← Back to sign in

Privacy Policy

Last updated: June 19, 2026

This Privacy Policy explains what information WC2026 (“we”, “us”, “the app”) collects when you use the app, how we use it, and the choices and rights you have. WC2026 is a personal, non-commercial project that lets you follow World Cup 2026 fixtures, standings and teams, and — when signed in — save match predictions. By using the app you agree to this policy.

1. Information we collect

We keep data collection to the minimum needed to run the app:

  • Google account profile. When you sign in with Google we receive and store your name, email address, profile picture (avatar) and your Google account identifier. For sign-in we request only the openid, email and profile scopes.
  • Google Calendar (optional). Only if you choose to Track a match do we request the https://www.googleapis.com/auth/calendar.events permission. We use it once to add that single match to your Google Calendar with a kick-off reminder, and we store only the resulting calendar event ID and the match's kick-off time so we don't create duplicates. We never read your existing calendar events and we do not keep an offline (refresh) token — you are never asked for this permission unless you actively track a match.
  • App activity. Content you create in the app — such as your match predictions — is stored and linked to your account.
  • Session data. When you sign in we create a session and store it in a secure, HttpOnly cookie so you stay logged in between visits.
  • Basic technical data. Like most websites, our servers may process standard request information (such as IP address and browser type) for security and to keep the service running.

We never receive or store your Google password — authentication is handled entirely by Google.

2. How we use your information

  • To authenticate you and keep you signed in.
  • To display your profile (name and avatar) within the app.
  • To save and show your match predictions.
  • To operate, maintain and secure the service.

We do not use your information for advertising, and we do not sell or rent your personal data to anyone.

3. Cookies

We use cookies that are strictly necessary for the app to function — we do not use advertising or third-party tracking cookies:

  • wc2026_session — keeps you signed in (HttpOnly, expires after about 7 days).
  • wc2026_oauth_state — a short-lived security cookie that protects the Google sign-in flow against forgery; it is removed as soon as sign-in completes.

Because these cookies are essential to signing in, disabling them will prevent you from logging in.

4. Third-party services

We rely on a small number of providers to deliver the app. Your data is shared with them only to the extent needed for these services to work:

  • Google Sign-In (Google LLC) — handles authentication and provides your basic profile. Your use of Google Sign-In is also subject to Google’s own Privacy Policy.
  • Google Calendar API (Google LLC) — when you track a match, we send that match’s details to Google to create the calendar event on your account. We do not access any other calendar data.
  • Amazon Web Services (DynamoDB) — stores your profile, sessions and predictions on our behalf.

WC2026’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer or sell Google user data, and we use it only to provide the calendar feature you request.

5. Data retention

We keep your profile and predictions for as long as your account is active. Sessions expire automatically (about 7 days) and signing out removes the active session immediately. If you ask us to delete your account, we will remove your profile and associated data, except where we are required to retain it by law.

6. How we protect your data

Data is transmitted over encrypted connections (HTTPS), session cookies are HttpOnly and marked Secure in production, and the sign-in flow is protected against cross-site request forgery. No method of transmission or storage is 100% secure, but we take reasonable steps to safeguard your information.

7. Your rights and choices

  • Access & correction — you can view your profile in the app; you can update your name and avatar by changing them in your Google account.
  • Sign out — signing out ends and deletes your current session at any time.
  • Deletion — you can request deletion of your account and data by contacting us (see below).
  • Revoke access — you can revoke WC2026’s access to your Google account at any time from your Google account permissions.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. We will honour applicable requests.

8. Children’s privacy

WC2026 is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Significant changes may be highlighted within the app.

10. Contact us

If you have any questions about this Privacy Policy or your data, contact us at hoanghai18497@gmail.com.