Privacy policy
Last updated: 8 October 2026
This document sets out exactly what Pronocast keeps. It was written from the database schema itself rather than from a template: every item below matches a column that exists, and nothing else is stored.
What we collect
| Data | When | Why |
|---|---|---|
| Email address | On sign-up | To identify your account and allow password resets |
| Password | On sign-up | Stored only as a hash, by Supabase Auth. Nobody, ourselves included, can read it |
| Your Google account information | Only if you sign in with Google | Google sends us your email address, name, profile picture and a Google account identifier, kept with your account by Supabase Auth. Only the email address is used to identify your account. No password is created with us in that case |
| Acceptance of the terms | On sign-up | Date of your acceptance and version of the terms accepted, kept as evidence |
| Browser push subscription | Only if you turn notifications on | The technical address your browser provides and its encryption keys, without which no notification can reach you |
| Notification preferences | Only if you turn notifications on | The confidence threshold, frequency and lead time you chose |
| Matches already notified | Each time a notification is sent | To avoid alerting you twice about the same match |
Google Analytics, with your consent
If you click “Accept all” in the cookie banner, and only then, we also use Google Analytics to measure traffic: pages viewed, the site you came from, visit duration, country and approximate city, device type and browser. Google Analytics then places cookies on your device (_ga) that recognise your browser from one visit to the next, for 13 months at most. Until you accept, the tag is not loaded and no data is sent to Google.
Google Analytics does not record your IP address, and we use none of its advertising features. The data is kept for 14 months at most. This processing rests on your consent, which you can withdraw at any time with the link (also at the bottom of every page): the Google Analytics cookies are then deleted.
Product usage measurement
Inside the app, we use PostHog to understand which pages and features are used (pages viewed, buttons clicked, filters chosen). PostHog is hosted in the European Union (Frankfurt). The tool sets no cookie and writes nothing to your device: a visitor who is not logged in is a new identifier on every visit. For a logged-in member, events are tied to the technical identifier of the account, never to the email address, so that usage can be followed from one visit to the next. What you type into fields is not recorded.
Recording your browsing, with your consent
If you click “Accept all” in the cookie banner, and only then, PostHog also records your browsing on the site: pages shown, mouse movements, clicks and scrolling. These recordings show us where the site is hard to use. What you type into fields is always masked, and the sign-in, sign-up, password and profile pages, which show or ask for your email address, are never recorded. No cookie is set for this. Recordings are kept for one month at most, then deleted. This processing rests on your consent, which you can withdraw at any time with the link: recording stops immediately.
We also use PostHog to receive the site's technical errors so we can fix them: the error message, where in the code it happened, the page concerned and the browser type. For an error on our servers, none of your session data is sent, neither cookies nor address parameters.
When you reach the site from an advert, the page address carries the campaign name (utm parameters). If you create an account during that visit, the campaign name is stored with the account, so that we know which adverts bring sign-ups. It does not identify you and is not shared with any advertising network.
This processing rests on our legitimate interest in improving the service. You can object to it by writing to the address given below; your events are then deleted.
Community vote
On match pages you can vote, without an account, for the player you think will win. To accept only one vote per person and per match, your IP address is turned into a fingerprint computed with a secret key specific to each match: the address itself is never stored, and the fingerprint cannot be used to follow you from one match to another. Fingerprints are deleted three days after the vote; only the anonymous totals remain. Legal basis: legitimate interest in keeping the vote reliable.
What we do not do
- No advertising trackers and no cross-site tracking. The only non-essential cookies, those of Google Analytics, are placed only with your consent.
- No selling, sharing or renting of your data.
- No commercial profiling, no unsolicited newsletter.
- No collection of your bets: Pronocast does not know whether you bet, or how much.
Cookies
Pronocast sets one strictly necessary cookie, your session cookie, without which you would be signed out on every page. It is exempt from consent. PostHog, described above, sets none and writes nothing to your device.
The only other cookies are those of Google Analytics, placed only if you click “Accept all” in the banner. Refusing has no effect on your access to the site. You can change your mind at any time: .
The site also keeps, in your browser's local storage, four preferences: your answer to the cookie banner (for 6 months, so you are not asked on every page), light or dark theme, having dismissed the English version prompt, and your community votes, so they can be shown again if you come back. They stay on your device, are not sent to us, and are erased with the site's data in your browser. On the Pronocast team's own devices only, a marker excludes our own visits from all audience measurement.
Where your data lives
Your account, your preferences and your push subscription are stored with Supabase, in the eu-central-1 region (Frankfurt, Germany). That data therefore stays within the European Union.
The application itself is served by Vercel Inc., a company established in the United States. Your requests, and with them the session cookie that identifies you, pass through its infrastructure, as does the audience measurement described above. This transfer outside the European Union is covered by the European Commission's standard contractual clauses (decision 2021/914), which Vercel incorporates into its data processing agreement.
The emails we send you (address confirmation, password reset) are delivered by Resend Inc., a company established in the United States, from its servers located in the European Union. Resend only receives your email address and the content of those messages, and keeps them only for as long as delivery takes. This transfer is covered by the same standard contractual clauses, incorporated into its data processing agreement.
If you choose to sign in with Google, authentication is handled by Google Ireland Limited, which then knows you are signing in to Pronocast. The data may be processed in the United States by Google LLC, under the same certification as below. Email and password sign-in remains available, with no exchange with Google.
If you accept audience measurement cookies, Google Analytics is provided by Google Ireland Limited, and the data may be processed in the United States by Google LLC. This transfer relies on Google's certification under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023).
How long
Your data is kept for as long as your account exists. Deleting it is immediate and total: it cascades to your push subscription, your preferences and your notification history, with no deferred retention period.
Your rights
You have rights of access, rectification, erasure, portability, objection and restriction of processing.
Two of them are exercised directly in the application, with nothing to write and nothing to wait for: the Profile page lets you change your email address and permanently delete your account. For the others, write to contactpronocast@gmail.com.
If an answer does not satisfy you, you can refer the matter to the CNIL, the French data protection authority, at 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or through cnil.fr.
Legal basis
Managing your account rests on performance of the contract between us. Push notifications rest on your consent, which you can withdraw at any time from the Profile page, with no effect on the rest of the service. Google Analytics and the recording of your browsing also rest on your consent, which you can withdraw at any time from the “Manage cookies” link.
Data controller
Thibault Sardou, contactpronocast@gmail.com. See also the legal notice.
Governing version
This page is a translation provided for convenience. In the event of any discrepancy, the French version prevails.