Privacy Policy

The short version

You can use the whole free side of this app without an account and without telling us who you are. We do not sell data, we do not run advertising networks, and we do not track you across other websites.

This service is operated by Ilay Marom. For any privacy question or request, contact support@avdijaszn.com.

If you never sign in

We do not create an account for you and we do not store anything that identifies you on our servers.

Your browser keeps a few things locally, which never leave your device except where noted:

• A random id used only to stop one person from flooding a game with reactions. It is sent with a reaction and with nothing else. It is not linked to a name, an account, or any other activity.
• Your no-spoiler preference, so results stay hidden between visits.
• Your answer to the analytics question, so we stop asking.
• Whether you finished first-run onboarding, and a short-lived copy of your policy acknowledgement and optional “where did you hear about us” answer until they can be saved to your account after sign-in.
• If you send in-app feedback while signed out, the text of that note is stored on our servers without an account id.

If you create an account

Accounts are handled by Clerk, our authentication provider. Your email address and password live with Clerk — they are never sent to or stored on our own servers.

What our database holds about a signed-in reader is:

• An opaque account id issued by Clerk, which looks like "user_2ab…" and means nothing outside this service.
• A display name you choose, so leaderboards are readable.
• An avatar image address, if you set one. Stored encrypted.
• Your own activity: predictions, ratings, reactions, watchlist, prediction groups you join, and any saved views or preferences you create.
• Your acceptance of the current Terms, Privacy Policy, Cookie Policy, Refund Policy and Accessibility Statement, including the policy version and time, so we can show what you agreed to.
• Your optional answer to “Where did you hear about us?”, including up to 120 characters if you choose Other. Skipping has no effect on the service.
• Feedback you send from the in-app review screen (feature requests, bugs, or anything else you type). Stored encrypted. We read it to improve the app. If you were signed in it is deleted with your account.

If you subscribe to Pro or Analyst

Payments are processed by Polar, who act as merchant of record. Card numbers never reach our servers and we never see them.

We store only what is needed to know whether your membership is active: a customer and subscription reference from Polar, the plan you chose, its status, and the date access runs to. Polar is told your account identifier so a purchase can be matched to the right account; it is not told your name or your email by us.

If you message someone

You can message people you share a prediction group with, one to one or in your group’s room for a game. Messages are stored encrypted, and you can block anyone at any time — a block works in both directions, and in a group room it hides that person from you rather than removing them for everybody.

These messages are not end-to-end encrypted. When somebody reports a message, an operator can read that message in order to act on the report. We do not read conversations otherwise, and there is no automated scanning of them.

Reports are kept with the message, who filed them and why, for as long as needed to act on them and to recognise a repeated pattern. Delete your account and your messages go with it; a copy may remain in the other participant’s thread, because it is their conversation too.

If you turn on notifications

A push subscription is a delivery address issued by your browser or phone, plus two keys that let only us encrypt a message to it. We store all three encrypted, and use them for nothing but sending the alerts you asked for.

You can revoke this at any time from Settings, or by removing notification permission in your browser or operating system. Endpoints that stop working are deleted automatically.

Analytics, and why it asks first

We use Vercel Web Analytics and Speed Insights to measure traffic and performance, and PostHog for product events, click heatmaps, and session replay. PostHog stores a random browser identifier after consent; if you sign in, it is linked only to Clerk’s opaque account id.

Replay masks all form entries and rendered page text before data leaves your browser, strips query strings from recorded URLs, and does not record console output. These services stay completely unloaded until you agree and never follow you to other sites.

Declining changes nothing about how the app works. You can withdraw consent at any time from the link in the footer; this stops capture and clears PostHog’s local identifier.

Affiliate and sponsor links

When a sponsored or affiliate link is followed we record which slot was used, where it pointed, and when. That record contains no identifier of any kind and cannot be traced back to a reader — it exists only to show a partner how often their link was used.

Server logs and abuse prevention

Like any web service, our servers see the IP address your request arrives from. We use it in memory to rate-limit abusive traffic, and it is written to a log line when a request fails or when someone tries an invalid operator token — which is how a break-in attempt gets noticed.

These logs are kept only as long as they are useful for diagnosing and defending the service, and are never combined with your account or used to build a profile.

Where a form is protected by Cloudflare Turnstile, your IP address is also passed to Cloudflare as part of that check.

What we never collect

• Advertising or cross-site tracking identifiers.
• Your location. The app converts tip-off times using the timezone your device reports, which happens entirely in your browser.
• Your contacts, calendar, photos, or device identifiers.
• Payment card details.
• Your email address, on our own servers.

Why we are allowed to hold it

Where the UK/EU GDPR or Israeli privacy law applies, our grounds are:

• Performing our contract with you — running your account, your membership, and the features you switch on.
• Your consent — analytics, and push notifications. Withdrawable at any time.
• Legitimate interests — keeping the service working and defending it against abuse, such as rate-limiting reactions.
• Legal obligation — keeping billing records for as long as tax law requires.

Who else processes it

We use a small number of providers, each for one job:

• Clerk — accounts and sign-in.
• Polar — payments and subscriptions, as merchant of record.
• Vercel — hosting the website, and analytics if you agreed to it.
• PostHog — product analytics, click heatmaps, and privacy-masked session replay if you agreed to it.
• Railway — hosting the API and the database.
• Cloudflare — Turnstile, the check that separates people from bots on some forms.
• Sentry — crash and error reports, with no account identifiers attached.
• ESPN — the source of every statistic shown. We only ever read from it. Nothing about you is sent there.

Where it is held, and for how long

Our providers operate servers outside Israel, including in the European Union and the United States, so your data may be processed there under the transfer safeguards those providers offer.

Sensitive values — push credentials, invite tokens, avatar addresses and saved preferences — are encrypted in our database rather than stored in plain text.

We keep account data for as long as the account exists. Delete your account and it goes with it, except billing records we are legally required to retain. Anonymous affiliate click counts are kept indefinitely because they identify nobody.

Your rights

You can ask for a copy of what we hold, correct it, delete it, restrict or object to how it is used, or take it elsewhere in a portable form. You can withdraw consent for analytics or notifications at any time without losing anything else.

Providing account information is voluntary, but without it we cannot create or run an account. The acquisition-source question is optional and skipping it has no consequence. We do not sell or share personal information for cross-context behavioural advertising, use it for targeted advertising, or make decisions with legal or similarly significant effects by automated profiling.

Residents of US states with applicable privacy rights may ask to know, access, correct, delete, or obtain a portable copy of covered personal information, and may appeal a refusal by replying to our decision. We will not discriminate against you for exercising a right. Because we do not sell, share, or use personal data for targeted advertising, there is no such processing to opt out of.

Write to support@avdijaszn.com and we will respond within 30 days. If you are not satisfied you may complain to your local data protection authority, or in Israel to the Privacy Protection Authority.

Children

This app is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes

If this policy changes in a way that affects you, we will say so in the app rather than quietly editing the page. The date above always reflects the current wording.