Privacy Policy

Account information. When you create an account we collect your email address and a display nickname. If you sign up or sign in with Google OAuth, we also pull your Google account's profile photo (avatar_url). Your email is used for authentication and account recovery. Your nickname and avatar are displayed publicly alongside your blog comments and activity within the app.

Subscription and billing information. If you subscribe, we store a pricing country (an ISO country code derived from the billing address you enter at Stripe checkout, used to show you the right price and tax), a Stripe customer identifier (stripe_customer_id) linking your account to your Stripe record, the date you accepted our Terms of Service (tos_accepted_at), and the policy version you accepted (accepted_policy_version). Your full billing name, billing address, and payment method details (card number, expiry) are collected and held directly by Stripe, our payment processor: we never see or store your full card details.

Usage and analytics data. With your consent, we use Google Analytics, Microsoft Clarity and Vercel Analytics to understand how the site is used and to monitor performance. These tools collect data such as page views, approximate location, device and browser information, and page load metrics. We use this to improve the Service, not to build advertising profiles, and we never sell it. Analytics only run once you accept them in the cookie banner; see Cookies below. Microsoft Clarity also records how you interact with pages (clicks, scrolling and mouse movement) as session recordings and heatmaps, with your email address and anything you type masked.

Error monitoring data. We use Sentry to detect and diagnose errors. By default, Sentry runs a masked, errors-only baseline: it captures error details (page URL, browser type, stack trace) with your IP address and other directly identifying data removed. Once you consent to analytics, Sentry switches to an enhanced tier that also captures your IP address and request headers. Sentry does not record or replay any on-page activity. Sentry processes this data in the EU (ingest.de.sentry.io).

Comment moderation data. If you post a blog comment, its text is sent to OpenAI's moderation API to screen for hateful, violent, or sexual content before publication. OpenAI does not use this data to train its models.

Game and notification data. When you play Beat the AI we store your picks, scores and streak, and your nickname and points appear on the public leaderboard. If you turn on push notifications we store a device token (issued through Firebase Cloud Messaging or your browser's push service) and your device's time zone, used only to deliver notifications and to keep them out of night hours (23:00 to 07:00 local time). We store your preferred site language so emails reach you in it, and a record of which notifications and emails we have sent you (the type, the race and whether it was push or email) so the same message never goes out twice. When you are signed in we also store your browser's time zone, so emails show times in your local time. If an email to you bounces or is marked as spam, we record that and stop emailing that address. If you rate a recap email, we store that rating with your account. If you tell us why you unsubscribe, we keep that answer without your name or email address.

Shared links. When you share your picks or a race result, the link and its preview image contain those picks and, only if you appear on the public leaderboard, your nickname. Anyone you send the link to, or who finds it, can see them.

Your data is used to:

• Authenticate you and maintain your session
• Display your nickname and avatar within the app
• Send transactional emails (e.g. password reset)
• Process your subscription, calculate the correct price and tax for your pricing country, and manage billing through Stripe
• Monitor errors, keep the Service secure, and prevent abuse
• Understand how the Service is used and diagnose bugs, via Google Analytics, Microsoft Clarity, and Vercel Analytics
• Screen blog comments for abusive content via OpenAI's moderation API
• Send game notifications you control: push notifications you turn on, and at most two emails per race weekend (a pick reminder a few hours before the race locks, sent only when push can't reach you, and a recap of your score after the race). These emails contain no marketing and no tracking pixels. Their links carry a short tag so that, with your analytics consent, we can count which email brought you back

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Under GDPR, every use of your data needs a legal basis. Here is the basis for each purpose:

Account creation, sign-in, and session management

Contract: necessary to provide the Service you signed up for

Subscription and billing, processed through Stripe

Contract: necessary to provide the paid Service and process your payment

Security, fraud prevention, and the masked error-monitoring baseline

Legitimate interest: keeping the Service safe and working, balanced against your right to privacy

Blog comment moderation via OpenAI

Legitimate interest: keeping the comment section free of abusive content

Game emails about your own picks and results (pick reminder, race recap)

Legitimate interest: helping you keep up with a game you joined. They are on by default for accounts; switch each type off in your account settings or use the unsubscribe link in every email, and we stop straight away

Analytics, non-essential cookies, and Microsoft Clarity

Consent: only runs after you opt in through the cookie banner

Push notifications

Consent: only sent after you turn them on in your browser or the app; turn them off at any time in your account settings

You can withdraw consent at any time using the cookie settings link in the footer. Withdrawing consent does not affect processing carried out before you withdrew it.

