PRIVACY
POLICY

[ 01 ]ABOUT THIS POLICY

This Privacy Policy explains how Cyril Paul Guirguis, operating as What's Your Pick? ("we," "us," "our") collects, uses, shares, and protects information when you use the What's Your Pick? mobile application ("WYP," the "App").

By creating an account or using WYP, you agree to the practices described in this policy. If you do not agree, please do not use the App.

We've written this in plain language. If anything is unclear, contact us at whatsyourpickapp@gmail.com.

[ 02 ]WHO WE ARE

WYP is a free social prediction game for the 2026 international soccer tournament. The App lets users make predictions about matches, compete in private groups with friends, and view leaderboards. There is no real-money gambling, no betting, no in-app purchases, and no advertising.

[ 03 ]INFORMATION WE COLLECT

We collect only the information necessary to operate WYP. We do not sell, rent, or trade your personal information to third parties.

3.1 INFORMATION YOU PROVIDE

• Account information: When you sign in with Apple, Google, or email, we collect your email address. If signing in with Apple or Google, we may also receive your name (you can edit this in the App).
• Profile information: Your display name and optional profile photo.
• User-generated content: Predictions you make on matches, groups you create or join, and any text you enter (group names, etc.).

3.2 INFORMATION WE RECEIVE AUTOMATICALLY

• Account identifier: A unique user ID assigned by our backend (Supabase) when you sign in.
• Authentication tokens: Cryptographic tokens issued by Apple, Google, or our backend used to keep you signed in securely. These are stored on your device and never shared with third parties.
• Technical logs: Standard server logs (IP address, timestamp, request type) generated by our backend infrastructure for security, debugging, and abuse prevention. These logs are retained for up to 30 days unless required longer for legal or security reasons.

3.3 INFORMATION WE DO NOT COLLECT

To be explicit, WYP does not collect:

• Your precise location
• Your contacts
• Your photos or media (except a profile photo you voluntarily upload)
• Your microphone or camera data
• Your browsing or app usage outside of WYP
• Advertising identifiers (IDFA, AAID)
• Health, financial, or payment data
• Biometric data

We do not use any third-party analytics, advertising SDKs, or tracking tools. We do not engage in cross-app or cross-website tracking.

[ 04 ]HOW WE USE YOUR INFORMATION

We use the information we collect only for these purposes:

Our legal basis for processing (under GDPR) is performance of a contract with you (we cannot provide the App without processing your account data) and our legitimate interests in operating a secure service.

[ 05 ]WHO WE SHARE INFORMATION WITH

We share information only with the limited third parties listed below, each of whom acts as a data processor on our behalf and is contractually required to protect your data.

5.1 SERVICE PROVIDERS

• Supabase (Supabase Inc., based in the United States): hosts our backend, database, and authentication. Your account information and predictions are stored in Supabase's secure infrastructure. Supabase Privacy Policy
• Apple (Apple Inc.): if you sign in with Apple, Apple verifies your identity and returns an authentication token to us. Apple may give us an email (which can be a relay address that hides your real email). Apple Privacy Policy
• Google (Google LLC): if you sign in with Google, Google verifies your identity and returns an authentication token to us. Google Privacy Policy
• API-Football (API-Sports SAS): provides match schedules and results. We send no personal information to API-Football — only generic queries for fixtures. API-Sports Privacy Policy
• Apple Push Notification Service and Firebase Cloud Messaging (Google): deliver push notifications to your device. Notification content does not include sensitive personal data.

5.2 OTHER USERS

Your display name, profile photo (if you've added one), and predictions are visible to other members of any group you join. Your email address is never visible to other users.

5.3 LEGAL DISCLOSURES

We may disclose information if required by law, court order, or to protect our rights, your safety, or the safety of others. We will challenge overbroad requests where appropriate.

5.4 BUSINESS TRANSFERS

If we are acquired, merged, or sell substantially all our assets, your information may be transferred to the successor entity. We will notify you (by email and in-app notice) before your data is transferred and becomes subject to a different privacy policy.

