Privacy policy

1. Who is responsible

Garg Capital Group LLC ("we", "us") publishes Predictly and is responsible for (the "controller" of) the personal data described here. For anything in this policy, write to contact@predictly.caffaai.com.

This policy covers the Predictly web app and the Predictly apps for iOS and Android.

2. What we collect

Account: your email address, username, display name, timezone, the interests you pick, and optionally an avatar. The date you confirmed you are 18 or older, and the version and date of the documents you accepted. We do not collect your date of birth, phone number, postal address, contacts, photos, or location.

Sign-in: if you set a password, a one-way scrypt hash of it — never the password itself. If you signed in with Google, the account identifier and email address Google gave us. Sign-in links, password-reset links and session tokens are stored only as hashes.

Sessions and devices: for each signed-in session, a hashed session token, the device type (web, iOS or Android), and when it was created and last used. If you allow notifications, the push token for that installation, which we treat as a secret and never show to anyone.

Network data: to stop abuse, the service counts requests against a masked form of your IP address in short-lived counters that expire within minutes. We do not store IP addresses in the database.

Email delivery: which messages we sent you, when, and whether they were delivered — not their contents.

Connected assistants: if you connect an AI assistant, its name and web address as it registered them, the permissions you approved and when, and when it last connected. Its access tokens are never stored; its refresh tokens are stored only as hashes.

3. What you create here

Forecasts and every revision of them, with times. Trades, positions, settlements and the double-entry point ledger behind them. Scores, rankings, badges and season records.

Questions, clarifications, evidence links, comments, disputes, votes, reports you file and members you block.

Journal notes — your rationale, evidence, and what would change your mind. These are private to you unless you choose to share a note with your circle. No moderator or administrator can read a private journal note.

AI coach reports, if you turn the coach on (section 5).

4. How we use it, and on what legal basis

To run the service you signed up for — accounts, sign-in, questions, forecasts, markets, scoring, circles, notifications you asked for, and support (performance of our contract with you).

To keep the service safe — preventing abuse and fraud, rate limiting, moderating content, acting on reports and blocks, and keeping an audit record of moderation decisions (our legitimate interest in a safe service, and your contract).

To send push notifications and to run the AI coach — only if you turn them on (your consent, which you can take back in Settings at any time).

To comply with the law and answer lawful requests (legal obligation).

We do not use your data for advertising, we do not build advertising profiles, we do not track you across other companies' apps or websites, and we do not sell or share your personal information for cross-context behavioural advertising.

5. The AI coach

The coach is off until you turn it on, and turning it off cancels anything queued.

When a report is generated it may only use your own records for one question, plus that question's public price and consensus history. It never reads another member's notes, votes or positions, and every claim it makes is checked against those records before you see it.

No third-party AI provider is connected today, so none of your text has been sent to one. Before we connect one we will name it in this policy and ask you to accept the new version.

Coach reports are deleted 24 months after they are written, and you can delete any report yourself at once.

5a. AI assistants you connect

When you connect an assistant such as Claude, ChatGPT or Cursor, it can read and act on your account only within the permissions you approved, through the same checks the apps use. Whatever it reads — questions, your forecasts, positions and balances, discussion comments — is sent to that assistant's provider, whose own privacy policy then applies to it.

Your private journal notes and coach reports are never available to a connected assistant.

Disconnect any assistant in Settings; it loses access immediately. Deleting your account disconnects them all.

6. Who else handles your data

We use these service providers, only to run Predictly, under contracts that require them to protect the data and use it only on our instructions:

Amazon Web Services — servers in the United States that run the API and the web app, and the managed database (Amazon RDS) that holds the data described here, with its backups.

Redis Cloud (Redis Ltd.) — short-lived rate-limit counters, keyed by your account id or a masked form of your IP address, that expire within minutes to hours. No content, email address or profile data is stored there.

Resend — sending transactional email: sign-in links, password resets, notices about your account. It receives your email address and the message.

Apple Push Notification service and Google Firebase Cloud Messaging — delivering push notifications, if you allow them. They receive the push token and the notification text.

