Privacy Policy

📋 1. Information We Collect

1.1 Information You Provide Voluntarily

We collect information you provide directly to us, such as when you fill out our contact form. This includes:

• Name — to address you personally in our response.
• Email address — to reply to your inquiry.
• Message content — your question, feedback, or bug report.
• Subject / category — to route your inquiry to the appropriate team.

We do not collect this information unless you actively submit the contact form.

1.2 Information Collected Automatically

When you visit our website, certain information is collected automatically through standard web technologies and third-party services. This may include:

• IP address — collected by our hosting provider and by Google Analytics.
• Browser type and version — e.g., Chrome 125, Safari 17.
• Operating system — e.g., Windows 11, iOS 17, Android 14.
• Device type — desktop, tablet, or mobile.
• Referring URL — the page you visited before arriving at our site.
• Pages visited and time on site — collected by Google Analytics.
• Click events — such as which match outcomes you selected (not stored on our servers).
• Screen resolution and viewport size — to understand device usage patterns.

1.3 Information Stored Locally in Your Browser

Your bracket predictions and theme preference are saved in your browser's localStorage — not on our servers. This data:

• Never leaves your device unless you use the "Share Link" feature.
• Is accessible only from your browser on your device.
• Can be deleted at any time by clearing your browser's site data or clicking "Reset Bracket".

🔧 2. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to contact form submissions — we use your name and email to reply to your inquiry and nothing else.
• To improve the website — analytics data helps us understand which features are used, identify bugs, and prioritize improvements.
• To serve relevant advertisements — Google AdSense uses cookies and data to serve personalized or contextual ads based on your interests and browsing behaviour.
• To measure advertising performance — aggregate ad impression and click data helps us understand the site's monetization.
• To ensure technical functionality — log data may be used to diagnose server or CDN issues.
• To comply with legal obligations — if required by law or a valid legal process.

We do not use your information for automated decision-making, profiling, or any purpose not listed above without your explicit consent.

🍪 3. Cookies & Local Storage

3.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They allow websites to remember your preferences and improve your experience. Similar technologies include localStorage (used in your browser) and pixel tags.

3.2 Cookies We Use

3.3 How to Manage Cookies

You can control or delete cookies through your browser settings. Please note that disabling third-party cookies may affect the display of advertisements and some analytics functionality, but will not affect core bracket features.

• Chrome: Settings → Privacy and Security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions

You can also opt out of personalised advertising by visiting Google Ad Settings or the Network Advertising Initiative opt-out page.

📢 4. Google AdSense & Advertising

Our website uses Google AdSense, an advertising service provided by Google LLC ("Google"). Google AdSense uses cookies and web beacons to serve advertisements on our site.

4.1 How Google AdSense Works

Google uses the DoubleClick cookie to serve ads based on your prior visits to our website and/or other websites on the internet. This allows Google to show you relevant advertisements across websites that participate in the Google Display Network.

4.2 Personalised vs. Non-Personalised Ads

Google AdSense may serve both personalised ads (based on your interests and browsing history) and non-personalised ads (contextual ads based on page content). The type of ads shown may depend on your location, consent, and privacy settings.

4.3 Third-Party Vendors

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the internet.

4.4 Opting Out of Ad Personalisation

• Visit Google Ad Settings to manage your ad personalisation preferences.
• Visit aboutads.info to opt out of interest-based advertising from participating companies.
• Install the Google Analytics Opt-out Browser Add-on.

For more information about how Google uses data when you use our website, please visit: How Google uses data from sites that use our services.

📊 5. Google Analytics

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, to help us understand how visitors interact with our website. Google Analytics collects information anonymously and reports website trends without identifying individual visitors.

5.1 What Google Analytics Collects

• Number of visitors and sessions
• Pages viewed and time spent on each page
• Country / city (approximate, based on IP)
• Browser, operating system, and device type
• Traffic source (how you arrived at our site)
• Engagement events (scroll depth, button clicks)

5.2 IP Anonymisation

We have enabled IP anonymisation in Google Analytics. This means that Google will truncate/anonymise the last part of your IP address before storing it. Your full IP address is never stored by Google Analytics on our behalf.

