicta Leagues ("we", "us") is the data controller for personal data collected via the Service. For any privacy questions, contact us at hello@predicta-leagues.com.

Data you provide directly:

• Email address (used to sign in and to send transactional emails)
• Password (stored only as a salted hash — we cannot see it)
• Display name (visible to other players)
• Your prediction: the ordering of the 20 Premier League clubs and your Joker selection
• Mini-league memberships and the names/descriptions of mini-leagues you create
• Email preferences (which types of transactional and digest emails you want to receive)

Data collected automatically:

• Session cookies to keep you signed in
• Limited technical logs (IP address, user agent, request timing) retained briefly by our hosting providers for security and abuse prevention
• Email delivery events (open/deliver/bounce) received from our transactional email provider for the emails we send you

• To provide the Service — display your prediction, compute scores, render mini-league standings
• To send transactional emails (verification, password reset, welcome, weekly digest during the season)
• To respond to support requests
• To detect and prevent abuse, fraud, and violations of our Terms
• To improve the Service in aggregate — never by isolating individual users' data for advertising or resale

• Performance of a contract — most core game functionality (signup, prediction submission, scoring, mini-leagues) is necessary to provide the Service you signed up for.
• Legitimate interests — abuse prevention, service diagnostics, security logging.
• Consent — for non-essential digest emails you can toggle off in preferences.
• Legal obligation — where we are required by UK law to retain or disclose specific information.

We use the following sub-processors under contractual data protection terms:

• Supabase — database and authentication. Hosts your account, prediction, and mini-league data. EU region.
• Vercel — application hosting and edge routing. Sees request-level metadata (IP, user agent, path) to serve pages.
• Resend — transactional email delivery. Sees your email address and the content of transactional emails we send you. EU region (eu-west-1).
• Sportmonks — Premier League fixture and standings data. We receive data from Sportmonks; we do not send them your personal data.

We do not sell personal data. We do not share personal data with advertisers.

We keep your account data while your account is active. When you delete your account (via Account settings) we remove your profile, predictions, mini-league memberships, and email preferences immediately.

Certain artifacts persist after account deletion:

• Mini-leagues you created where other members remain — admin role transfers automatically to the longest-tenured remaining member; the league itself is retained as it belongs to those members as much as to you.
• Aggregate community statistics that are no longer personally identifiable.
• Third-party operational logs held by Supabase, Vercel, and Resend under their own retention policies. If you want those cleared you can contact those providers directly, or contact us and we'll help.

Under UK GDPR you have the following rights:

• Access — see what data we hold on you. Use the Download my data tool for a JSON export.
• Rectification — correct inaccurate data. Change your email, display name, or password from Account settings.
• Erasure — delete your account and data via Account settings. Immediate hard delete; no grace period.
• Portability — receive your data in machine-readable form via the JSON export above.
• Restriction and objection — restrict our processing of your data or object to processing based on legitimate interests. Contact us at hello@predicta-leagues.com.
• Complain to a supervisory authority— you can lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) at any time.

Our primary hosting is in the EU/UK. Some sub-processors (notably Vercel's edge network) may briefly transfer request data outside the UK/EEA. Transfers rely on standard contractual clauses or equivalent safeguards under UK GDPR Article 46.

We use only essential cookies necessary to run the Service — authentication and session cookies. We do not use marketing or analytics cookies. If we introduce any non-essential cookies we will surface a consent banner and update this policy accordingly.

Passwords are stored as salted hashes; we never see your plaintext password. All traffic to the Service is served over HTTPS. Access to production systems is restricted and multi-factor authenticated. We do our best but cannot guarantee that any online service is 100% secure — if you believe your account has been compromised, contact us immediately at hello@predicta-leagues.com.

The Service is not directed at children under 13. If we become aware that a child under 13 has provided us with personal data we will delete it.

Material changes will be surfaced in-app or by email to registered users. The "Last updated" date at the top of this page indicates when the current version took effect.

For any privacy questions, or to exercise your rights: hello@predicta-leagues.com.