Privacy policy

The Lovable Game is the data controller for personal data processed in connection with the Service. For any data protection request, contact privacy@bracket26.example.

• Account data: email address, display name, and (if you sign in with Google) your OAuth identifier and profile photo URL.
• Profile preferences: country, favourite team, language, marketing-email opt-in (all optional).
• Game data: your picks, scores, leaderboard position, referral relationships.
• Technical data: IP address, browser, device type, and basic error logs needed to keep the Service running securely.
• Communications: messages you send to support and any opt-in email engagement.

We do not knowingly collect data from anyone under 18.

• To create your account and authenticate you (contract);
• To run the game: score picks, display leaderboards, deliver prizes (contract);
• To keep the Service secure and prevent fraud (legitimate interest);
• To send service emails like password resets or rule changes (legitimate interest / contract);
• To send marketing emails about The Lovable Game and tournaments — only with your opt-in consent;
• To comply with legal obligations (e.g. tax records for prize winners).

We never sell or rent your personal data. We share limited data with carefully chosen processors who help us run the Service:

• Cloud hosting & database (EU region) for storing accounts, picks, and serving the app.
• Authentication providers (Google) if you choose social sign-in.
• Transactional email provider for sign-in links, password resets, and prize notifications.
• Error & uptime monitoring for diagnosing bugs and outages.

Each processor is bound by a data processing agreement. Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses and supplementary measures.

Account and game data is kept for as long as your account is active. If you delete your account, we erase personal data within 30 days, except where we must keep limited records to comply with legal obligations or to defend legal claims (typically up to 6 years for accounting where prizes were issued). Aggregated, anonymised stats (e.g. "32% of players picked Brazil") may be retained indefinitely.

If you are in the EEA, the UK, or a comparable jurisdiction, you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to certain processing;
• port your data to another service;
• withdraw consent for marketing at any time, with no effect on past processing;
• lodge a complaint with your local supervisory authority.

To exercise these rights, email privacy@bracket26.example. We respond within 30 days and may ask for proof of identity.

We use industry-standard safeguards: TLS in transit, encryption at rest, scoped database access, row-level security, and regular dependency audits. No system is 100% secure; we will notify you and the appropriate authority of a breach affecting your personal data within 72 hours of discovery, as required by law.

We use a small, focused set of cookies and local storage:

• Strictly necessary: authentication session and CSRF protection. Always on; cannot be disabled.
• Functional: remembering your country theme, language, and dark/light mode.
• Analytics: aggregated, privacy-respecting product analytics with no cross-site tracking. You can opt out from settings.

We do not use advertising cookies and do not share data with ad networks.

We may update this policy occasionally. Material changes will be announced in-app or by email at least 14 days before they take effect.