Predyvo Privacy Policy

1. Controller

The controller is [nazwa operatora serwisu – do uzupełnienia], [adres do korespondencji – do uzupełnienia]. Contact: kontakt@predyvo.com.

2. Data we process

• From sign-in (Google, Microsoft, LinkedIn, X): account ID at the provider, name, email address (if the provider shares it) and profile picture.
• From email sign-in: your email address and one-time sign-in codes (we store only their hashed form, valid for 10 minutes).
• Account data: username, profile picture (if you add one), profile bio, privacy settings, chosen language, role, referral code.
• A public profile shows others your nickname, picture, bio, join date, follower count, PT and Predyks results, ranking positions and – if you allow it – your settled forecasts and bets history. A private profile shows others only your nickname (e.g. in comments). New profiles are public by default – you can make yours private in the settings at any time.
• Game activity: stakes, balance and Predyks transaction history, markets, proposals, comments, reactions, followed players, reports, achievements, notifications.
• Technical data: IP address and request data in server logs, strictly necessary cookies.
• Analytics data (only with your consent): pages visited, identifiers from Google cookies, browser and device information, IP address.
• Contact form: topic, message and – if you provide it – an email address for the reply.

3. Purposes and legal bases

• Running your account and the game (Art. 6(1)(b) GDPR – performance of the contract, i.e. the Terms).
• Security, abuse prevention and content moderation (Art. 6(1)(f) GDPR – legitimate interest).
• Handling reports, complaints and contact form messages (Art. 6(1)(b) and (f) GDPR).
• Analysing use of the service with Google Tag Manager and Google analytics tools (Art. 6(1)(a) GDPR – consent, which you can withdraw at any time in the footer under “Cookie settings”; withdrawal does not affect the lawfulness of earlier processing).

We make no decisions with legal effects based solely on automated processing. Leaderboards and levels result only from in-game activity.

4. Recipients

• Hetzner Online GmbH (Germany) – servers running the service and database.
• OVH (France) – domain registration and DNS.
• Google, Microsoft, LinkedIn and X – only when you sign in with that provider, under their privacy policies.
• OVH SAS (France) – email service (no-reply@predyvo.com mailbox): your email address and the message with the sign-in code, only when you sign in with email.
• Cloudflare, Inc. (USA) – Cloudflare Turnstile, protecting the sign-up and sign-in window against bots: your IP address and browser and device information needed to tell a person from an automated script, only during the “I'm not a robot” check. Legal basis: our legitimate interest in protecting the service against abuse (Art. 6(1)(f) GDPR).
• Anthropic PBC (USA) – the Claude AI model: creating markets from news, translating market content (including player proposals), resolution suggestions and comments by labelled AI bots. We send market content and, for bot comments, the latest comments in the market discussion (username and text) – never email addresses or other account data.
• Let's Encrypt – HTTPS certificate (no user data).
• Google Ireland Limited (Ireland) and Google LLC (USA) – Google Tag Manager and analytics tools, only after you consent in the banner: the data listed under “Analytics data”.

Data may also be disclosed to authorities entitled by law.

5. Transfers outside the EEA

Anthropic, Cloudflare, Google (analytics tools – with your consent) and – when you sign in – Google, Microsoft, LinkedIn and X may process data in the USA, based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

6. Retention

• Account and activity data – until the account is deleted; Predyks transaction history may be kept longer in anonymised form.
• Server logs – up to 30 days; database backups – up to 14 days.

7. Your rights

You have the right to access, rectify, erase, restrict and port your data and to object to processing based on legitimate interest. Write to the contact address.

You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa) or the authority in your country.

8. Cookies and browser storage

Strictly necessary cookies: the sign-in session, CSRF protection, the “I'm not a robot” check confirmation at sign-up (30 minutes) and – if you arrive via a referral link – the referral code (30 days). They do not require consent.

The “I'm not a robot” check is performed by the Cloudflare Turnstile widget shown in the provider's frame (see “Recipients”); where it is not enabled in a given version of the service, the check runs on our own server.

Google analytics cookies (such as _ga) are set only after you click “Accept” in the banner. Without consent the Google tag is not loaded at all. You can change your decision in the footer under “Cookie settings”; when you withdraw consent we remove these cookies from your browser.

Browser storage keeps only interface settings (e.g. hiding the guide) and your analytics decision.

9. Changes

We announce significant changes in the service. The current version is always available on this page.