Privacy Policy

1. Who We Are

Sofa Pundit is a sports prediction platform. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

2. Data We Collect

• Account data: Name, email address, and profile picture obtained from Google when you sign in via Google OAuth.
• Profile data: Username you choose during onboarding.
• Usage data: Groups you create or join, championship predictions you submit, leaderboard scores.
• Technical data: IP address, browser type, and session tokens necessary for authentication and security.

3. How We Use Your Data

• To provide and operate the Service
• To send transactional emails (group invitations, prediction deadline reminders)
• To calculate and display leaderboard scores
• To maintain security and prevent abuse

Legal basis: Contract performance (Art. 6(1)(b) GDPR) for core functionality; legitimate interests (Art. 6(1)(f) GDPR) for security and abuse prevention.

4. Data Sharing

We share your data only with:

• Google— for authentication (OAuth 2.0). Subject to Google's Privacy Policy.
• Neon — our database provider (PostgreSQL, hosted on AWS).
• Resend — for transactional email delivery.
• Vercel — for hosting and edge functions.

We do not sell your personal data to third parties.

5. Cookies

We use strictly necessary cookies for authentication (session tokens). We do not use tracking or advertising cookies. You can manage cookie preferences through your browser settings.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data is deleted within 30 days, except where retention is required by law. Prediction and leaderboard data may be retained in anonymised form.

7. Your Rights (GDPR)

If you are located in the EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at privacy@sofapundit.club.

8. Security

We implement industry-standard security measures including HTTPS, encrypted database connections, and short-lived session tokens. No method of transmission over the internet is 100% secure.

9. Children

The Service is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice on the Service.

11. Contact

For privacy-related enquiries: privacy@sofapundit.club