We use essential cookies that keep you signed in and remember your consent choices; these are required for the Service to function and do not need consent. We also use non-essential cookies, analytics cookies set by Google Analytics and Microsoft Clarity (for example _ga, _clck), which only run after you accept them in the cookie banner shown on your first visit. You can change your choice at any time using the cookie settings link in the footer, or block cookies through your browser settings. We do not use advertising cookies, and we do not sell your data.

We share the minimum data necessary with the following processors to run the Service. Each operates under its own privacy policy and processes only the data required for its function:

• Supabase: database and authentication infrastructure that stores your account data.
• Stripe: payment processing and billing (United States). Stripe holds your billing name, billing address, and payment method details directly; we only store your Stripe customer ID.
• Google: Google Analytics (site usage measurement), Google OAuth (optional sign-in with your Google account), Firebase Cloud Messaging (push notification delivery), and Gemini (the AI models that generate predictions and editorial content) (United States).
• Microsoft: Microsoft Clarity (session recordings, heatmaps and usage measurement, only with your analytics consent) (United States).
• Vercel: application hosting and Vercel Analytics (United States).
• Sentry: error monitoring, processed in the EU (ingest.de.sentry.io).
• OpenAI: receives the text of blog comments to screen for abusive content before publication (United States). OpenAI does not use this data to train its models.
• Resend: sends our game emails, using sending infrastructure in the EU (Ireland). Resend receives your email address and the content of each email (United States company). Resend also tells us whether each game email was delivered and whether a link in it was clicked. We keep these records for 90 days, and our emails never track whether you open them.

We do not share your personal information with any third party beyond what is necessary to operate this service.

Google, OpenAI, Resend, Stripe, and Vercel are based in the United States, so your data may be processed outside the European Economic Area. Where that happens, the transfer relies on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Sentry processes data in the EU.

Account data (email, nickname, avatar, pricing country, Stripe customer ID, and consent records) is kept for as long as your account exists. If you delete your account, this data is removed from our systems, other than what we must keep to comply with tax and accounting law.

Blog interactions, likes, saves, and comments, are kept until you delete your account or remove them yourself.

Analytics data (Google Analytics, Vercel Analytics) is kept for the minimum retention period each provider offers. Sentry error data is kept for Sentry's configured retention period, after which it is deleted automatically. Microsoft Clarity keeps session recordings for 30 days and heatmap and usage data for up to 13 months.

Notification preferences, the sent-notification record and the email bounce flag are kept while your account exists and are deleted with it. A push device token is deleted when you turn notifications off on that device, when the push service reports it is no longer valid, or when you delete your account.

Under GDPR and similar privacy regulations, you have the right to:

• Access: request a copy of the personal data we hold about you, or download your data yourself from your account page
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your account and associated data
• Restriction: request that we limit how we process your data in certain cases
• Portability: download your data in a structured, machine-readable format from your account page, or request it from us
• Objection: object to processing we carry out on the basis of our legitimate interests

To exercise any of these rights, contact us at the email address below. You also have the right to lodge a complaint with a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

The Service is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age.

If you are a parent or guardian and believe your child has provided us with personal data, contact us at support@f1predictions.ai and we will delete it. You can also delete an account and its associated data at any time from your account settings.

The data controller is the trader that operates F1 Predictions, identified in our Terms of Service. For privacy-related inquiries, contact us at support@f1predictions.ai.