Privacy Policy

Effective Date: On publication  |  Last Updated: 21 October 2026  |  Version: 2.0

1. About this notice

PredictX Technologies Private Limited ("PredictX", "we", "us") runs PredictX — a prediction game for live sport and other events, played with virtual tokens that have no cash value. This notice explains what personal data we process when you use the PredictX app (iOS and Android), the website thepredictx.com, and PredictX polls embedded on partner websites, why we process it, who we share it with, how long we keep it, and the rights you have.

We are the Data Fiduciary for this data under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025. Section 15 has a short note for visitors from the EEA, the UK and Switzerland.

PredictX is for adults only. You must be 18 or older to create an account (see §12).

2. Contact us

3. Consent — what we ask for, and what we do without asking

Using PredictX is not treated as consent to everything in this notice. We ask for your consent separately for each optional purpose below. On the website and in the current version of the app, every optional purpose is off until you switch it on — for everyone, in India and everywhere else. Older versions of the app work differently until you update; see below.

The first time you open the app or visit the website, we ask. You can change any choice at any time — on the website at Settings → Privacy, in the app at Settings → Privacy — and withdrawing is as easy as giving: one switch per purpose. Withdrawing stops that processing from then on; it does not make processing before the withdrawal unlawful. If you are not signed in, your choices are stored on your device. On the website and in the current app version, nothing optional runs until you choose.

Once you have answered — the banner on the website, or the prompt in the current app version — we honour all four choices, on our servers as well as on your device.

Older app versions. App versions released before the consent prompt do not ask. If you use one and have not answered yet, then until you update the app and make your choices: your interest profile keeps being built and used for recommendations, you keep receiving promotional push notifications (new markets, markets closing soon, daily reward reminders), and usage analytics from that app version may be recorded. Updating and answering the prompt applies your choices from then on.

When you are signed in, we keep a consent record for each choice you make: the purpose, whether you granted or withdrew it, the version of this notice you were shown, the time, the client (web, iOS or Android), your IP address and your browser or app user agent. We keep it so we can prove what you agreed to (see §8).

What we do without asking for consent. Some processing is needed to give you the service you asked for, or is a legitimate use under section 7 of the DPDP Act. We do not ask for consent for:

• your account and sign-in;
• your token balance and its ledger, your predictions, payouts and leaderboards;
• groups, chat, challenges and tournaments you take part in;
• preventing fraud and multiple accounts (using a device record and your IP address);
• security logs;
• crash diagnostics (Firebase Crashlytics, with no user identifier attached);
• website error monitoring (Sentry, without your name or email);
• transactional push notifications, such as a market you entered being resolved.

4. Personal data we process

5. Ads, analytics and cookies

Website. We use these cookies and similar storage:

• Essential — your sign-in session (px_session, an encrypted httpOnly cookie), a marker that tells the page you are signed in, and your consent choices and theme. These are needed for the site to work and do not need consent.
• Analytics (with Analytics consent) — Google Analytics 4 cookies (such as _ga) and Microsoft Clarity cookies _clck (up to 1 year) and _clsk (1 day). Clarity is operated by Microsoft; see the Microsoft Privacy Statement.
• Advertising — Google AdSense, where we show ads, and only to visitors who are not signed in. With Advertising consent, ads may be personalised. Without it, ads are non-personalised; Google may still use limited data, such as for frequency capping, fraud prevention and aggregated reporting.

No analytics or session-replay script runs before you opt in. No advertising script runs before you answer the consent banner; if you decline Advertising, any ads are non-personalised. When you are signed in, you can change every choice under Settings → Privacy. Signed in or not, you can reopen the cookie banner for the browser you are using:

App. Firebase Analytics runs only with Analytics consent. Google AdMob shows personalised ads only with Advertising consent and non-personalised ads otherwise. Firebase Crashlytics (crash diagnostics, no user identifier) and Firebase Cloud Messaging (push notifications) run as part of the service.

6. Who we share personal data with

We do not sell your personal data. We share it only with the service providers below, for the purposes stated, and with authorities where the law requires it. The full list is kept in our sub-processor register; your data download (§10) lists each recipient by name, purpose and location.

For personalised advertising, Google acts as an independent controller of the data it collects; its use is described in Google's privacy policy.

Inside groups. Other members of a group you join see your username, avatar, your predictions and position within that group, and your chat messages. Your activity outside the group is not shown to them.

Legal disclosures. We disclose personal data where the law requires it — for example to comply with a valid order of a court or a lawful request of a government agency.

7. Transfers outside India

Our servers are in AWS's Mumbai region (ap-south-1). Some recipients in §6 process data outside India — Google, Apple, Microsoft and Sentry (mainly in the United States), Anthropic (United States, and no user personal data), and AWS's worldwide content-delivery network, whose edge functions are deployed from the US (us-east-1). Section 16 of the DPDP Act permits transfers outside India except to countries the Government of India restricts by notification; none of these transfers is to such a country.

8. How long we keep it

Inactive accounts. If the DPDP Rules' inactivity provision applies to PredictX, an account not used for three years will be erased, and we will tell you at least 48 hours beforehand; signing in cancels it.

