Privacy Policy

Data we collect

• Account data — the email address, username, and any profile details (such as a display name or avatar) you provide, and your authentication information.
• Activity data — the forecasts, reasoning, and other content you submit, and your interactions with the Service (questions viewed, deep dives, rankings, and similar).
• Technical and usage data — device, browser, IP address, and log data, and analytics events about how the Service is used.
• Payment data — if you subscribe, payment is processed by Stripe. We store a Stripe customer/subscription reference and status; we never receive or store your full card details.
• Communications — messages you send us and your email/notification preferences.

How we use your data, and our lawful bases

Under the UK GDPR we rely on the following lawful bases:

• To perform our contract with you — creating and managing your account, running forecasting, consensus, and leaderboards, and providing and billing the Premium subscription.
• Our legitimate interests — to secure, maintain, analyse, and improve the Service, prevent fraud, abuse, and manipulation, and understand how features are used (in a way that does not override your rights).
• Your consent — for any optional marketing emails and any non-essential cookies, where required. You can withdraw consent at any time.
• Legal obligations — to comply with law, respond to lawful requests, and keep necessary records.

Service providers we share with

We share personal data only with trusted providers that process it on our behalf under contract, or where required by law. These include Supabase (database and authentication), Vercel (hosting), Stripe (payments), PostHog (product analytics), our email delivery provider (for sign-up and account emails), and market-data providers (Twelve Data, CoinGecko). Public parts of your profile, such as your username and forecasts, are visible to other users by design. We do not sell your personal data.

International transfers

Our primary database is hosted in the UK/EU. Some of our providers may process data outside the UK. Where that happens, we rely on an appropriate safeguard — such as a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses — so that your data receives an equivalent level of protection.

Cookies and analytics

We use strictly necessary cookies for authentication and security, and product-analytics cookies (PostHog) to understand usage and improve the Service. You can control or block cookies through your browser settings, though disabling some may affect functionality.

Marketing and communications

We send service and account messages (such as sign-up confirmation, security, billing, and forecast notices) that are necessary to operate the Service. Any optional marketing email includes an unsubscribe link; unsubscribing stops those emails without affecting your account or subscription.

Data retention

We keep personal data for as long as your account is active and for a reasonable period afterwards, and longer only where needed to meet legal, accounting, security, or dispute-resolution requirements. When data is no longer needed we delete or anonymise it. Aggregated or anonymised data that no longer identifies you may be retained.

Security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and database-level security rules. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your rights

Subject to the UK GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You can update your profile and delete your account from your settings, or contact us to exercise any right. We will respond within the time limits the law requires.

If you are unhappy with how we handle your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to address your concern first.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Consensus figures and rankings are generated automatically but are informational and do not determine your legal rights.

Users outside the UK

If you access the Service from outside the UK, you may have additional or different rights under your local law (for example, the EU GDPR or the California CCPA). Contact us and we will handle your request in accordance with applicable law.

Changes and contact

We may update this policy from time to time; material changes will be posted here with an updated date. Questions or requests can be sent to probsquestions@gmail.com.