Privacy Policy

Last Updated: August 2026

This Privacy Policy explains what information REDZONEPicks.app collects, how it is used, and the choices you have. It applies to your use of REDZONEPicks.app (the "Service").

1. Information We Collect

Account information. When you register, we collect your email address, a securely hashed version of your password (we never store your password itself), and a display name.

Pool membership information. When you join a pool, we store the entry name you play under, your role (player, co-commissioner, etc.), whether you're marked paid within that pool, and your autopick preference, if any. If a pool's commissioner turns on Contact Requirements for their pool, joining that specific pool may also collect your first and last name, phone number, mailing address, and/or answers to a custom question the commissioner has configured. This is optional, controlled entirely by that pool's commissioner, and only collected for pools that request it. It is tied to your membership in that specific pool and stored for that commissioner's use in running the pool - for example, to coordinate a prize or payout. Today, your first and last name and phone number can be used by the commissioner to search for and message players within the Service; your mailing address and custom question answers are stored with your membership record and shown back to you in your own account, and are not currently displayed to the commissioner through any page of the Service. None of this information is shown to other players or used for advertising, and all of it is permanently deleted if you leave that pool or are removed from it.

Gameplay data. Your weekly picks, tiebreaker guesses, and any Trash Talk posts or pool announcements you submit.

Payment information. If you create a pool, you pay a one-time hosting fee through Stripe, our payment processor. We store the amount charged, the pool and season it applies to, and a reference to the Stripe transaction. We never receive or store your card number or other card details - those go directly to Stripe.

Technical information. We temporarily use your IP address, in memory only, to apply rate limits that protect account registration, login, and password reset from abuse. This IP address is not written to our database or retained.

Cookies. The Service sets a single session cookie to keep you logged in. It is marked HTTP-only and, in production, Secure, and expires after 14 days of inactivity. We do not use advertising or analytics tracking cookies.

2. How We Use Information

We use the information above to: operate your account and let you log in; let you join and participate in pools; compute and display picks, scores, and standings; let commissioners manage their pool's roster and communicate with players; process hosting fee payments; send account-related email (such as password resets and, if a pool's commissioner uses it, reminder notices or pool-wide email); and protect the Service from abuse.

3. How We Share Information

We do not sell your personal information. We share information only as needed to operate the Service:

• With Stripe, our payment processor, to process hosting fee payments.
• With our email provider, currently an SMTP relay through Porkbun, to send account and pool-related email.
• With your pool's commissioner, for the pool membership information described in Section 1 - this is necessary for them to run the pool.

Game schedules, scores, and related NFL data shown on the Service come from a third-party sports data provider (a public ESPN API endpoint). That's public sports information, not tied to your personal account data - we don't send your personal information to that provider.

We do not share your information with advertisers or data brokers, and we do not use any third-party analytics, advertising, or error-monitoring service on the Service.

4. Data Retention

Your account information is retained for as long as your account exists.

If you leave a pool, or a commissioner removes you from one, your membership record for that pool - including any Contact Requirements information you provided and your picks in that pool - is permanently deleted.

There is not currently a self-service option to delete your entire account; contact us via the Contact page to request it. When we complete an account deletion request, your account, along with your membership records and picks across every pool you belong to, is permanently deleted. If you are the owner/commissioner of a pool, deleting your account also deletes that pool entirely, including every other member's entries and picks in it - we will confirm this with you before completing a deletion request that would affect other players.

5. Data Security

Passwords are stored using industry-standard one-way hashing (bcrypt) and are never stored or transmitted in plain text. The Service is served over HTTPS. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

7. Your Choices

You can leave any pool at any time from your dashboard, which permanently removes your membership record (including any Contact Requirements information) and your picks in that pool. You can contact us to correct inaccurate account information or to request deletion of your account.

8. Third-Party Links

Pages on the Service may link to third-party sites (such as Stripe's checkout page). This Privacy Policy does not apply to those third-party sites, and we encourage you to review their own privacy practices.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date above reflects the most recent revision.

10. Contact

Questions about this Privacy Policy can be sent to us via our Contact page.