[ 06 ]WHERE YOUR DATA IS STORED

Your data is stored on servers operated by Supabase, located in the United States (AWS region us-east-1). If you access WYP from outside the United States (for example, from Canada, Europe, or elsewhere), your data is transferred to and processed in the United States under appropriate safeguards, including Standard Contractual Clauses where required by GDPR.

[ 07 ]HOW LONG WE KEEP YOUR DATA

• Active accounts: We retain your account data for as long as your account exists.
• Deleted accounts: When you delete your account (see Section 9), we permanently delete your profile, predictions, and group memberships from our active database within 30 days. Backup snapshots may retain residual data for up to 90 days before they are rotated out.
• Server logs: 30 days, except where retained longer for legal or security reasons.
• Legal holds: We may retain information longer if required by law or to defend legal claims.

[ 08 ]YOUR RIGHTS AND CHOICES

Depending on where you live, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Correct inaccurate or incomplete data (most fields can be edited directly in the App).
• Deletion: Delete your account and all associated data (see Section 9).
• Portability: Receive your data in a machine-readable format.
• Restriction or objection: Restrict or object to certain processing.
• Withdraw consent: Where we rely on consent, withdraw it at any time.
• Complain to a regulator: Lodge a complaint with your local data protection authority (in the EU, your national DPA; in the UK, the ICO; in Canada, the Office of the Privacy Commissioner of Canada).

To exercise any of these rights, email us at whatsyourpickapp@gmail.com. We will respond within 30 days.

CALIFORNIA RESIDENTS (CCPA / CPRA)

If you are a California resident, you have specific rights including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information for cross-context behavioral advertising. To exercise your rights, contact us at cpguirguis@gmail.com.

[ 09 ]ACCOUNT DELETION

You can permanently delete your account at any time:

• Open the App
• Go to Profile → Settings → Delete account
• Confirm

This action immediately removes your profile, predictions, and group memberships from our active database. The deletion is permanent and cannot be undone.

You can also request deletion by emailing whatsyourpickapp@gmail.com — we will action it within 30 days.

[ 10 ]CHILDREN'S PRIVACY

WYP is rated 12+ and is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at cpguirguis@gmail.com and we will delete it promptly.

If you are between 13 and the age of majority in your country, please use the App only with the involvement of a parent or guardian.

[ 11 ]DATA SECURITY

We use industry-standard security measures to protect your data:

• All connections between the App and our backend are encrypted using HTTPS / TLS 1.2 or higher
• Passwords (where applicable) are never stored in plaintext; we use Supabase's bcrypt-based hashing
• Database access is restricted by row-level security policies that ensure users can only read their own data and data they're explicitly permitted to see
• Authentication tokens are stored securely on your device's keychain (iOS) or keystore (Android)
• We regularly review our security practices and dependencies

No system is completely secure, however. If we become aware of a data breach affecting your personal information, we will notify you and applicable regulators as required by law.

[ 12 ]INTERNATIONAL USERS

WYP is operated from Canada. If you access the App from outside Canada, you understand that your data may be processed in a country with different data protection laws than your own. We take steps (including Standard Contractual Clauses where required) to ensure your data receives an adequate level of protection wherever it is processed.

[ 13 ]CHANGES TO THIS POLICY

We may update this policy from time to time. When we do:

• We will update the "Last Updated" date at the top
• For material changes, we will notify you in the App and/or by email at least 14 days before the changes take effect
• Continued use of the App after the effective date constitutes acceptance of the updated policy

The current version of this policy is always available at whatsyourpick.app/privacypolicy and within the App under Settings → Privacy & Terms.

[ 14 ]CONTACT US

If you have any questions, requests, or concerns about this policy or how we handle your data, please contact us:

THIS POLICY APPLIES TO THE WHAT'S YOUR PICK? MOBILE APPLICATION ONLY · NOT TO THIRD-PARTY LINKED SERVICES