Privacy Policy

Last updated: 2026-05-13

This policy describes what data World Cup 2026 Predictor collects, for what purposes, and what rights you have over it.

1. Data we collect

• Bracket prediction: the teams you pick in groups and the knockout stage, along with the computed score.
• Account (optional): if you sign in with Google via Supabase Auth, we store your user identifier to link your predictions. We don’t access your email beyond authentication.
• IP address: used only to rate-limit abuse. Not stored alongside your prediction.
• Cookies and similar technologies: see section 5.

2. How we use data

• Display your prediction on a unique shareable URL.
• Calculate scores and public rankings.
• Generate AI analysis via Google Gemini.
• Prevent spam and abuse.

3. Data processors

We share data with the following providers:

• Vercel — application hosting.
• Supabase — PostgreSQL database and authentication.
• Google (Gemini API) — AI analysis. Your prediction may be sent as context. Google does not use it to train models per its Gemini API policy.
• Google AdSense — advertising. See section 5.
• Cloudflare — bot protection via Turnstile.

3b. Affiliate programs

This site participates in the Amazon Associates program. When you click a link to Amazon from our app and complete a purchase, we may receive a commission at no additional cost to you. These links are identified by thetag=wc2026pred-20 parameter in the URL and are processed under Amazon’s privacy policy.

• Amazon Associates — affiliate program. Clicks on product links may be tracked by Amazon per their privacy policy.

4. Retention

Predictions are kept indefinitely to maintain a historical ranking. You can request deletion by emailing the contact below.

5. Cookies and advertising

We use functional cookies (session, theme, consent) and advertising cookies (Google AdSense) only when you give explicit consent via the banner. We implement Google Consent Mode v2: until you accept, ad and analytics storage are denied by default.

6. Your rights

Under GDPR (EU) and CCPA (California) you have the right to access, rectify, delete and port your data, and to object to its processing. To exercise any of these rights, contact us.

7. Children

The service is not directed at children under 13 (16 in the EU). We do not knowingly collect children’s data.

8. Changes

If we materially update this policy we will refresh the date at the top and, where appropriate, notify you.

9. Contact

For privacy questions or to exercise your rights: privacy@pickthecup.com.