Privacy Policy

Quiet Please ("we", "us", "our") operates the website quietplease.app(the "Service"). We are subject to the EU General Data Protection Regulation (GDPR).

For any privacy-related questions, contact us at support@quietplease.app.

We collect the minimum personal data necessary to operate the Service and provide you with a functional experience. Without this data, we would not be able to create your account, track your predictions, or display leaderboards.

We collect the following categories of personal data:

Account data (when you sign up)

• Email address
• Password (stored as a secure hash — we never see or store your plain-text password)
• Username (chosen by you)
• If you sign up via Google or Facebook: your name and email as provided by the OAuth provider

Profile data (optional)

• Country and city (if you choose to add them)

If you play without an account (optional)

• An email address, only if you choose to leave one on an anonymous challenge so that we can send you the final result. See section 7.
• An email address, only if you ask us to tell you when a particular tournament draw is published. See section 7.

Activity data

• Bracket predictions you make
• Challenge picks and display names
• League memberships
• Friend connections
• Points and rankings (calculated from your predictions)

Technical data

• IP address (used temporarily for rate limiting; not persisted to our database)
• Basic page-view analytics via Vercel Analytics (aggregated, no personal identifiers)

We use your data to:

• Provide and operate the Service (authentication, predictions, leaderboards, leagues, challenges)
• Send you email notifications about tournament draws and points earned (you can opt out at any time)
• Send you the result of an anonymous challenge, if you asked us to — a single email, after which your address is deleted
• Tell you that a tournament draw you asked about has been published — a single email, after which your address is deleted
• Prevent abuse through rate limiting
• Calculate rankings and display leaderboards

We do not sell your personal data. We do not use your data for advertising.

Under the GDPR, we process your personal data on the following bases:

• Contract performance: Processing necessary to provide you with the Service (account management, predictions, rankings)
• Legitimate interest: Rate limiting and abuse prevention
• Consent: Email notifications (you may withdraw consent at any time via your account settings or the unsubscribe link in any email)

We use the following third-party services that may process your data:

• Supabase (database and authentication hosting) — processes your account data and activity data
• Vercel (website hosting and analytics) — processes page-view analytics and request metadata
• PostHog (product analytics, EU-hosted) — processes your IP address and how you use the site, so we can see which features are used and where people get stuck
• Sentry (error monitoring, EU-hosted) — processes technical details of errors, including your IP address and the page you were on, so we can fix crashes
• Resend (email delivery) — processes your email address when we send notifications
• Google (OAuth authentication) — receives and sends your email and name if you choose to sign in with Google
• Facebook / Meta (OAuth authentication) — receives and sends your email and name if you choose to sign in with Facebook

Each of these services has their own privacy policies. We only share the minimum data necessary for them to provide their services.

All of our cookies are first-party. We set no third-party advertising or cross-site tracking cookies, and we never sell or share your data with advertisers.

Essential — always set, because the site cannot work without them:

• Authentication cookies — managed by Supabase to keep you signed in
• username_is_set — records that you have chosen a username, so we route you to the right page after signup
• qp_consent — remembers the choice you made about the cookies below, so we don't ask again on every page

Optional — only set if you accept, and removed if you decline:

• qp_attr (6 months) — records how you first found us (for example, a search campaign or a link from another site) so we can tell which of our pages are worth improving
• qp_ref (30 days) — if you arrived through a friend's invite link, records who invited you so they get credit when you sign up
• qp_notice_… (90 days) — if you dismiss an announcement bar (for example, the one about an upcoming Grand Slam), remembers that so it stays dismissed. One per announcement. If you decline cookies we simply hide it for the current page instead.
• PostHog — product analytics. If you accept, PostHog stores an identifier so we can see how many separate people use the site and where they get stuck. If you decline, PostHog runs without storing anything on your device.

If you are in the EU, EEA or UK we ask before setting any of the optional cookies. You can change your mind at any time using the Cookie settings link in the footer of any page — declining removes the cookies listed above.

We also use Vercel Analytics for basic page-view metrics. It is privacy-focused and sets no cookies at all.

You can participate in anonymous challenges without creating an account. When you do, we store a display name you choose and your bracket picks. A random token is stored in your browser's local storage to identify you as the creator or opponent of a challenge.

You may optionally leave an email address so that we can tell you how the challenge finished. This is never required to play. If you leave one:

• It is used for exactly one email — the final result, sent once the tournament ends.
• It is stored on that challenge alone. It is not added to any mailing list, is not used for marketing, and is not linked to an account, because you do not have one.
• We delete it at the moment that email is sent. You can also delete it at any point before then using the link in the email, or by emailing us.

You may also leave an email address on a tournament page to be told when that tournament's draw is published. The same rules apply, and for the same reason — we asked for one thing, so we do one thing with it:

• It is used for exactly one email — that the draw is out — sent once, when it is.
• It is stored against that one tournament. It is not added to any mailing list, is not used for marketing, and is not linked to an account.
• We delete it at the moment that email is sent. You can also delete it at any point before then using the link in the email, or by emailing us.

Your IP address is used temporarily for rate limiting but is not saved to our database.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it.

Anonymous challenge data is retained indefinitely as it is not linked to a personal account. The exception is either kind of email address left without an account — on a challenge, or asking about a draw: that is deleted as soon as the one email it was given for is sent, or immediately if you ask us to before then.

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Data portability — receive your data in a structured format
• Object to processing based on legitimate interest
• Withdraw consent at any time (e.g., email notifications)

To exercise any of these rights, email us at support@quietplease.app. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us and we will delete it promptly.

Our third-party service providers (Supabase, Vercel, Resend) may process data outside the European Economic Area (EEA). Where this occurs, we rely on the provider's standard contractual clauses or other appropriate safeguards as required by the GDPR.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, contact us at:
support@quietplease.app