Privacy

• We store what is needed to run competitions and count picks.
• We do not sell your information, and nothing on Universus follows you to other sites.
• You can delete your account yourself in Settings.

Universus is run by Icarus Solution Development, a business based in the Netherlands. Under European privacy law (the GDPR) that makes Icarus Solution Development the controller of your information. Questions go to hello@universus.vote.

• Your account. Your name and email address.
• How you sign in. A scrambled (hashed) version of your password, never the password itself. If you use Google: your Google account ID, name, email address, profile picture address and the sign-in tokens Google gives us. If you use passkeys: each passkey's public key and the browser and device it was made on.
• Your sign-in sessions. For each device you are signed in on: the IP address and the browser it uses.
• Competitions you run. The title, the question, the entries, the settings and the email addresses you invite.
• Your picks. Every matchup you were shown, what you picked and when.
• Guests. If you judge before you have an account: a display name and your picks, tied to this device by a cookie.
• Reports. If you report a competition: your account, the reason and any note you add. We keep it so each account reports a competition only once.

• To run the service you asked for. Signing you in, showing you matchups, counting your picks, sending the codes and invitations.
• To keep results honest and the site safe. One real person per account, and limits that stop abuse. This is our legitimate interest in a verdict that can be trusted.
• To see how many people visit. Page counts only, with no cookies and no profile of you.

• The organiser of a competition sees your name, how many picks you have made and when you joined. In the match replay they also see who made each pick, as a partly hidden email address.
• Other judges see the standings and whatever else the competition's settings allow. Your email address is never shown to them.
• Anyone with the link to a competition's results can see its title, entries and standings when the organiser has made the results open. An open competition that anyone with the link can judge may also be picked by us for the front page, which shows its standings.
• People you invite see your name in the invitation email.
• We, the operator, can look at any competition, private and invite-only ones included, to keep the site within its terms and to choose what the front page shows.

These services work for us and receive only what their job needs.

• Vercel hosts the site, so every request passes through it, including your IP address. Its visitor counter records the page, the referring site, your country and your browser and device type, without cookies.
• Prisma Postgres is the database. Everything listed above is kept there.
• Forward Email sends our email: confirmation codes, invitations and account notices. It receives the address and the message.
• Google, only if you choose to sign in with Google. Google learns that you signed in to Universus.
• Upstash keeps a scrambled (hashed) version of your IP address for 24 hours when you set off the AI commentary as a visitor to the front page or as a guest finishing a judging run. It limits how often the commentary runs.
• Daedalus, our own service, writes the AI commentary with the help of an AI model provider. It receives a competition's title, question, number of judges and standings. When someone reports a competition, it also has an AI model check it, using the competition's title, question, description and entries and the reason and note given in the report. It never receives names of judges, email addresses or who picked what.
• Cloudflare checks that an email sign-up comes from a person, not a bot. It sees your IP address and details of your browser when you press the sign-up button.

Some of these companies process information outside the European Union. Where they do, it is under the safeguards European law requires, such as standard contractual clauses.

Universus uses only the cookies it needs to work. None of them track you, so there is no cookie banner.

• Sign-in cookies. Keep you signed in, and carry a Google or passkey sign-in through its steps.
• Sign-in prompt cookie. Remembers for a few minutes where to take you after you sign in.
• Guest cookie. Ties a guest's judging run to this device.
• Saved on your device. Your light or dark theme, whether this browser holds a passkey, and when we last offered you one.

• Your account: until you delete it. Your competitions and picks stay after that, without your name.
• Sign-in sessions: until you sign out on that device or delete your account. A session stops working seven days after you last use it.
• Confirmation codes: ten minutes.
• A sign-up that was never confirmed: removed after 48 hours.
• A guest run that was never claimed with an account: removed after 48 hours.

Open Settings, choose Delete account and type DELETE. The deletion is scheduled 14 days out, we email you the date, and you can cancel until then.

After 14 days we remove your name, email address, password, Google link, passkeys and sessions, and close the competitions you ran. Your competitions and picks stay, shown as "Deleted account", so other people's results do not change.

You can ask us for a copy of your information, to correct it, to delete it, or to stop or limit a use of it. Email hello@universus.vote and we answer within a month.

If you are unhappy with how we handle your information, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your own country.

When this page changes, the date at the top changes with it.

Contact: hello@universus.vote