Google — only if you signed in with Google: it authenticates you and tells us your account identifier and email address.

AI assistants you connect yourself (section 5a) — they receive what they ask for within the permissions you approved, and what they do with it is governed by their provider's own privacy policy. We never connect one for you.

Apart from these providers, we share personal data only when the law requires it, to protect someone's safety, or as part of a merger or sale of the service, in which case this policy continues to apply. Other members see only what the service shows them: your username, display name, avatar, public questions and comments, and the ranking and profile details your profile-visibility setting allows.

7. How long we keep it

Your account data, for as long as you have an account. Expired or revoked sessions: deleted 30 days later. Sign-in and reset links: deleted when used or within a day of expiring. Notifications: 90 days. Email delivery records: 90 days. Unused trade quotes: 7 days. Assistant refresh tokens: 30 days after they expire or are revoked. Coach reports: 24 months. Abuse signals: 12 months. Closed content reports: 2 years.

Moderation and administration audit records: 7 years, because they are what makes a moderation decision answerable.

The ledger, trades, positions, settlements, forecast revisions, scores and rankings are kept for the life of the service, detached from you if you delete your account (section 9).

Our database host keeps automated backups for at most 35 days, so deleted data leaves the backups within 35 days of leaving the database.

8. Your rights

Wherever you live, you can: see and correct your profile in Settings; download a copy of your data in Settings ("Download my data" — a JSON file with your profile, preferences, memberships, questions, comments, forecasts, trades, positions, ledger entries, journal, coach reports, notifications, badges, blocks and connected assistants); turn off notifications and the coach; disconnect assistants; and delete your account (section 9).

Depending on where you live — including the EU, UK, and California — you may also have the right to access, correct, delete, or port your data, to restrict or object to how we use it, to take back consent, and not to be discriminated against for exercising these rights. We do not sell or share personal information as the California Consumer Privacy Act defines those words, and we do not use sensitive personal information.

To use any right that Settings does not cover, write to contact@predictly.caffaai.com from the address on your account. We answer within 30 days (45 days for California requests). You may use an authorized agent, and we may need to verify your identity first. You can also complain to your local data protection authority, or in California to the California Privacy Protection Agency.

9. Deleting your account

Delete your account from Settings → Your data in either app, or on the web as described at /delete-account. If you cannot sign in, write to contact@predictly.caffaai.com from the address on your account.

Deletion runs 30 days after you ask. Until then you can cancel it, and we email you when you ask — so if someone else took over your account, you will know while you can still stop it.

When it runs: every session is signed out; your email address, password, display name, avatar and sign-in identifiers are erased and your username is replaced with an anonymous one; your journal, coach reports, preferences, devices, push tokens, notifications and blocks are deleted; the text of your comments is erased; and your circle memberships end. Circles you own pass to another member as the terms describe.

What stays, attached to the anonymous account and no longer to you: ledger entries, trades, positions, settlements, forecast revisions and scores, resolutions, votes and disputes, rankings, reports you filed, and audit records. Other members' balances, market prices and rankings are computed from these rows, so erasing them would rewrite other people's records. Questions you wrote stay, credited to "Deleted user".

10. How we protect it

TLS on every connection to the service and to the database. Passwords are stored only as scrypt hashes, and session tokens, sign-in links and invite codes only as hashes.

Access to private data is decided by one permission check used by the apps, the realtime feed and the background jobs alike. Staff access is limited to people who need it, and every moderation or administration action is audited.

No system is perfectly secure. If a breach affects your data we will tell you and the authorities as the law requires.

11. Where your data is processed

Predictly is run from the United States, and your data is stored and processed there. If you use it from elsewhere, your data is transferred to the United States; for transfers from the EU, EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) with our providers.

12. Children

Predictly is only for people 18 and older, and we do not knowingly collect data from anyone younger. If we learn an account belongs to someone under 18, we close it and delete its data. If you believe a child has an account, write to contact@predictly.caffaai.com.

13. Changes to this policy

The version and effective date are shown at the top. The version you accepted is stored with the date you accepted it. If we change this policy in substance, the apps ask you to accept the new version before you can take part again.