Privacy Policy

The data controller is Pundit OÜ (Estonian commercial registry code [registry code]), registered at [registered address], Tallinn, Estonia. For any privacy question, or to exercise the rights below, contact privacy@pundit.gg.

• Account & identity: your email address (via our auth provider, Clerk), your chosen username, your self-declared date of birth, and your country.
• Activity in the game: your predictions, scores, points, rating, quests, any cosmetic items, and squad/leaderboard participation.
• Profile you add: optional bio, avatar, and details of your gaming gear / PC setup if you choose to enter them.
• Linked accounts (optional): if you connect FACEIT or Steam, we read the public profile data those services return (such as your handle, and public stats or owned-games list). We do not store your FACEIT or Steam passwords or long-lived access tokens.
• Technical & usage data: basic logs and product-analytics events (e.g. pages viewed, actions taken) used to keep the service working and improve it.

We do not ask for identity-document / KYC data during the beta, because the beta has no Pro tier and no real-money prizes (the KYC provider, Veriff, is not in use during the beta — see below).

Under the GDPR we rely on these legal bases:

• Consent (Art. 6(1)(a)) — for creating your account and processing your data to take part in the beta, which you give by ticking the consent box at sign-up. You can withdraw it at any time (see your rights below).
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent cheating and abuse, debug problems, and understand and improve how the product is used. We balance these against your rights.
• Legal obligation (Art. 6(1)(c)) — where we must keep or disclose data to comply with the law.

We do not sell your personal data, and we don't use it for third-party advertising.

We use a small set of trusted service providers (processors) to run Pundit. They process data only on our instructions:

• Clerk — authentication and account sign-in (stores your email/login).
• Supabase — our database, which stores your profile and game activity. Our Supabase project is hosted in the EU region (London).
• Resend — sending transactional email (e.g. the welcome email).
• PandaScore and Liquipedia — providers of esports match, team, and player data shown in the product.
• Sentry — error and performance monitoring, to find and fix bugs.
• PostHog — product analytics (configured to the EU host).
• FACEIT / Steam — only if you choose to link them, to read the public profile data described above.

Veriff (identity verification) is integrated for the future Pro tier but is not used during the beta, since the beta has no prizes requiring age verification.

We aim to keep personal data within the EU/EEA — our database is hosted in the EU region (London). Some processors listed above are established outside the EEA; where data is transferred internationally it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact privacy@pundit.gg for details.

We keep your account and game data for as long as your account is open. If you delete your account (or ask us to), we delete or anonymise your personal data within a reasonable period, except where we must keep something to comply with a legal obligation or to resolve disputes. Because this is a beta, data may also be reset as part of testing.

Under the GDPR you have the right to access your data, correct it, eraseit (“right to be forgotten”), restrict or object to certain processing, receive a copy in a portable format, and withdraw consentat any time (withdrawing doesn't affect processing already carried out). To exercise any of these, email privacy@pundit.gg.

If you believe we've mishandled your data you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) — https://www.aki.ee/en. We'd appreciate the chance to help first.

The beta is for users 16 and older. It is not directed at children under 16, and under-16s are not permitted to create an account during the beta. If we learn we've collected data from someone under 16, we'll delete it. Access for younger users with verifiable parental consent is planned for the full release.

During the beta we use essential cookies only— the ones needed to sign you in and keep the site working (for example, your authentication session). We don't use advertising or cross-site tracking cookies. If we add non-essential cookies later, we'll ask for your consent first.

We may update this policy as the product develops. When we make a material change we'll update the version label at the top of this page.