UPDOWNSCORE — PRIVACY NOTICE (DRAFT v1.0, 18 October 2026)
IMPORTANT: This is a privacy-by-design draft, not legal certification. Add the operating legal entity, privacy contact, applicable jurisdiction, processor terms and retention periods before inviting the public.
1. Minimal sign-up. Our application does not ask for or intentionally store a real name, email address, phone number, postal address, date of birth, bank details, financial portfolio, password or government ID. At sign-up, we ask you to attest that you are at least 18; we do not collect your birth date.
2. What is stored in the UpDownScore application tables. A random account ID, the public username you choose, your stock tickers, UP/DOWN calls, timestamps, outcomes, score, follow relationships and the date/version of the terms you accepted. These are needed to run the public game and prevent manipulation. A user ID, username and activity history may still be personal data or pseudonymous data under applicable privacy laws.
3. What becomes public. Your username, prediction history, direction, dates, outcomes, rolling accuracy, followers and following may be visible to visitors. Never place private information in the public username. We do not offer private predictions in this version.
4. Supabase Authentication. Anonymous sign-in creates an authentication account ID and tokens without requiring email or phone numbers. Session credentials are held in local browser storage, not in UpDownScore's public tables. Sign-out, cleared local storage or switching devices can make the account unrecoverable. Supabase may also process operational information including IP addresses and authentication events.
5. Technical service providers. Cloudflare (web delivery and security), Supabase (hosted database and authentication) and any third-party content-delivery provider used for application libraries may process IP addresses, usage metadata, logs or security events as part of delivering the website. We cannot promise that these vendors collect zero technical personal data. Their own privacy notices and processing terms also apply.
6. Purpose. Data is used to register pseudonymous participation, timestamp predictions, enforce 9:00 AM IST cutoff, settle forecasts, display public leaderboards, let people follow others, investigate abuse and protect the platform. We do not sell user data or request access to bank/trading accounts.
7. Storage and retention. Resolved predictions are normally retained for a rolling 365 days. Pending disputed/unverified results may remain until resolved. Public profile/follow records remain while the profile is active. Auth-provider records, server logs, backups and security records may have different retention rules; those require a documented provider review before launch.
8. Rights and removal. Before opening to the public, the operator will provide a working contact and tested process to request deletion, access or correction where legally required. Because this version has no identity recovery, users should retain their browser session and never assume they can recover their profile after clearing it. Public predictions must not be edited in a way that undermines score integrity, but privacy rights and lawful removal requests will be handled appropriately.
9. Security. The application uses HTTPS, server-enforced cutoff times, database row-level security and privileges restricting who can create or change predictions and scores. Security cannot be guaranteed absolutely. Abuse protections such as CAPTCHA and rate limits should be enabled before public release.
10. Children's data. This platform is intended for adults 18+. We do not knowingly invite or request children's data.
11. Updates and compliance. Applicable privacy rules depend on the operator's location and users served (including India and Singapore). A proper legal and vendor assessment is required before public launch. We will publish significant changes and request fresh consent where legally necessary.