Privacy Policy This policy explains how predictapp handles personal data on the predictapp.io website, the predictapp web app, the iOS and Android apps, the predictapp API, the predictapp MCP server and the predictapp analysis plugin for AI clients (together, "predictapp" or "the Service"). Who is responsible for your data The data controller is R-W Services SRL, Strada Putnei 15, 550410 Sibiu, Romania ("we", "us"), which operates predictapp. You can contact us about anything in this policy at support@predictapp.io. Because we are established in Romania, we process personal data under the EU General Data Protection Regulation (GDPR) and Romanian data protection law. What data we collect We collect only what we need to run the Service: • Account data: your email address, your password (stored by our authentication provider in protected form, never readable by us) or, if you sign in with Google or Apple, the account identifier and email that provider shares with us. Optionally your name, username, country and language. • App data: the things you create and choose in the app, such as saved picks, bets and combos, reveal history, fantasy teams and scoring formats, league preferences, missions and streaks, and notification settings. • Sleeper link (optional): if you link a Sleeper account, the Sleeper username and user ID you give us, and the public league and roster data we fetch from Sleeper to analyse your lineup. • Push notifications (mobile apps): a device token, so we can send the notifications you have enabled. • Referrals: your referral code and the referrals and rewards linked to it. • Payment records: what you bought, when, the amount, its status, and any refunds or disputes, plus the customer and subscription identifiers our payment providers give us. Card payments on the web are handled by Stripe; purchases in the iOS and Android apps are handled by Apple and Google, with RevenueCat managing app subscriptions. We never receive or store your full card number. • API and MCP access: the API keys you create (we store only a name, a prefix, a one-way verifier and creation, last-used and revocation dates, never the readable key), your AI client connections and the permissions you granted them, your machine-credit wallet and its ledger of top-ups, charges and reversals, your included-call allowances and usage, the prediction resources you have acquired, and, if you ask for it, the forecasts and selections you save and how they were graded. • Requests to the API, MCP server or analysis plugin: the parameters of each request, such as sport, event or player IDs, scoring format, thresholds and access mode. We do not need, and do not ask your AI client for, your conversation with it or any unrelated documents. • Website usage data: pages visited, browser, device, approximate location derived from your IP address, and cookies, as described under "Cookies and advertising" below. • Support messages: what you send us when you contact support. What we use it for, and why we are allowed to • To provide the Service you signed up for: creating and running your account, showing predictions and stats, saving your picks, running API and MCP requests, counting included calls, charging and crediting your wallet, and processing subscriptions and purchases. Legal basis: performance of our contract with you. • To send you the emails and notifications the Service needs, such as purchase receipts, password resets and results of things you saved. Legal basis: performance of our contract. • To send you newsletters, coaching emails and promotional notifications. Legal basis: your consent or, for existing customers, our legitimate interest in telling you about similar services. You can unsubscribe from every marketing email and turn off notifications in the app at any time. • To keep the Service secure and prevent abuse, including detecting fraud, payment abuse and repeated refund claims. Legal basis: our legitimate interest in protecting the Service and our customers. • To measure and improve the website and app, and to show ads on certain pages. Legal basis: your consent, where the law requires it (see "Cookies and advertising"). • To keep accounting and tax records and respond to lawful requests. Legal basis: legal obligation. AI clients and the analysis plugin You can connect predictapp to an AI client, such as ChatGPT, through the MCP server or the analysis plugin. When you do, the AI client sends us the request parameters described above and receives back the model outputs and, where relevant, account, allowance and billing information for that request. The AI client is run by its own provider, under that provider's own terms and privacy policy. We do not control how the AI provider stores, uses or trains on your conversations or on the results we return. Please read their policy before connecting. What your AI client can see about you When you connect an AI client, our consent screen lists exactly what it is asking for before you approve. Depending on what the client requests and what is available in your account, it can receive: • Your predictapp account identifier (always). • Your email address and whether it is verified. • Your name and profile picture. • Your phone number and whether it is verified. • Permission to stay connected by refreshing its session. The predictapp analysis plugin asks only for your account identifier and permission to stay connected. Other AI clients may ask for the other permissions above. These identity permissions only tell the AI client who you are. They do not give it access to your app data, picks or account settings. The connection itself can only make prediction and machine-access requests on your behalf. You can disconnect an AI client and revoke API keys at any time in Settings, API & MCP. Disconnecting a client or revoking a key stops future access. It does not delete your predictapp account. To delete your account, see "Deleting your account" below. Who we share data with We do not sell your personal data. We share it only with service providers that help us run predictapp, under contracts that require them to protect it, and only as needed for the purposes above: • Supabase: authentication, database and server functions. • Neon: database hosting for sports model data. • Netlify: website and app hosting. • Stripe: web payments, subscriptions and refunds. • Apple, Google and RevenueCat: in-app purchases and app subscriptions. • Google Firebase Cloud Messaging and Apple