Privacy
Policy

SigmaSpeed (sigmaspeed.app) is a competitive appearance-scoring platform that uses AI and crowd voting to determine who “mogs” harder in real-time battles. This Privacy Policy applies to all users of the SigmaSpeed website, application, and related services (collectively, the “Service”).

The key things to know up front:

• Video stays on your device. All AI facial analysis runs locally in your browser. Raw video is never sent to our servers.
• Duel Mode is 18+ only. Live peer-to-peer video in Duel Mode streams directly to your opponent — not to us — but match metadata is always logged.
• We don't sell your data. We do not sell, rent, or trade personal data to third parties for marketing purposes.
• You can delete your account and all associated data at any time.

We collect the following categories of information:

Account Data

• Email address — required for account creation and authentication.
• Date of birth — used to verify age requirements. Users under 13 cannot create accounts. Duel Mode requires 18+.
• Username and display name — chosen by you, visible on your public profile.
• Avatar image — optional, uploaded by you.

Usage & Match Data

• Match history — opponent IDs, scores, timestamps, and outcome for every battle.
• ELO ratings — your competitive rating history over time.
• Votes — whether you voted in a match (not who you voted for — votes are anonymous).
• Reports — if you file or receive a moderation report, this is logged.
• Waiver records — Duel Mode waiver signature timestamp and version.

Technical Data

• IP address — logged for security, rate-limiting, and fraud prevention.
• Browser and device type — collected automatically via standard server logs.
• Session tokens — used to keep you authenticated, stored in secure HTTP-only cookies.

Waitlist Data

• Email address — collected if you join the waitlist before creating an account.
• Referral code — generated for your unique referral link.
• Referred-by code — recorded if you signed up via a referral link.

SigmaSpeed's AI scoring engine uses Google MediaPipe, a machine-learning library that runs entirely in your browser via WebAssembly. When you enter a battle:

• Your camera feed is accessed by the browser only.
• MediaPipe analyzes each frame locally and extracts numerical landmark coordinates (e.g., eye width, jaw angle).
• These landmark values are used to compute a numerical MOG score.
• Only the final numerical score is transmitted to our servers — not the raw video, not the landmark data.
• No screenshot or recording of your camera feed is made by SigmaSpeed.

You can verify this by inspecting network requests in your browser developer tools during a battle session.

In Duel Mode, your live camera and audio are streamed peer-to-peer to your matched opponent using WebRTC. This means:

• Your video stream is sent directly to your opponent's device, not through SigmaSpeed servers.
• A Cloudflare TURN server may relay traffic if a direct peer connection cannot be established due to network conditions. Relay traffic is encrypted in transit and not recorded by Cloudflare beyond standard network logs.
• SigmaSpeed does not record or store the live video stream from Duel Mode sessions.
• However, match metadata is always logged: opponent ID, AI scores, crowd vote counts, timestamps, and moderation reports.

Recording Reservation

SigmaSpeed reserves the right to record, store, and review Duel Mode sessions for the purposes of safety enforcement, abuse prevention, Terms of Service investigations, and cooperation with law enforcement. This capability exists as a legal safeguard and is only invoked upon credible reports or legal obligation. Users are notified of this in the Duel Mode waiver, which must be signed before entry.

Waiver

Before entering Duel Mode for the first time, users must accept the Duel Mode Waiver, which acknowledges peer-to-peer streaming, consent to potential session review, and agreement to conduct rules. The waiver timestamp and version are stored on your account. A new waiver acceptance is required if the waiver terms are updated.

We use data we collect for the following purposes:

• Providing the Service: Running battles, maintaining leaderboards, calculating ELO ratings, and enabling the tournament system.
• Account management: Authentication, password resets, and session management.
• Safety and moderation: Detecting abuse, processing reports, enforcing the age gate, and investigating Terms of Service violations.
• Communications: Sending waitlist confirmation emails, account-related notifications, and (with consent) product updates. You can unsubscribe from marketing emails at any time.
• Improving the platform: Analyzing aggregated, anonymized usage patterns to improve scoring accuracy, matchmaking quality, and the overall experience.
• Legal compliance: Responding to legal requests, enforcing our terms, and protecting the rights of users and SigmaSpeed.

