Privacy Policy · WC26 Live

WC26 Live (operated by mehdijabry.dev studio, "we", "us", "our") respects your privacy. This page explains what we collect, why, who we share it with, and what rights you have. If anything here is unclear, write to info@pressing90.live and we'll fix the language.

1. What we collect

A. When you just browse the site (no account)

Standard server logs (IP address, user-agent, pages visited, timestamp) for ~30 days for security + analytics.
Anonymous, aggregate analytics via Cloudflare Web Analytics (no cookies, no fingerprinting). See their privacy notice.
Anonymous, aggregate analytics via Google Analytics 4 (cookies + IP anonymisation enabled). You can opt out in your browser.
Local-storage on your device for things you do on the site (e.g. your bracket picks, preferred date). Stays on your machine unless you sign in.

B. When you create an account

Your email address and chosen display name.
Your bracket picks and prediction history (so we can sync across devices).
If you sign in with Google, we receive your name, email, and profile picture from Google — nothing else. See Google's disclosure flow at sign-in for the exact scope.
An OAuth-managed session token stored in a cookie.

C. We do NOT collect

Payment information (we have no payments).
Phone numbers.
Location (beyond what an IP address coarsely implies).
Microphone, camera, or device sensors.

2. Why we collect it

To serve the site (you can't visit without an IP).
To remember your bracket so you can come back to it.
To improve the site — which features people use, which break.
To prevent abuse — automated scraping, brute-force sign-ins.
To run ads (see §4) so the site stays free.

3. Who we share it with

We use third-party services to run the site. Each gets only what they need:

Cloudflare (DNS, CDN, edge security) — sees every request to the site at the network layer. Their privacy policy.
Supabase (database + auth) — stores your account and bracket picks if you create an account. Their privacy policy.
Google (sign-in with Google + Analytics) — only if you choose to sign in with Google, or for anonymous traffic analytics. Google privacy policy.
Adsterra (advertising network) — drops a cookie and may use device + IP signals to target ads. See §4. Their privacy policy.
ESPN, TheSportsDB (data sources) — we call their public APIs from our edge worker, so they only see our server's IP, not yours.
Resend (transactional email) — sends sign-in / recovery emails if you create an account. Their privacy policy.

We do not sell your personal data. We do not share it with anyone not listed above except when forced by law.

4. Advertising

We run third-party display ads to keep the site free. Right now our ad partner is Adsterra (turbulentrefreshments.com loader). They may set their own cookies and use your IP + device info to serve targeted ads.

We do not allow popunder, push-notification, social-bar, or in-page-redirect ad formats — only contained iframe banners and native cards. If you ever see something invasive, that's a bug — please report it.

If you're in the EU/UK/EEA: under GDPR, ad targeting requires your consent. If our cookie banner shows when you visit, your choices there take precedence over anything else on this page.

5. Cookies

We use the smallest set of cookies that actually do something:

Session cookies — keep you signed in.
Preference cookies — remember UI choices like dark/light theme.
Analytics cookies — Google Analytics 4 (anonymised IP).
Advertising cookies — set by Adsterra. Block via your browser if you want.

Most modern browsers let you block, limit, or delete cookies. If you do, parts of the site (sign-in, saved brackets) may break.

6. Your rights (GDPR, CCPA, PIPEDA)

Depending on where you live, you have the right to:

Ask what data we hold about you.
Ask us to correct or delete it.
Ask us to port it to another service.
Withdraw your consent at any time.
File a complaint with your data protection authority.

To exercise any of these, email info@pressing90.live from the address tied to your account. We'll respond inside 30 days.

7. Children

WC26 Live is not directed at children under 13. We don't knowingly collect their data. If you believe a child has signed up, write to us and we'll delete the account.

8. Security

Traffic is HTTPS-only. Accounts are stored on Supabase (managed Postgres, encryption at rest). We never store passwords — only Supabase-managed Argon2 hashes. We patch dependencies on a rolling basis. If you find a security issue, write to info@pressing90.live — we'll respond quickly and credit you (if you want) in the fix.

9. Changes to this policy

If we change how we handle data, we'll update the "Last updated" date at the top of this page and, for material changes, post a notice on the home page for at least 30 days.

10. Contact

Privacy questions, requests, complaints: info@pressing90.live.