Push Notification service: push notifications. • Resend: transactional emails. • SendFox: newsletters. • Google (Analytics, Tag Manager, AdSense and its consent tool) and Microsoft (Clarity): website analytics and advertising, as described below. • Sleeper: only if you link your Sleeper account, to fetch your public league data. • AI clients you connect: as described above, at your direction. We may also disclose data where the law requires it, to respond to a valid request from a court or authority, or to protect our rights and our users. Some of these providers are based in, or process data in, countries outside the European Economic Area, such as the United States. Where that happens, we rely on the safeguards those providers offer, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. How long we keep data We keep your account and app data for as long as your account is open. When you ask us to delete your account, we delete it within 30 days. We keep payment and accounting records, such as purchases, refunds, wallet charges and invoices, for as long as Romanian tax and accounting law requires, even after your account is deleted, and then delete them. Revoked API keys and disconnected AI clients stop working immediately. Their records stay attached to your account until the account is deleted, so the history of your charges stays accurate. Deleting your account Email support@predictapp.io from the email address on your account, with the subject "Delete my account". You can also start this from predictapp's account deletion page without signing in. We will confirm and delete your account and the data tied to it within 30 days, except the payment records described above. Your rights Under the GDPR you have the right to: • Access the personal data we hold about you and get a copy of it. • Correct data that is wrong or incomplete. • Delete your data. • Restrict or object to how we use it, including at any time to marketing. • Receive the data you gave us in a portable format. • Withdraw your consent at any time, without affecting what we did before. To use any of these rights, email support@predictapp.io. We will reply within one month. If you think we have not handled your data properly, you can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, www.dataprotection.ro), or to the authority in the EU country where you live. Cookies and advertising The website uses cookies and similar technologies to remember your preferences, measure how the site is used, prevent fraud, and show ads. Some pages of the website, the stats pages (leagues, clubs, matches, markets, NFL teams, players, props and fantasy), show ads served by Google AdSense. The home page, pricing, about, contact and legal pages do not show ads. • Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other websites. • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. • Google and its partners may collect and process data such as your IP address, device identifiers, browser information and the pages you visit, to show, measure and personalise ads and to prevent fraud. • You can learn how Google uses information from sites that use its services here: https://policies.google.com/technologies/partner-sites • You may opt out of personalised advertising by visiting Google's Ads Settings: https://adssettings.google.com. You can also opt out of some third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices (and, in Europe, https://www.youronlinechoices.eu). If you opt out, or do not consent, you may still see ads, but they will not be personalised. If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before any advertising or analytics cookies are used. That consent is collected by Google's consent management platform, which is certified under the IAB Europe Transparency and Consent Framework, and lists every advertising partner and purpose so you can accept, reject or choose per purpose and per partner. Until you answer, Google's tags run with consent denied (Google Consent Mode), and no advertising cookies are set. Elsewhere, a banner explains that we use cookies for analytics and ads, and you can reject them. If you reject, analytics and ad personalisation are switched off and only non-personalised ads are shown. Where US state privacy laws apply, you can also opt out of the sale or sharing of your personal information for targeted advertising through the link Google's consent tool shows. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. You can also delete or block cookies in your browser settings, although some parts of the site may then not work. The third parties that may set cookies or similar technologies on the website are Google (Google Analytics and Google Tag Manager, for usage statistics; Google AdSense and its advertising partners, for ads; privacy policy: https://policies.google.com/privacy) and Microsoft (Clarity, for usage analytics; privacy statement: https://privacy.microsoft.com/privacystatement). We do not change how the website collects data when your browser sends a Do Not Track signal. Use the cookie settings above instead. Age requirements The predictapp website, web app and mobile apps, and the general API and MCP server, are for people aged 18 or older, because they cover betting markets and odds. The predictapp analysis plugin contains no betting features and can be used by people aged 13 or older. If you are between 13 and 17, you need a parent or guardian's permission to use it, and you cannot make purchases. We do not knowingly send marketing to anyone under 18, or use their data for personalised advertising. If you are a parent or guardian and believe your child has given us personal data in a way this policy does not allow, email support@predictapp.io and we will delete it. Security We protect your data with technical and organisational measures appropriate to the risk, including encrypted connections, access controls that limit who can see personal data, and storing API keys and passwords only in protected form. No system is perfectly secure, so please keep your password and API keys private and revoke any key you think has been exposed. Changes to this policy We may update this policy when the Service or the law changes. We will post the new version on this page with a new date, and tell you by email or in the app if a change significantly affects how we use your data. Contact R-W Services SRL, Strada Putnei 15, 550410 Sibiu, Romania support@predictapp.io Last updated: October 28, 2026