Privacy Notice

• Account data: the email address and password you sign up with, held by Supabase Auth (the authentication service Praedictum uses; the password is stored as a hash). Every email we send, including confirmation, sign-in and password-reset emails from Supabase Auth and our invitation emails, is delivered through Resend, so Resend receives your email address and the content of those messages.
• Product data, once signed in: your player lock/exclude preferences, your private adjustments to Praedictum’s baseline projections, the runs you start (simulations, lineup builds), and the lineups you mark as submitted. All of it is stored under an internal, opaque account id, not directly under your name or email.
• Join Beta waitlist form: if you used it, the email address you submitted, the optional “what do you play” line, the time you consented and which version of this notice you consented to.
• Request metadata: as with any web request, our hosting providers may log your IP address and browser details as part of normal server operation.

The account email authenticates you and lets us contact you about your account. Product data is your working state in the app; it is what makes your locks, adjustments and lineups yours. Praedictum runs no analytics and uses none of this data for marketing or advertising.

Praedictum itself sets the cookies needed to keep you signed in (Supabase Auth session cookies). We do not use analytics or advertising cookies of our own. If that changes we will update this notice and ask for consent where required.

The sign-up, log-in, password-reset and resend-confirmation pages load a bot check (Cloudflare Turnstile) script from Cloudflare. Cloudflare receives your IP address and browser signals to tell people from bots, and it may set its own cookies or use your browser’s storage for that purpose, under Cloudflare’s own terms. We have not independently catalogued what it stores.

In Praedictum’s own Postgres database, hosted on Supabase, in the region configured for the Supabase project. Supabase (database and account authentication), Vercel (this web site), Render (API server and background processing), Resend (delivery of all our emails, including sign-in and confirmation emails, so it receives account email addresses) and Cloudflare (DNS and, where enabled, the bot check) act as Praedictum’s service providers and process data on its behalf. We do not sell your data.

Account and product data are kept until you ask us to delete your account or the beta ends. A Join Beta signup is deleted when we invite you, 12 months after you submitted it if we haven’t invited you by then, or when the beta ends, whichever comes first; until an automated sweep exists this is done by hand, so “12 months” means “up to 12 months”. Server logs are kept by each provider under its own defaults.

There is no in-app delete button yet. To ask for deletion, email praedictum2026@gmail.com from the address on your account. An admin honoring the request deletes your Supabase Auth account (your sign-in), your Join Beta signup row and your invitation row, and records that the erasure happened.

What is not deleted: your preferences, adjustments, runs, lineups and marks are kept unchanged for product-history reasons, under the same opaque account id they always used. Once your account is gone that id maps to no one, so tracing it back to you would need a separate breach.

For any other privacy request, such as a copy of your data or a correction, contact us at praedictum2026@gmail.com; we handle these by hand. If you are in the EU, UK or California you may have further rights, including to complain to your data-protection regulator.

Praedictum is for adults of legal age in their jurisdiction (at least 18, or 21 where that is the minimum). We do not knowingly collect data from anyone younger.

Privacy questions and requests: praedictum2026@gmail.com.

Any change in wording gets its own notice version, shown at the top of this page. See also the Beta Terms.