Privacy Policy

Last Updated: June 8, 2026

1. Introduction & Nature of Service

AI World Cup 2026 (“the Service”) is a free virtual prediction platform for entertainment purposes only. No real money is involved. All predictions use virtual credits with no monetary value. Users receive a starting balance of $50,000 in virtual credits to make predictions on FIFA World Cup 2026 matches.

The Service displays predictions generated by third-party AI models (Claude, ChatGPT, Grok, and Gemini). These predictions are not created, verified, or endorsed by AI World Cup 2026 and do not represent the views or opinions of this platform or its operator. They are provided for entertainment purposes only and must not be used for making real-money wagers or financial decisions.

This Service is a personal project and is not operated by a registered company or corporation. It is not affiliated with, endorsed by, or connected to FIFA, any football federation, or any licensed gambling or wagering operator.

This Privacy Policy describes how we collect, use, and protect your information when you use our website. By creating an account or using the Service, you agree to the practices described in this policy.

2. Information We Collect

Account Data

When you create an account, we collect:

• Display name (user-provided)
• Email address (used for login)
• Password (hashed using bcrypt via Supabase Auth — we never store or have access to your plaintext password)
• Avatar selection (chosen from preset options)
• Timezone (auto-detected or manually selected)

Prediction Data

When you use the Service, we collect:

• Prediction selections — match, market, selection, odds, allocation, result, and return
• Credits statistics — balance, accuracy, correct picks, total picks, ROI, and streak

None of this represents real money. All allocations, returns, and credit values are virtual with zero monetary value.

Technical Data

• IP address: Used transiently during sign-in and sign-up solely to auto-detect your timezone via our third-party provider (ipinfo.io). Your IP address is not stored in our database — only the derived timezone is retained.
• Session token: A signed JWT stored as an HTTP-only cookie to maintain your authenticated session, managed by Supabase Auth.
• Server logs: Standard web server logs (IP, user-agent, timestamps) may be retained by our hosting provider for security and operational purposes.

Data We Do NOT Collect

• Payment or financial information (no real money transactions exist)
• Government-issued identification
• Social media account data
• Browsing history or cross-site activity
• Device fingerprints or advertising identifiers
• Biometric data

3. How We Use Your Information

We use the information we collect to:

• Create and authenticate your account
• Enable you to place virtual predictions and track your performance
• Display your name, avatar, and prediction statistics on the public leaderboard
• Auto-detect your timezone for accurate match time display
• Maintain session security and prevent unauthorized access

We do not use your data for advertising, marketing emails, behavioral profiling, or any purpose unrelated to operating the Service. We never sell your data to third parties.

4. Cookies & Tracking Technologies

We use two cookies:

These cookies are strictly necessary for the Service to function. They are not used for tracking, analytics, or advertising. The geo_tz cookie stores only a timezone identifier (e.g., “Asia/Kolkata”) derived from your IP address — your IP address itself is not stored.

We do not use:

• Google Analytics or any third-party analytics service
• Advertising or cross-site tracking cookies
• Tracking pixels, beacons, or web bugs
• Browser fingerprinting or similar identification technologies
• Third-party cookies of any kind

5. How We Share Your Information

Public Information

Your display name, avatar, and prediction performance statistics (credits, accuracy, ROI, streak) are publicly visible on the leaderboard to all visitors of the Service.

Third-Party Service Providers

Our AI prediction models (accessed via OpenRouter) and sports data provider (API-Football) never receive any user personal data. They are used solely to generate match predictions and retrieve fixture information.

We do not sell your data and we do not share it with advertisers. We may disclose your information if required by law, legal process, or governmental request, or to protect the rights, safety, or property of the Service or its users.

6. Data Security

We implement the following security measures to protect your data:

• Passwords are hashed using bcrypt via Supabase Auth (never stored in plaintext)
• Authentication sessions use signed JWTs with automatic refresh
• Auth cookies are HTTP-only and Secure (not accessible to client-side JavaScript)
• Database queries use parameterized statements via Drizzle ORM to prevent SQL injection
• No payment or financial data is collected or stored

While we take reasonable precautions to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Data Retention

When you request account deletion, all your personal data — including your account information, prediction history, credits data, and active sessions — is permanently and irreversibly removed through cascading deletion.

8. Your Rights

Regardless of where you are located, you have the following rights:

• Access: You can view all your personal data on your Profile page at any time.
• Correction: You can update your display name, avatar, and timezone directly from your Profile page.
• Deletion: You can request complete account deletion by contacting us. Deletion permanently removes all your data, including prediction history, credits, and session data.
• Data Portability: You may request a machine-readable copy of your personal data by contacting us.

To exercise your rights, contact us at founder@aiworldcup2026.com. We aim to respond to all requests within 30 days.

9. GDPR (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional provisions apply:

Legal Basis for Processing

• Contract: Processing your account and prediction data is necessary to provide the Service you signed up for.
• Legitimate Interest: Timezone detection via IP address to improve your user experience (displaying match times in your local timezone).

Your Additional Rights Under GDPR

In addition to the rights listed in Section 8, you have the right to:

• Restrict the processing of your personal data
• Object to processing based on legitimate interest
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with your local data protection supervisory authority

Data controller: AI World Cup 2026, operated as a personal project. Contact: founder@aiworldcup2026.com

10. CCPA (California Users)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Categories of Personal Information Collected

• Identifiers (name, email address)
• Internet or network activity (session data)
• Geolocation data (timezone derived from IP address)

Your California Privacy Rights

• Right to Know: You can request details about the personal information we collect, use, and disclose.
• Right to Delete: You can request deletion of your personal information.
• Right to Opt-Out of Sale: We do not sell your personal information to any third party. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including countries where our hosting provider operates. ipinfo.io may process your IP address in their own facilities for timezone detection.

By using the Service, you acknowledge that your data may be processed in jurisdictions with different data protection laws than your own. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

12. Age Restrictions

This Service is intended for users aged 18 or older. While no real money is involved, the prediction context of the Service is designed for adult users.

We do not knowingly collect personal data from anyone under the age of 18. If we learn that we have collected personal information from a user under 18, we will take steps to promptly delete that information.

We also do not knowingly collect personal information from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If a parent or guardian believes their child has provided us with personal information, please contact us at founder@aiworldcup2026.com and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The “Last Updated” date at the top of this page indicates when the policy was most recently revised.

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

We aim to respond to all inquiries within 30 days.