Privacy

Last updated 5 September 2026. Plain version: we keep what the site needs to work, we don't sell anything, and we don't send your email address to advertisers.

What we collect

Your account. Email address and password, handled by our authentication provider — we never see the password. Plus the username, display name, bio, picture and leagues you choose.
What you post. Picks, takes, comments, reactions, follows and watchlist. Picks and takes are public by design: a record nobody can see isn't a record.
Private messages, the Vent room, and game chat. These are visible to the people in them and to us as site administrators for moderation. They are not public.
Sign-in attempts. A username and a timestamp, kept about an hour, so somebody can't guess passwords endlessly.
Basic analytics. Pages visited, roughly where from, and what kind of device. No name attached.

Who else sees it

Supabase — database, sign-in and file storage.
Vercel — hosting and page analytics.
Resend — sends confirmation and password emails.
PostHog — how pages are used, so layout problems are visible.
Reddit — a pixel telling us which ads led to sign-ups.
X — the same thing, for ads run there.

The Vent room, private messages and password resets are excluded from PostHog and from both ad pixels. Those pages are not recorded and not reported to anyone. Vent especially: people go there to say something in private, and handing an ad network the fact that somebody opened it would defeat the point of having the room.

Reddit offers a feature that sends advertisers' visitors' email addresses back for better ad matching. It is switched off, and nothing equivalent is switched on for X. Your email is for your account and for emails you asked for.

Both pixels are blocked outright by Safari's tracking prevention and by most ad blockers, which we think is fine — they exist to tell us whether an ad worked, and nothing on this site depends on them running.

We do not sell your data, and there is no advertising on the site itself.

Cookies

A sign-in cookie so you stay logged in, a note of your light or dark preference, and cookies set by the analytics above. Blocking the analytics ones costs you nothing here.

Your choices

Edit or clear your username, picture, bio and leagues any time from your profile.
Delete your own posts before the game starts. After it starts they stay, because a record you can edit afterwards isn't one.
Ask us to delete your account and we will remove it and the personal data attached to it. Email hello@gwuap.co from the address on the account. There is no self-serve button for this yet, which is why the email is here.
Ask for a copy of what we hold on you, at the same address.

Keeping it

Account data stays until you ask us to delete it. Sign-in attempts are cleared within about an hour. Posts stay while the account does.

Age

Gwuap is for people 18 and over. Nothing here is gambling — no deposits, no stakes, no payouts — but the sport being discussed is wagered on elsewhere, so we keep the site to adults.

Changes

If this changes materially we'll say so on the site rather than quietly editing the date at the top.

Contact

hello@gwuap.co — a person reads it.

How Gwuap works · gwuap.co