Privacy Policy

Account information. When you create an account we collect your email address and a display nickname. If you sign up or sign in with Google OAuth, we also pull your Google account's profile photo (avatar_url). Your email is used for authentication and account recovery. Your nickname and avatar are displayed publicly alongside your blog comments and activity within the app.

Subscription and billing information. If you subscribe, we store a pricing country (an ISO country code derived from the billing address you enter at Stripe checkout, used to show you the right price and tax), a Stripe customer identifier (stripe_customer_id) linking your account to your Stripe record, the date you accepted our Terms of Service (tos_accepted_at), and the policy version you accepted (accepted_policy_version). Your full billing name, billing address, and payment method details (card number, expiry) are collected and held directly by Stripe, our payment processor: we never see or store your full card details.

Usage and analytics data. With your consent, we use Google Analytics, Vercel Analytics, and Vercel Speed Insights to understand how the site is used and to monitor performance. These tools collect data such as page views, approximate location, device and browser information, and page load metrics. We use this to improve the Service, not to build advertising profiles, and we never sell it. Analytics only run once you accept them in the cookie banner; see Cookies below.

Error monitoring data. We use Sentry to detect and diagnose errors. By default, Sentry runs a masked, errors-only baseline: it captures error details (page URL, browser type, stack trace) with your IP address and other directly identifying data removed. Once you consent to analytics, Sentry switches to an enhanced tier that also captures your IP address and request headers, and enables Session Replay, a reconstruction of on-page activity (mouse movement, clicks, navigation) recorded for about 10% of sessions and 100% of sessions where an error occurs. All text is masked and all media is blocked in these recordings, so typed content and images are never captured. Sentry processes this data in the EU (ingest.de.sentry.io).

Comment moderation data. If you post a blog comment, its text is sent to OpenAI's moderation API to screen for hateful, violent, or sexual content before publication. OpenAI does not use this data to train its models.

Your data is used to:

• Authenticate you and maintain your session
• Display your nickname and avatar within the app
• Send transactional emails (e.g. password reset)
• Process your subscription, calculate the correct price and tax for your pricing country, and manage billing through Stripe
• Monitor errors, keep the Service secure, and prevent abuse
• Understand how the Service is used and diagnose bugs, via Google Analytics, Vercel Analytics, Vercel Speed Insights, and Sentry Session Replay
• Screen blog comments for abusive content via OpenAI's moderation API

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Under GDPR, every use of your data needs a legal basis. Here is the basis for each purpose:

Account creation, sign-in, and session management

Contract: necessary to provide the Service you signed up for

Subscription and billing, processed through Stripe

Contract: necessary to provide the paid Service and process your payment

Security, fraud prevention, and the masked error-monitoring baseline

Legitimate interest: keeping the Service safe and working, balanced against your right to privacy

Blog comment moderation via OpenAI

Legitimate interest: keeping the comment section free of abusive content

Analytics, non-essential cookies, and Sentry Session Replay

Consent: only runs after you opt in through the cookie banner

You can withdraw consent at any time using the cookie settings link in the footer. Withdrawing consent does not affect processing carried out before you withdrew it.

We use essential cookies that keep you signed in and remember your consent choices; these are required for the Service to function and do not need consent. We also use non-essential cookies, analytics cookies set by Google Analytics (for example _ga) and the Sentry Session Replay recording described above, which only run after you accept them in the cookie banner shown on your first visit. You can change your choice at any time using the cookie settings link in the footer, or block cookies through your browser settings. We do not use advertising cookies, and we do not sell your data.

We share the minimum data necessary with the following processors to run the Service. Each operates under its own privacy policy and processes only the data required for its function:

• Supabase: database and authentication infrastructure that stores your account data.
• Stripe: payment processing and billing (United States). Stripe holds your billing name, billing address, and payment method details directly; we only store your Stripe customer ID.
• Google: Google Analytics (site usage measurement), Google OAuth (optional sign-in with your Google account), and Gemini (the AI models that generate predictions and editorial content) (United States).
• Vercel: application hosting, Vercel Analytics, and Vercel Speed Insights, a separate performance-measurement beacon (United States).
• Sentry: error monitoring and Session Replay, processed in the EU (ingest.de.sentry.io).
• OpenAI: receives the text of blog comments to screen for abusive content before publication (United States). OpenAI does not use this data to train its models.

We do not share your personal information with any third party beyond what is necessary to operate this service.

Google, OpenAI, Stripe, and Vercel are based in the United States, so your data may be processed outside the European Economic Area. Where that happens, the transfer relies on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Sentry processes data in the EU.

Account data (email, nickname, avatar, pricing country, Stripe customer ID, and consent records) is kept for as long as your account exists. If you delete your account, this data is removed from our systems, other than what we must keep to comply with tax and accounting law.

Blog interactions, likes, saves, and comments, are kept until you delete your account or remove them yourself.

Analytics data (Google Analytics, Vercel Analytics, Vercel Speed Insights) is kept for the minimum retention period each provider offers. Sentry error and Session Replay data is kept for Sentry's configured retention period, after which it is deleted automatically.

Under GDPR and similar privacy regulations, you have the right to:

• Access: request a copy of the personal data we hold about you, or download your data yourself from your account page
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your account and associated data
• Restriction: request that we limit how we process your data in certain cases
• Portability: download your data in a structured, machine-readable format from your account page, or request it from us
• Objection: object to processing we carry out on the basis of our legitimate interests

To exercise any of these rights, contact us at the email address below. You also have the right to lodge a complaint with a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

The Service is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age.

If you are a parent or guardian and believe your child has provided us with personal data, contact us at support@f1predictions.ai and we will delete it. You can also delete an account and its associated data at any time from your account settings.

The data controller is the trader that operates F1 Predictions, identified in our Terms of Service. For privacy-related inquiries, contact us at support@f1predictions.ai.