Privacy Policy

Pick'em Baby is operated by [LEGAL ENTITY NAME] (“we,” “us,” or “our”). This Privacy Policy explains what personal information we collect when you use pickembaby.com, our AI football assistant, pick’em leagues, playoff brackets, and related services (together, the “Service”), how we use that information, and who we share it with.

It does not cover third-party sites or services we link to, or the separate privacy practices of the identity providers, payment processors, and AI providers described in Section 4.

Your use of the Service is also governed by our Terms of Service.

Account information. When you register we collect your email address, a username (displayed publicly on leaderboards), a hashed password, and your favorite NFL team. You may optionally add an avatar image, a short bio, and a preferred assistant tone. We record whether your email has been verified and your account type (guest, regular, or premium).

Social sign-in. If you sign in with Google, X (Twitter), or Facebook, we receive the basic profile information those services share with us — typically your name, email address, and profile image. We never receive your password for those accounts. Some providers may not share an email address, in which case sign-in cannot complete.

Guest sessions. You can use the AI assistant without an account. Guest sessions are identified by a session cookie and a limited daily allowance; guest activity is not linked to a persistent profile and abandoned guest records are periodically deleted.

Chat content. We store the messages you send to the AI assistant, the assistant’s responses, chat titles, any documents or artifacts generated in a chat, feedback votes on responses, and whether a chat is private or public. Images you attach (JPEG or PNG, up to 5 MB) are stored with our file storage provider.

Gameplay information. Your game picks and confidence values, the leagues you create or join, league invite codes, playoff bracket selections, and the scores, standings, and accuracy statistics derived from them.

Wallet and purchase information. Your Yards balance and a ledger of every grant, spend, purchase, and refund. For purchases we store the amount, what it was for, the status, and the identifiers returned by our payment processor. We never receive or store your full card number, CVV, or bank credentials — those go directly to our payment processor.

Affiliate information. If you use or share a referral link, we store your referral code, the accounts attributed to you, the bounties earned, and payout status.

Technical information. Our servers and hosting provider generate logs that include IP address, browser and device type, referring page, requested URLs, and timestamps. We use these for security, abuse prevention, rate limiting, and debugging.

• Provide the Service — authenticate you, run chats, record picks, score leagues and brackets, and maintain leaderboards.
• Generate AI responses — transmit your messages and relevant context to our AI providers so they can produce a response.
• Process payments — complete purchases of Yards packs, paid bracket entries, and league entry fees, and credit affiliate bounties.
• Communicate with you — send email verification, password resets, and Service notices. Marketing email, if we ever send it, will include an unsubscribe link.
• Protect the Service — enforce rate limits, detect fraud and referral abuse, and investigate violations of our Terms.
• Improve the Service — understand which features are used and diagnose errors, using aggregated or de-identified data wherever practical.
• Comply with law — meet tax, accounting, and legal obligations, and respond to lawful requests.

We do not use your chat content to train our own models, and we do not make automated decisions about you that produce legal or similarly significant effects.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with service providers that help us operate the Service, and only for that purpose:

• AI providers (Anthropic, xAI) — receive your chat messages and any context needed to generate a response. When you ask for news, opinions, or predictions, your question may be used to run a web and social search through xAI.
• Hosting and storage (Vercel) — hosts the application, stores uploaded images, and generates request logs.
• Database and cache providers — store your account, gameplay, and chat records, and (optionally) support resumable streaming.
• Payment processor (Stripe) — collects and processes payment details and returns transaction results to us.
• Email delivery (Resend) — sends verification, password reset, and notification email on our behalf.
• Identity providers (Google, X, Facebook) — only if you choose social sign-in.
• Sports data provider (SportsRadar) — supplies live NFL data. We send it queries about games and teams, not your personal information.

We may also disclose information when required by law or valid legal process, to protect our rights, safety, or property or that of our users, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you before your information becomes subject to a different privacy policy).

Some information is intentionally visible to other users:

• Your username, avatar, and favorite team appear on league standings and leaderboards you participate in.
• Within a league, other members can see your picks after the applicable lock time, along with your weekly and season scores.
• Chats you explicitly mark as public can be viewed by anyone with the link. Chats are private by default.

Choose a username and bio you are comfortable showing publicly, and do not include personal details in a chat you intend to make public.

We use cookies that are necessary for the Service to function: a session cookie that keeps you signed in, a CSRF token, and preference cookies that remember settings such as your theme and selected model. Blocking these will break sign-in and core features.

We do not use advertising cookies or third-party ad trackers. We honor Global Privacy Control (GPC) signals as a valid opt-out request where required by law.

• Account, gameplay, and chat data — kept while your account is active, and deleted or de-identified within 90 days of account deletion.
• Guest sessions — abandoned guest records are pruned on a rolling basis.
• Payment, wallet, and affiliate records — retained as long as required for tax, accounting, and anti-fraud purposes, typically seven years, even after account deletion.
• Security and request logs — retained for a short period (generally 30–90 days) unless needed for an active investigation.

Passwords are stored as bcrypt hashes, never in plain text. Traffic is encrypted in transit with TLS, database queries are parameterized, and access to production data is limited to people who need it. Password reset and email verification tokens are stored hashed and expire.

No system is perfectly secure. If you believe your account has been compromised, contact us at support@pickembaby.com immediately.

Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy of it in a portable format, to correct inaccuracies, to delete it, to limit how sensitive information is used, and not to be discriminated against for exercising these rights.

California residents (CCPA/CPRA). In the last 12 months we collected the categories of information described in Section 2 — identifiers, customer records, commercial information, internet activity, and user-generated content — for the business purposes in Section 3. We did not sell or share personal information for cross-context behavioral advertising, and we do not knowingly collect personal information from minors. You may use an authorized agent to submit a request.

Colorado, Connecticut, Virginia, Texas, Utah, and other state privacy laws. Residents of states with comprehensive privacy laws have equivalent access, correction, deletion, and portability rights, and may appeal a denied request by replying to our decision.

To exercise any right, email support@pickembaby.com. We will verify your request against your account and respond within 45 days, extendable once where the law allows. You can also delete most content — chats, picks, and profile details — directly from your dashboard.

The Service is not directed to children. You must be at least 18 years old to hold an account, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected information from a child under 13, we will delete it. A parent or guardian who believes a child has provided us information should contact support@pickembaby.com.

The Service is operated from and intended for users in the United States, and information is stored and processed there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States under this Policy.

We may update this Policy as the Service evolves. When we do, we will change the effective date at the top of this page, and for material changes we will provide additional notice — by email or an in-app notice — before the change takes effect. Continuing to use the Service after a change means you accept the updated Policy.

Questions or requests about privacy:

[LEGAL ENTITY NAME]
[BUSINESS MAILING ADDRESS]
support@pickembaby.com