How Bracketo collects, uses, and protects your data.
Last updated: 14 June 2026
Draft notice. This policy is a starting template adapted for Bracketo's specific data flows. It is not legal advice. Before publishing in your final jurisdiction, have it reviewed by a qualified lawyer — especially for the contact details, governing law, and any jurisdiction-specific clauses (GDPR, CCPA, LGPD, etc.).
Who we are
Bracketo (the "Service", "we", "us") is an interactive FIFA World Cup 2026 bracket reference site available at https://bracketo.world. The Service is operated by an individual publisher and hosted on Cloudflare Pages.
For privacy-related questions, contact: [your contact email here].
What data we collect
Bracketo does not require an account and does not directly collect personally identifying information (name, address, payment details). However, when you visit the Service, the following data is collected by third-party services we integrate:
Google Analytics (GA4) — anonymous usage data including page views, session duration, language, approximate location (country / region), device type, and interaction events (group hover, phase navigation, language change, team search). Your IP address is anonymised before being processed by Google.
Google AdSense — when you consent to advertising cookies, Google may set cookies on your device to deliver personalised ads, measure ad performance, and prevent fraudulent activity. If you decline, AdSense serves only non-personalised ads (contextual ads based on the page content alone).
Cloudflare Pages — our hosting provider may log standard request metadata (IP address, user agent, timestamp) for security and performance purposes. See Cloudflare's privacy policy.
We store your language preference and last-viewed phase locally in your browser via localStorage. This data never leaves your device and is not transmitted to us or any third party.
Purpose of processing
Analytics — to understand how visitors use the Service so we can improve content and user experience.
Advertising — to display ads that fund the operation of the Service. Personalised ads (when consented) help Google match relevant ads to your interests.
Functional preferences — to remember your language and viewing preferences across sessions.
Legal basis (GDPR / EEA, UK, Switzerland)
Consent (Art. 6(1)(a) GDPR) — for analytics cookies and personalised advertising cookies.
Legitimate interest (Art. 6(1)(f) GDPR) — for non-personalised ads, basic server logs, and security measures.
You can withdraw your consent at any time by clearing your browser cookies for bracketo.world, or by visiting the Service in private/incognito mode.
Cookies and similar technologies
We use the following categories of cookies and storage:
Essential (always on): cookies and localStorage entries required for the site to function (language preference, dismissal state for the ad banner, consent record).
Analytics (consent required): cookies set by Google Analytics — typically _ga, _ga_* — to distinguish visitors and measure session behaviour.
Advertising (consent required for personalisation): cookies set by Google AdSense and its partners to serve and measure ads. See how Google uses ad cookies.
We implement Google Consent Mode v2. Before you make a choice, both Google Analytics and AdSense run in "consent denied" mode — no personalised cookies are set, and ads served are non-personalised.
Third-party services
We share data (anonymised where possible) with the following third parties, each of which acts as an independent data controller for the data they process:
Some of our service providers (Google, Cloudflare) are based in the United States. Where personal data is transferred outside the EEA, UK, or Switzerland, the transfer is protected by the EU–US Data Privacy Framework, the UK Extension, the Swiss–US Data Privacy Framework, and/or Standard Contractual Clauses approved by the European Commission.
Data retention
Google Analytics — Bracketo configures GA4 with a 14-month retention period for event-level data. Aggregate reports are retained indefinitely.
Google AdSense — retention is governed by Google's policies (typically up to 2 years for ad measurement).
localStorage — retained on your device until you clear your browser data.
Your rights
Depending on your jurisdiction, you may have the right to:
Access the personal data we (or our processors) hold about you.
Request correction of inaccurate data.
Request erasure ("right to be forgotten") subject to legal exceptions.
Object to or restrict certain types of processing.
Request data portability.
Withdraw consent at any time (without affecting processing already done).
Lodge a complaint with your national data protection authority. EU residents can find theirs at edpb.europa.eu.
California residents have additional rights under the CCPA/CPRA, including the right to opt out of the "sale" or "sharing" of personal information. Bracketo does not sell personal information in the conventional sense, but the use of advertising cookies may qualify as "sharing" under California law. To opt out, decline ad cookies via the consent banner or use the Network Advertising Initiative opt-out tool.
To exercise any of these rights, email us at [your contact email here]. We will respond within 30 days.
Children's privacy
Bracketo is a general-audience site and is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from minors. If you believe a minor has provided data through the Service, please contact us so we can delete it.
Changes to this policy
We may update this policy from time to time. Material changes will be highlighted at the top of this page with a new "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.
This is not a contract. It is a description of our data practices. By using Bracketo you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of the Service.