Privacy Policy
Last updated 11 October 2026.
Brier is a private prediction market for small groups of friends. This policy explains what personal data we collect, why, the legal basis for it, how long we keep it, who processes it on our behalf, and the rights you have over it.
Who is responsible for your data
Brier is operated by an individual based in the United Kingdom, acting as the data controller. For any privacy question, or to exercise any of the rights below, contact contact@brier.live. UK data protection law (the UK GDPR and the Data Protection Act 2018) applies.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (or magic-link sign-in), via Supabase Auth | To create and secure your account and sign you in | Performance of our terms with you (contract) |
| If you choose Sign in with Google: your Google name, email address and profile picture link, which Google shares with us through Supabase Auth | To create your account from your verified email address. We keep the name and picture link in your sign-in record but do not display or use them elsewhere in Brier | Contract |
| Username you choose, and an optional avatar image | To identify you to other members of your groups | Contract |
| Groups you create or join, and your role in each | To run the group prediction features | Contract |
| Markets you create (title, description, closing date) and predictions you submit (a probability, and the Brier score computed once the market resolves) | The core purpose of the product | Contract |
| Your IP address, in transient server logs and in an in-memory rate-limit counter | To keep the service available and resist abuse and brute-force attempts | Our legitimate interest in security |
| Your email address if you join the pre-launch waitlist | To email you an invitation when Brier opens | Our legitimate interest in launching to interested people; you can opt out at any time |
What we don't collect
No analytics or tracking scripts run on Brier. We don't use Google Analytics, Meta Pixel, or similar tools. We don't build advertising profiles, and we never sell or share your data with third parties for advertising or any other purpose.
Who processes your data for us
We use a small number of service providers (processors) who handle data on our instructions and under contract:
- Supabase - database, authentication, file storage, and the emails Supabase Auth sends (sign-in confirmation, password reset).
- Google - only if you choose Sign in with Google. Google handles your sign-in on its own page under its own privacy policy, and tells us your name, email address and profile picture link. We send Google nothing about what you do in Brier.
- Vercel - application hosting. Vercel processes request metadata, including IP addresses, in transient logs.
- Resend - sends the waitlist confirmation email and, in future, transactional email. Resend receives the recipient address and message content.
- Sentry - error monitoring. When the app hits an unexpected error, Sentry receives the error message, a stack trace, and technical context such as the browser, operating system, and the page path, so we can diagnose and fix it. It is configured for error reporting only: your IP address, your account identifier, and request and response bodies are all withheld, and there is no performance tracing or session recording. Events are processed in the EU.
Some of these providers may process data outside the UK. Where they do, the transfer is covered by an adequacy decision or by standard contractual clauses (the UK International Data Transfer Agreement or equivalent).
Who else can see your data
- Your predictions are private to you until the market you predicted on closes.
- Once a market closes, other members of that group can see everyone's prediction and Brier score for it.
- Your username and avatar are visible to other members of any group you share with them.
- People outside your groups can never see your data.
Access is enforced by row-level security policies in the database itself, checked on every query rather than only in application code.
How long we keep it
- Account data (profile, group memberships, markets, predictions): until you delete your account, after which it is removed immediately as described below.
- Waitlist email addresses: until you ask to be removed, or until launch is complete and invitations have been sent, whichever is sooner.
- Server logs containing IP addresses: retained for a short period by our hosting provider for security and debugging, then rotated out. We do not keep our own copy.
- Backups: the database is backed up by Supabase on a rolling schedule. Deleted data persists in backups until they age out, normally within a few weeks.
Deleting your account
You can permanently delete your account from Account Settings at any time. This removes your profile, your avatar image, every group membership, and every prediction you have made. Groups you created remain for other members, but your association with them is removed. Deletion is immediate and cannot be undone, subject only to backups ageing out as described above.
To be removed from the pre-launch waitlist, email contact@brier.live or use the unsubscribe link in the confirmation email.
Your rights
Under UK data protection law you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, and to receive your data in a portable format. To exercise any of these, email contact@brier.live. We will respond within one month.
If you are not satisfied with how we have handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).
Data breaches
If a breach occurs that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will tell affected users without undue delay where the risk is high.
Age
Brier is for adults. You must be at least 18 to use it, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we will delete it.
Invite codes
Invite codes are randomly generated (12 hex characters, roughly 281 trillion possibilities) and don't currently expire. Anyone with a valid code can join the group it belongs to - don't post invite codes anywhere public. A group admin can regenerate a code at any time, which invalidates the old one.
Changes to this policy
If this policy changes materially, we will update the date at the top and, where the change affects how we use data you have already given us, email registered users before it takes effect.
Contact
Questions about this policy or your data - reach out to contact@brier.live.