Privacy policy

WC 2026 (“the Pool”) is a private World Cup fantasy pool operated by Jon Morin as a personal, non-commercial project. It is not affiliated with FIFA or any of the participating federations. You can reach the operator at morinjj@gmail.com.

We only collect what we need to run the pool:

• Account info. If you sign in with Google we receive your name, email address, and profile photo from Google. If you sign up with an email and password we store your email and a hashed password (handled by Supabase Auth).
• Your picks and entries. The team name you choose, the teams and players you draft, your captain, and any picks you edit before lock.
• Activity in the app. Standard server logs (IP address, user agent, request paths and timestamps) generated by our hosting providers when you visit pages or make picks. These are used to keep the service running and to debug problems.

We do not run advertising trackers, sell your data, or share it with marketers. We do not knowingly collect information from anyone under 13.

• To sign you in and keep you signed in.
• To save your picks and calculate the league standings.
• To show your name, team name, and avatar to other members of the pool (this is the whole point of a league).
• To contact you, rarely, about the pool itself (rule changes, account issues). We do not send marketing email.

Other members of the pool can see your display name, team name, avatar, picks (after lock), and points. Your email address is visible to the pool administrator(s) but not to other members.

We use the following providers to run the service. Each processes some of the data above only as needed to provide their piece of the system:

• Supabase — authentication and the application database.
• Vercel — application hosting and request logs.
• Google— only if you choose “Continue with Google” to sign in.
• API-Football — supplies match, team, and player data shown in the app. We send no personal information about you to API-Football.

We keep your account and picks for as long as the pool is active so the standings stay coherent. If you ask us to delete your account we will remove your profile and detach your picks from your identity within a reasonable time, subject to anything we need to retain for security or legal reasons.

• You can update your team name and avatar at any time from your profile.
• You can request export or deletion of your data by emailing morinjj@gmail.com.
• You can revoke Google’s connection to this app from your Google account permissions page.

Authentication and password hashing are handled by Supabase Auth. Traffic to and from the app is served over HTTPS. No system is perfectly secure, but we keep our dependencies up to date and limit access to production data to the operator.

If we make a meaningful change to this policy we will update the date at the top of this page and, where appropriate, mention the change in the app.

Questions, requests, or complaints? Email morinjj@gmail.com.