9. Deleting your account

You can delete your account yourself at any time — in the app (Settings → Danger Zone → Delete Account) or on the website (Settings → Delete my account). If you cannot access either, email support@thepredictx.com from the email address on your account. Full steps: Delete your account.

Erased immediately:

• your Google or Apple sign-in link, email address and phone number;
• your name, username and profile picture;
• your devices, device identifiers and the IP addresses recorded with them;
• all sessions, push notification tokens and notifications;
• the text of every chat message you wrote (shown as “Message deleted”);
• your group memberships — if you were a group's only admin, admin passes to its longest-standing member; a group with no one else in it is closed;
• your username in group activity messages (shown as “A former member”);
• any challenge still waiting for an answer is cancelled, and the tokens held for it are returned;
• your personalisation profile and your watchlist;
• your consent and age acknowledgement records, and your nominee's details.

Kept, without anything that identifies you: your token balance history, transactions and prediction entries stay in our records under an internal account number that no longer links to your name, email or sign-in. They are kept so that prediction pools, payouts to other people and leaderboards remain correct. Analytics records in our database stay, unlinked from you, and so does the marketing campaign that brought you, with nothing that identifies you. We also keep a one-way keyed fingerprint of your email, device and IP address, with no link to your account, to stop repeat sign-up bonuses. Messages other people wrote, and notifications they received, are not changed even if they mention you.

Backups and analytics providers: copies in our database backups expire as those backups roll over, currently within 30 days. Usage events already sent to Google Analytics or Firebase are kept by Google under its retention settings; Firebase events carry an internal account number, website events carry none, and neither carries your name or email. Microsoft Clarity recordings are not linked to your account. Deletion is irreversible — your account cannot be recovered.

10. Your rights

Under the DPDP Act you can:

• Get a copy of your data (section 11) — download a copy of the personal data we hold about you, together with the list of service providers we share data with — each one's name, purpose and location.
• Correct and update it (section 12) — edit your name and avatar in your profile; change your username through its own flow. Your email comes from Google or Apple; if it is wrong, email privacy@thepredictx.com.
• Erase it (section 12) — delete your account (§9).
• Withdraw consent (section 6(4)) — any purpose, any time (§3).
• Nominate someone (section 14) — name a person who can exercise these rights for you if you die or become unable to.
• Raise a grievance (section 13) — see §11.

All of these are self-service on the website at Settings → Privacy and in the app at Settings → Privacy. You can also email privacy@thepredictx.com; we reply within 30 days. Because PredictX has no passwords, we act on emailed requests only when they come from the email address on the account, or after confirming the request with you while you are signed in.

11. Grievances and the Data Protection Board

Raise a grievance in the app or on the website under Settings → Privacy → Raise a grievance — you get a reference number straight away, which is your acknowledgement — or email grievance@thepredictx.com, and we acknowledge it within 24 hours. We resolve complaints about content or another user within 15 days and all other grievances within 30 days. Details: Grievance Redressal.

If you are not satisfied with our response, you can complain to the Data Protection Board of India, constituted under the DPDP Act and the DPDP Rules, 2025. The Act asks you to raise the grievance with us first.

12. Adults only (18+)

PredictX is for people aged 18 or older. When you sign in for the first time, you declare that you are 18 or older; we keep a record of that declaration (§4). We do not collect your date of birth and there is no route for a parent or guardian to consent on a child's behalf. If we learn that an account belongs to someone under 18, we close it and erase it as described in §9. If you believe a child is using PredictX, tell us at privacy@thepredictx.com.

13. Security

We protect personal data with safeguards including: encryption in transit (TLS 1.2 or higher, with HSTS); database encryption at rest with a customer-managed AWS KMS key; encrypted-at-rest Redis; application secrets held in AWS Secrets Manager; and restricted, session-controlled administrator access. These describe the hosting account that runs PredictX. A copy in our previous hosting account, made before the move, is being deleted; it is not used to run the service. Details: Security & Data Protection.

14. Personal data breaches

If a personal data breach affects you, we will inform the Data Protection Board of India and tell you directly — in the app and by email — as the DPDP Rules require: what happened and when, which of your data was involved, the likely consequences, what we are doing about it, what you can do to protect yourself, and who to contact.

15. Visitors from the EEA, the UK and Switzerland

If the GDPR or UK GDPR applies to you, the consent choices in §3 work the same way. We rely on: performance of our contract with you for the service itself; your consent for the four optional purposes; our legitimate interests in preventing fraud and keeping the service secure; and legal obligation where the law requires us to keep or disclose data. You also have the rights to restrict or object to processing and to data portability, and you can complain to your local data protection authority.

16. Changes to this notice

When we change this notice materially, we will tell you in the app and by email before the change takes effect, and ask for your consent again where the change affects a purpose you consented to. The version and date at the top of this notice always show the current text.

17. Language

This notice is in English. You can ask for it in Hindi or any other language listed in the Eighth Schedule to the Constitution of India by emailing privacy@thepredictx.com. A Hindi version is being prepared.