5.3 Data Retention

We have configured Google Analytics to retain user-level data for 14 months, after which it is automatically deleted from Google's servers.

5.4 Opting Out

You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, which prevents the Google Analytics JavaScript from sharing information with Google Analytics about visit activity.

🔗 6. Third-Party Services

Our website integrates with the following third-party services. Each has its own privacy policy governing how they handle your data:

Social sharing integrations only activate when you explicitly click a share button. We do not pre-load social SDKs or tracking pixels from these platforms.

🤝 7. Data Sharing & Sale

We do not sell, rent, trade, or otherwise transfer your personal information to outside parties. We may share data only in the following limited circumstances:

• With service providers: We share data with Google (Analytics, AdSense) and Cloudflare (CDN) as described above, strictly to operate and improve the website.
• For legal compliance: We may disclose information if required by applicable law, court order, or government request, or to protect the rights, property, or safety of our users or the public.
• In a business transfer: If we merge with or are acquired by another company, your information may be transferred as part of that transaction. We will notify you if this occurs.

⏳ 8. Data Retention

• Contact form submissions: We retain contact form emails for up to 12 months, after which they are deleted unless an ongoing matter requires longer retention.
• Browser localStorage: Your bracket data remains in your browser indefinitely until you clear it. We have no access to or control over this data.
• Analytics data: Google Analytics data is retained for 14 months as configured in our GA4 property.
• Server logs: Our hosting provider may retain access logs for up to 90 days for security and performance monitoring.

👶 9. Children's Privacy (COPPA)

Our website is intended for general audiences and is not directed to children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately. We will take steps to remove such information from our records.

Google AdSense on our site is configured to not serve personalised ads to users under 18 in jurisdictions where such restrictions apply.

⚖️ 10. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you (primarily any contact form submissions).

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold.

Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data. For bracket data, simply click "Reset Bracket" or clear your browser's localStorage.

Right to Restrict Processing

You have the right to request that we limit how we process your personal data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format.

Right to Object

You have the right to object to our processing of your personal data for direct marketing or when processing is based on legitimate interests.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Opt-Out of Analytics & Ads

• Install the Google Analytics opt-out extension.
• Visit Google Ad Settings to disable personalised ads.
• Use your browser's privacy mode or a browser extension such as uBlock Origin.
• Adjust your browser's cookie settings as described in Section 3.

🛡️ 11. Security

We take reasonable technical and organisational measures to protect the security of information transmitted to and from our website. These include:

• HTTPS encryption — all data transmitted between your browser and our server is encrypted using TLS.
• No server-side storage of bracket data — your predictions never leave your device in identifiable form.
• Content Security Policy (CSP) — restricts the sources from which scripts and resources can be loaded.
• Regular security reviews — we periodically review our code and third-party dependencies for vulnerabilities.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

🌍 12. International Users & GDPR

Our website is operated from and hosted in servers that may be located in the United States or European Union. If you are accessing our website from outside these regions, including from the European Economic Area (EEA), United Kingdom, or Switzerland, your information may be transferred to, stored, and processed in a country that does not offer the same level of data protection as your home country.

GDPR (European Users)

If you are located in the EEA or UK, the General Data Protection Regulation (GDPR) gives you specific rights. The legal bases for processing your personal data are:

• Consent (Art. 6(1)(a)): For advertising cookies (Google AdSense), where we obtain your consent through a cookie banner.
• Legitimate Interests (Art. 6(1)(f)): For analytics that help us improve the website, where such interests are not overridden by your rights.
• Contract (Art. 6(1)(b)): For processing contact form submissions to respond to your inquiry.
• Legal Obligation (Art. 6(1)(c)): For compliance with applicable laws.

Our Data Protection Officer can be reached at privacy@worldcupbracket.app.

🏛️ 13. California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Opt-Out of Sale: We do not sell personal information. However, you can opt out of the sharing of personal information with Google for advertising by following the opt-out instructions in Section 4.

To submit a CCPA request, please contact us with "CCPA Request" in the subject line. We will respond within 45 days.

🔄 14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will:

• Update the "Last Updated" date at the top of this page.
• For material changes, provide a prominent notice on our website for 30 days.

Your continued use of our website after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

📬 15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: