Privacy

Your picks, ties, and skips, tied to a session. That log is the leaderboard.

A guest is an anonymous session. A username adds a password to it. Google sign-in stores the email Google returns; we never send mail.

Sessions record an IP address and browser user agent. The IP address also rate-limits requests. It never decides who is who.

Two: the session cookie (HttpOnly, SameSite=Lax) and bmx_track, your desktop/mobile choice, mirrored in local storage. No analytics, no ad pixels, no third-party scripts.

Usernames only: handle, pick count, and revealed pairings. Skips are never shown. Guests have no page. Profiles are noindex.

Live previews run on a separate origin in a sandboxed frame with no cookies. Nothing you do inside one reaches Benchmaxx.

Sign into an existing username and your guest picks merge in; the account's existing pick wins a conflict. Sign out and you get a fresh guest.

No email reset; an operator sets a new password on request. No self-service deletion yet; records stay while the arena runs. Admin actions are audited.