This Privacy Policy explains what personal information Gameweek ("we," "us") collects when you use our sports prediction games (the "Service"), how we use it, and the choices you have.
| Data | Why we collect it |
|---|---|
| Email address | Account creation, sign-in, password reset |
| Password | Sign-in. Our sign-in provider stores it only in scrambled (hashed) form; nobody can read it. |
| Username | Displayed on leaderboards; identifies your predictions |
| Your predictions, picks and quiz answers (including the names you type as quiz guesses), and the leagues you create or join | Core gameplay: scoring, leaderboards, private leagues |
| When you accepted this policy, and which policy version | A record of your consent |
| If you sign in through the site you're playing on: the ID that site uses for you, and the email address and name it passes to us | Keeping your game account linked to that site's login |
| How you signed in (with your email, or through the site) | Service reliability and statistics for the site |
| Your IP address and browser type, in our sign-in and security logs | Security, fraud prevention, service reliability |
| Usage analytics: a random identifier, the pages and features you use, and session recordings of how the game is used | Understanding how the Service is used and fixing problems |
| Error reports: your browser, the page, and what went wrong | Fixing problems |
We do not collect payment information, since the Service is free to use and involves no monetary transactions from users.
We don't sell your personal information. We share it only with:
| Service provider | What it does, and what it receives |
|---|---|
| Supabase | Our database, sign-in and backend, hosted in the EU (Frankfurt). Holds the account and game data above. |
| Cloudflare | Hosts and delivers our pages, the game and the widgets, and runs Turnstile, the check on our sign-in, sign-up and password-reset forms that keeps bots out (it reads technical signals from your browser, not who you are). Processes your IP address to do so. |
| PostHog | Usage analytics and session recordings, hosted in the EU. |
| Sentry | Error reports, hosted in the EU (Germany). |
| Resend | Sends our sign-up, password-reset and team-invitation emails. Receives your email address. |
| GitHub | Stores encrypted copies of our database backups (see Data retention). |
| SportMonks, Wikimedia and flagcdn | Club crests, player photos and flags are loaded from their servers by your browser, so they see your IP address. Our sports data suppliers receive no other information about you. |
On the business side, and for visitors to our own website:
| Service provider | What it does, and what it receives |
|---|---|
| Stripe | Handles payments by the businesses that run Gameweek games. Never involved for players. |
| Formspree | Delivers the messages sent through our contact form to us. Formspree, Inc. receives what you type into the form (your name, email, website, subject and message) and processes it in the United States. |
We keep your account information for as long as your account is active. If you delete your account on a site, you can no longer sign in or play on that site and the site's owner no longer sees you as an active player; for 30 days your past results stay on that site's leaderboards under your username and your data is kept so that you can come back (sign in again to restore it); after that, your profile, predictions and leaderboard entries on that site are permanently erased. To have your personal data permanently erased from every Gameweek game at once, use Delete everywhere in the Account section of your profile, or email [email protected] (also if you play through a site's own login); we complete such requests within 3 business days, and copies in our encrypted database backups expire within 30 days, except where we're required to retain information for legal reasons.
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to certain processing. Players can download a copy of their data and delete their account on a site from the Account section of their profile inside the game (this deactivates the profile on that site, and it is erased 30 days later). Delete everywhere erases your account from every site at once; you can also ask by email, see above. For anything else, or if you can't sign in, contact us at [email protected].
If you're located in the EU or UK: our legal basis for processing your data is performance of a contract (running your account and the Service you've signed up for) and legitimate interest (security and fraud prevention). If you believe we haven't handled your data properly, you also have the right to lodge a complaint with your local data protection supervisory authority.
We use essential browser storage (local storage) to keep you signed in between visits. Our website, the prediction game, the widgets and the customer dashboard set no cookies.
Across the Service (our website, the customer dashboard, and the prediction game and widgets embedded on customers' sites) we use PostHog, an EU-hosted analytics service, to understand how pages are used and to fix problems. It stores a random identifier in local storage (not a cookie) and makes session recordings of how the pages are used. Password fields are never recorded, and we strip sign-in and invitation tokens from any web address before it is recorded.
The Service is not directed at children under 16, and we don't knowingly collect personal information from them. You must be at least 16 to create an account.
We may update this Privacy Policy from time to time. We'll indicate the date of the most recent revision at the top of this page, and for material changes, make reasonable efforts to notify users.
Questions about this policy or your data? Reach us at [email protected].