What this site knows about you

Signing in

The board sits behind a sign-in. Every address except this page, the terms and the sign-in screen itself sends you to sign in first.

The only way in is “Continue with Google”. Google is asked for nothing beyond the basic profile that button carries: no contacts, no calendar, no Drive, no permission to post anywhere on your behalf. Google returns a signed token, and that token is traded for a session with Supabase, which is where sign-in for this site lives.

What is kept about you is exactly what that token carried:

• a Google account identifier;
• your email address;
• your name;
• the web address of your Google profile picture.

Those four are read to draw your name and picture in the top bar, and that is the whole of it. There is no profile page, no preferences to fill in, and nothing else asked for.

The session is held in cookies. It is what keeps you signed in, the board does not work without it, and so it is not something the site offers to switch off. It is refreshed while you are using the site and dropped when you sign out.

On the server side that record is one of the two things the database holds about a person; the other is the mailing list, which is the next section. Everything else there is match data — live games, drafts, series scores, market prices, the notes the draft analyst writes — and not one of those tables has a column for a visitor.

Asking for the weekly note

At the foot of the page there is one field, and it is the only thing this site asks a reader to hand over rather than works out for itself: an address for the weekly note. Filling it in is the whole of joining the list, and it has nothing to do with signing in — an account does not put you on the list, and a place on the list is not an account.

What is kept is the address, lowercased, and the moment it arrived. Not the address your request came from, not your browser, not the page you came from: the table has no columns for any of those, which is the durable version of that promise. And nothing in this site sends mail — the route writes the row and stops there.

The address is the row’s own key, so pressing the button twice leaves one row rather than two, and an address already on the list gets exactly the same answer as a new one. That sameness is deliberate: otherwise posting somebody else’s address here and reading the reply would tell you whether they had subscribed.

Nobody reading this site can read that list. Row-level security is on and the table has no policies at all, so the key that ships inside the browser bundle matches nothing and sees nothing; the only key that can write to it or read it is the server key, which never leaves the server. The other tables a browser can reach answer any signed-in reader. This one answers none of them.

There is no unsubscribe link, and no route behind one to hang it on. Deleting the row is the whole of leaving the list, and there are two ways to reach it. Deleting your account is one, described at the foot of this page: it takes the row with it, so long as the address on the list is the one your account signs in with. An email is the other, and it is the only one for an address that never matched an account — the table holds a string somebody typed into the field above, and it has no way of knowing whose it is.

To come off the list, write to hello@holdtab.com.

Analytics, and how to refuse them

Analytics here are PostHog, on its European servers, and they exist to show which parts of the board get used.

They are off until you say yes. The notice at the foot of the screen is a real switch, not a formality: choosing “Essential only”, or simply not answering, means the PostHog script is never put on the page. Not loaded and silenced — not loaded. Nothing about your visit goes anywhere.

Your answer is remembered in your own browser, under holdtab.consent.v1. No answer counts as no.

If you choose “Allow analytics”, then from that moment PostHog records page views as you move around the site and, on its own default behaviour, interactions such as clicks — together with what any web analytics tool collects: the address of the page, where you arrived from, your browser and device, and an approximate location worked out from your IP address. The site adds no events of its own beyond the first page view.

When you are signed in and have allowed analytics, PostHog is also told who you are — your account identifier and your email — so that a returning reader counts as one person rather than five. Visitors who are not signed in get no profile there at all.

One honest gap: there is no button inside the site to take that permission back. Clearing this site’s data in your browser removes the stored answer, the notice asks again on your next visit, and from then on nothing new is sent. That does not remove what PostHog already received.

To have that removed as well, write to hello@holdtab.com.

What stays in your browser and never reaches us

The board is yours and it stays with you. Every prediction you make — the results you set, the teams you lock, the seeds you swap, the power dials you drag, the model settings you change — is written to your browser’s own storage under ti2026-predictor.v1. There is no code in this site that sends it anywhere. It is not synced, not backed up, and not visible to anyone but you.

Which has a consequence worth knowing before it surprises you: open the board in another browser, or clear this site’s data, and it is empty. Signing in does not bring it back, because signing in was never what was holding it.

Kept the same way, in the same place, and equally private:

• the layout of your multistream tiles;
• which side panel you left open on a match page;
• which item of the rail you last picked;
• the short trail of pages you walked in this tab, which ends when the tab does.

Asking the analyst

The tournament analyst is answered by a language model. When you ask something, the question, the last few exchanges of that conversation, and a snapshot of the tournament’s own numbers are sent to Anthropic’s API, which writes the reply. Your name, email and account identifier are not attached to that request.

The conversation is not written to any database on this side. Close the tab and, as far as this site is concerned, it is gone. What Anthropic does with a request it received is governed by their terms, not ours.

Other people's code running inside these pages

• Google’s sign-in script, loaded from Google, draws the sign-in button — so Google sees that a browser loaded a page carrying it.
• Your profile picture, when you are signed in, is fetched from Google’s servers.
• Match pages and the multistream embed Twitch’s own player. When a stream loads, Twitch sees that request and applies its own cookies and policies. No stream, no Twitch.
• The film behind the front page plays through YouTube’s no-cookie player.
• The memes at the foot of the front page are still pictures fetched from YouTube’s image server, i.ytimg.com — so YouTube sees that request before you have pressed anything. Pressing a tile puts YouTube’s no-cookie player in the picture’s place.
• The site is served by Vercel, the live data pipeline runs on Fly.io, and sign-in and the database are Supabase. Requests pass through their servers and appear in the ordinary logs any host keeps.

Most of what is here is not about you

Nearly everything on this site is public esports data, gathered from other people’s services on a schedule by a background worker rather than by anything you do: matches and drafts from OpenDota, live match state and hero and item art from Valve’s own services, prices from Polymarket, rosters and results and player photographs from Liquipedia, and which channel is broadcasting from Twitch.

All of it is about professional teams and professional matches. None of that is about the person reading the page — a reader turns up in this database in exactly two places, both named above: the sign-in record, and the row on the mailing list if you asked for the weekly note.

Deleting what is held

There is a button, and it is yours to press without asking anyone. On the tournament page your name and picture sit in the top right corner: click them, and the menu that opens has “Delete account” below the sign-out line.

It asks once, in plain words, and then it removes the record described at the top of this page — the Google account identifier, the email address, the name, the picture address — from the sign-in service outright. Nothing is kept aside, nothing is marked for deletion later: when the button comes back, the record is gone. You are signed out in the same breath and returned to the sign-in screen, because there is no longer an account to be signed into. Signing in again with the same Google account makes a new record, not the old one.

What the button does not do is touch your board — and it could not. Your predictions are in this browser’s own storage under ti2026-predictor.v1 and have never been on the server, so there is nothing there to delete. Clearing this site’s data in your browser is what removes them, and that is yours to do whenever you like, signed in or not.

The mailing list is the other half, and it is the half that goes first: the row is deleted before the sign-in record, so a press that fails part way is simply one to press again — the account that authorises the second press is still there. The row it looks for is the one keyed by the address your account signs in with, lowercased to match the way the footer stored it.

Which carries a limit worth stating rather than leaving you to assume past it: the list knows addresses and has never known accounts. Subscribe with one address, sign in with another, and the button does not find that row and does not touch it. Then the row stays, and leaving the list is the separate ask described above.

Two things also sit outside its reach, and they are worth naming rather than glossing: whatever PostHog already received if you allowed analytics, and the ordinary request logs kept for a while by the hosts listed above.

For those, or for any question the button does not answer, write to hello@holdtab.com.

Getting in touch

Questions about this page, or a request about what the site holds about you: hello@holdtab.com.