Privacy Policy
Last updated: September 28, 2026
1. Who We Are
RafiPick Arena is a private sports prediction platform. We are committed to protecting your personal data and being transparent about how we use it.
2. Data We Collect
- Account data: Email address, display name (from Google OAuth, or the part of your email before @ if you sign up with a password) and, for password accounts, a salted hash of your password stored by Supabase.
- Usage data: Predictions you submit, scores, XP, and pool membership
- Technical data: IP address, device type, browser
- Measurement data (only with your consent): in-app events (e.g. a prediction saved), page views, clicks, and a recording of your session with all form inputs and player nicknames masked — filed under your account’s technical ID, never your e-mail or name. See section 5.
3. How We Use Your Data
- Providing and operating the Service
- Displaying your predictions and ranking within Pools
- Sending Service-related notifications (if enabled)
- Improving the Service via measurement tied to your account (only with your consent, see section 5)
4. Authentication
We use Google OAuth 2.0 or email + password, both via Supabase. With Google we never see your Google password; only your email and display name are shared. With a password account, Supabase stores only a hash of the password. Verification and password-reset codes are sent from rafi@rafipick.com through the mail servers of WEDOS Internet, a.s. (Czech Republic). Profile pictures are not stored or used.
5. Cookies
We use the following cookies and only the following cookies:
- Essential cookies (always on, no consent needed): your sign-in session, the consent choice itself, an invitation or referral code for 5 minutes while you sign in, and where to return you to (return_to) for 5 minutes.
- rafi_pick (essential, no consent needed): if you pick a score before signing in (landing, leagues overview or a league page), or on a pool that asks you to choose a tribe first, we keep that pick — the pool, the match and your score, nothing else — in this cookie for up to 24 hours so we can save it once you sign in and, where needed, choose a tribe. It is httpOnly, holds no identifier and is deleted as soon as the pick is saved or rejected.
- Measurement (only with your consent): PostHog (EU data centre, Frankfurt) receives in-app events (e.g. a prediction saved), page views and clicks, plus a recording of the session in which every form input and every player nickname is masked. It is filed under your account’s technical ID — a random UUID — never your e-mail or name. Vercel Analytics and Speed Insights run under the same consent.
You give this consent as an explicit choice between two equal buttons, never a pre-ticked box: for a newcomer it is the question right after the entry oath, for an existing player without an answer yet it is a one-time dialog. We store the choice as a timestamp on your profile, so it survives clearing cookies or switching browsers on the same account. You can change your mind at any time in Profile → Measurement: turning it off stops new measurement right away — but anything already queued in your browser at that exact moment may still be sent, since it was collected while consent was valid.
We do not ask visitors who are not signed in anything at all, and we do not measure them in the browser. Our public pages (the landing page, the guides and these legal pages) are counted on the server without cookies and without any identifier — we only record which page was opened, in which language, and the domain of the link that led here. Nobody can be recognised from that, so it needs no consent.
6. Data Sharing
We do not sell your personal data. We share data only with trusted processors (Supabase, Vercel, PostHog — EU hosting; WEDOS Internet, a.s. for transactional emails) necessary to operate the Service. All processors are GDPR-compliant.
- Pool members: your nickname and points are visible to other members of the same pool and may be shared by them outside the app as a standings image (nicknames and points only, no avatars).
7. Data Retention
We retain your data as long as your account is active. You may request deletion at any time by contacting us. Aggregated prediction statistics without a link to your account may be retained for statistical purposes.
8. Your Rights (GDPR)
If you are in the EU/EEA, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion ("right to be forgotten")
- Object to processing
- Data portability
To exercise these rights, contact: info@rafipick.com
9. Security
We implement industry-standard security measures including HTTPS, Row Level Security (RLS) in our database, and authentication through Supabase Auth (Google OAuth, or email + password stored only as a hash; sign-ups and password resets are confirmed by a one-time code).
10. Changes
We may update this Privacy Policy. We will notify you of significant changes via the platform. Continued use constitutes acceptance.