We do not use your data for advertising profiling, selling to data brokers, or any purpose not described in this policy.

We do not sell, rent, or trade your personal data. We share data only in these limited cases:

• Infrastructure providers: Supabase (database/auth), Cloudflare (TURN relay), and Resend (email) receive the minimum data needed to provide their services. Each is bound by their own privacy policy and data processing agreements.
• Public profile data: Your username, tier, ELO rating, and win/loss record are visible on your public profile and the leaderboard. You chose this username when creating your account.
• Match opponents: Your username and score are shared with your opponent at the end of a match.
• Legal requirements: We may disclose data if required by law, subpoena, court order, or to protect the safety of users or the public.
• Business transfers: If SigmaSpeed is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify users before such a transfer occurs.

• Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
• Match history and ELO ratings: Retained indefinitely to maintain leaderboard integrity and competitive history. Upon account deletion, your profile is anonymized rather than hard-deleted to preserve match record coherence.
• Waitlist data: Email addresses collected on the waitlist are deleted within 90 days of the Service launching to the public, or upon your request.
• IP and access logs: Retained for up to 90 days for security purposes.
• Moderation records: Reports and associated metadata may be retained for up to 2 years to support ongoing investigations and appeals.

You may request deletion of your account and associated personal data at any time by contacting privacy@sigmaspeed.app.

We rely on the following third-party services to operate SigmaSpeed:

Depending on where you live, you may have the following rights regarding your personal data. We honor these requests regardless of jurisdiction.

• Access: Request a copy of all personal data we hold about you.
• Deletion: Request permanent deletion of your account and associated personal data.
• Portability: Request your match history and profile data in JSON format.
• Correction: Request correction of inaccurate personal data (e.g., wrong date of birth).
• Restriction: Request that we restrict processing of your data while a correction or deletion request is in progress.
• Opt-out of marketing: Unsubscribe from promotional emails at any time using the unsubscribe link in any email, or by contacting us.
• Withdraw consent: Where processing is based on consent (e.g., camera access), you can withdraw consent at any time by revoking browser permissions or contacting us.

To exercise any of these rights, contact us at privacy@sigmaspeed.app. We will respond within 30 days. We may request identity verification before fulfilling sensitive requests.

GDPR (EU/EEA users): You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

CCPA (California residents): We do not sell personal information as defined by the CCPA. You have the right to know, delete, and opt out of sale (not applicable here). We do not discriminate against users who exercise their privacy rights.

SigmaSpeed is not directed at children under the age of 13, and we do not knowingly collect personal data from anyone under 13. During account registration, we collect date of birth. If a user's date of birth indicates they are under 13, account creation is blocked entirely with a clear message.

If we become aware that we have inadvertently collected personal data from a child under 13, we will delete that data promptly. If you believe a child under 13 has created an account on SigmaSpeed, please contact us immediately at privacy@sigmaspeed.app.

Users aged 13–17 may use SigmaSpeed for leaderboard viewing, voting, and solo scoring mode only. Duel Mode — which involves live peer-to-peer video streaming — is restricted to users who are 18 or older. Age is verified at signup (via date of birth) and re-checked server-side before a user can enter the Duel Mode matchmaking queue.

We take reasonable technical and organizational measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher.
• Database access is restricted by Row Level Security (RLS) policies in Supabase — users can only access their own data.
• Authentication tokens are stored in secure, HTTP-only cookies.
• API routes are rate-limited at the Edge Function level to prevent abuse.
• Service-role database credentials are never exposed to client-side code.
• No raw video data from your camera is transmitted to or stored on our servers.

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to security@sigmaspeed.app. We will acknowledge reports within 48 hours.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) and by posting a prominent notice on the website at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

The current version of this policy is v1.0, effective May 7, 2026.

For privacy-related inquiries, data requests, or to report a concern: