PRIVACY POLICY

1. Who this policy covers

This Privacy Policy explains how Bald Sports ("Bald Sports," "we," "us," and "our") collects, uses, discloses, and retains information when you use our websites, waitlist, app, contests, smart-contract interfaces, emails, support channels, and related services (together, the "Platform").

If you only use the public landing page or join the waitlist, we collect much less information than if you connect a wallet, enter a contest, submit picks or votes, or claim a payout.

2. Contact and privacy lead

Questions, privacy requests, or complaints can be sent to [email protected]. Bald Sports is the organization responsible for, and where applicable the controller of, personal information it collects and processes directly through the Platform.

Third-party wallet, authentication, onramp, blockchain infrastructure, analytics, compliance, and hosting providers may process information as service providers, processors, or independent controllers under their own terms and privacy policies.

3. Information we collect

Depending on how you use the Platform, we may collect or process the following categories of information:

• Waitlist and email data: email address, signup timestamp, unsubscribe status, and email engagement data.
• Wallet and account data: wallet address, wallet connection status, wallet signatures, embedded-wallet account identifiers, ENS name, generated handle, avatar, profile settings, authentication/session identifiers, and data processed through wallet or authentication providers such as Privy if enabled in the app.
• Entry and gameplay data: contest entries, entry counts, entry price, selected contest, picks, brackets, strategy votes, signed intent payloads, nonces, timestamps, backend receipt data, eligibility state, leaderboard data, scores, claim eligibility, claim data, payout records, and dispute or support records.
• Onchain data: transaction hashes, smart-contract interactions, USDC approvals, entry purchases, published pick/vote/bracket batches, Merkle roots or proofs, claims, wallet balances visible through public networks, and other blockchain data.
• Compliance and safety data: age, risk, and Terms attestations; Terms version accepted; IP address; approximate location or jurisdiction signals; geoblock results; sanctions or restricted-party screening results; wallet-risk signals; fraud, bot, abuse, and rate-limit signals; and related logs.
• Device and technical data: IP address, user agent, browser type, device type, operating system, referrer URL, pages viewed, server logs, performance data, error logs, and security events.
• Communications: messages you send us, support requests, feedback, social or community messages, and related metadata.
• Analytics data: page views, referral sources, rough location derived from network data, device/browser data, and interaction events used to understand and improve the Platform.

4. Information we do not want

Do not send us sensitive documents, government IDs, financial account details, private keys, seed phrases, or unnecessary personal information unless we specifically request it through an official flow. We will never ask for your private key or seed phrase.

5. How we use information

We use information to:

• operate the waitlist, website, app, contests, entries, picks, votes, scoring, settlement, and claims;
• connect wallets, authenticate users, maintain sessions, and provide profile or identity features;
• stage, validate, publish, audit, and verify signed picks, votes, brackets, and contest data;
• process entries, USDC payments, claims, refunds, and contest records;
• show contest status, pool status, leaderboards, results, claim status, and onchain references;
• verify eligibility, geoblock restricted jurisdictions, screen wallets, prevent fraud, enforce rules, and protect contest integrity;
• send launch updates, transactional emails, product updates, support replies, and important legal or security notices;
• debug, secure, monitor, test, and improve the Platform;
• comply with legal, sanctions, tax, accounting, record-keeping, dispute, and enforcement obligations;
• respond to lawful requests, legal process, regulatory inquiries, or safety incidents.

6. Legal bases for EEA, UK, and similar users

If laws such as the GDPR or UK GDPR apply to our processing of your personal information, our legal bases may include:

• Contract: to provide the Platform, process entries, operate contests, authenticate users, support claims, and respond to user requests.
• Legitimate interests: to secure, debug, monitor, improve, and protect the Platform; prevent fraud, abuse, bot activity, and rule manipulation; maintain contest integrity; and use privacy-focused analytics where consent is not required.
• Legal obligations: to comply with sanctions, tax, accounting, record-keeping, dispute, regulatory, and law-enforcement obligations.
• Consent: for marketing communications, optional features, or non-essential cookies or similar technologies where consent is required.

Where consent is the basis for processing, you may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal or processing based on another legal basis.

7. Public and onchain data

Blockchain data is public, persistent, replicated, indexable, and not controlled by Bald Sports. If information is published to Base, Ethereum, another blockchain, or a public contest dataset, we may not be able to delete, hide, reverse, or change it.

Wallet addresses are pseudonymous, not anonymous. A wallet address may be linked to your activity through public blockchain data, app data, device data, IP or location signals, ENS names, social activity, compliance screening, or information you provide.

Pending picks, votes, and bracket submissions are intended to remain private to you until the relevant batch is published. Once published or included in public contest data, they may become visible to others and may be permanent.

8. Who can access unpublished contest data

Before batch publication, staged picks, votes, brackets, and signed intent data may be accessible to Bald Sports personnel and contractors who need it to operate the Platform, backend infrastructure providers, security or audit providers, and other service providers that process the data for us. We use access controls and operational safeguards, but we do not promise that staged data is end-to-end encrypted or inaccessible to all service providers.

9. How we disclose information

We may disclose information to:

• Infrastructure providers such as Cloudflare, Supabase, hosting providers, database providers, logging providers, and storage providers.
• Email and communication providers such as Resend or future support tools.
• Wallet, authentication, and onramp providers such as Privy, wallet connectors, embedded-wallet providers, fiat onramp providers, and wallet apps you choose to use.
• Blockchain and crypto infrastructure such as Base, Ethereum, RPC providers, indexers, block explorers, smart contracts, UMA, oracle infrastructure, DEX routers, DeFi protocols, and settlement or claim infrastructure.
• Compliance and risk providers such as sanctions-screening, wallet-risk, geolocation, fraud-prevention, abuse-prevention, and security vendors.
• Analytics providers such as Plausible or similar privacy-focused analytics tools.
• Professional advisers such as lawyers, accountants, auditors, insurers, and security reviewers.
• Authorities or third parties where we believe disclosure is required or appropriate for legal compliance, sanctions, fraud prevention, security, dispute resolution, rule enforcement, or protection of rights and safety.
• Public networks and users when data is published onchain, included in public contest datasets, displayed in leaderboards, or needed to verify contest results and claims.

We do not sell personal information to data brokers. We also do not use or share personal information for third-party targeted advertising.

10. Analytics, cookies, and browser storage

Our current landing page uses Plausible, a privacy-focused analytics provider that does not use cookies for standard analytics.

The app may use cookies, localStorage, sessionStorage, wallet session state, or similar browser storage for essential or functional features such as wallet connection, authentication, security, attestation status, preferences, and app state. Wallet, authentication, onramp, and analytics providers such as Privy or Plausible may use their own cookies or similar technologies under their own policies.

If we add advertising pixels, cross-site tracking, or non-essential analytics or cookies that require consent, we will update this policy and, where required, provide appropriate choices.

11. Automated or semi-automated checks

We may use automated or semi-automated tools to make or support decisions about geoblocking, sanctions screening, wallet-risk screening, fraud prevention, bot detection, rate limits, and eligibility. These checks may affect whether you can connect, enter, continue, claim, or use certain Platform features.

If you believe a restriction was applied incorrectly, contact [email protected]. Where required by law, you may request information about the personal information used, the main factors that led to the decision, and review by a person. We may not be able to provide full details about security, sanctions, or fraud logic if doing so would compromise the Platform or our legal obligations.

12. Cross-border processing

We and our service providers may process, store, or access information in Canada, the United States, the European Economic Area, and other countries. Privacy laws in those places may differ from the laws where you live. We use service providers and contractual, technical, and operational safeguards that we consider appropriate for the data and purpose. Where required, we assess cross-border processing and transfers before using a provider or transferring personal information.

13. Retention

We keep information only as long as reasonably needed for the purposes described in this policy, unless a longer period is required or permitted for legal, compliance, sanctions, fraud-prevention, tax, accounting, security, dispute, audit, or record-keeping reasons.

Examples:

• Waitlist email data is kept until you unsubscribe or ask us to delete it, subject to suppression and legal records.
• Contest, entry, claim, attestation, screening, and audit logs may be kept for longer because they support legal compliance, dispute resolution, fraud prevention, and contest integrity.
• Support messages may be kept while your issue is active and for a reasonable period afterward.
• Onchain data and public blockchain records cannot be deleted by Bald Sports.

14. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system, smart contract, wallet, blockchain, or internet transmission is perfectly secure. You are responsible for protecting your wallet, private keys, devices, passwords, and recovery phrases.

If we become aware of a privacy or security incident that requires notice, we will take steps to mitigate harm and provide notices where required by law.

15. Your choices and rights

Depending on where you live and the information involved, you may have rights to access, correct, delete, export, receive a portable copy of, restrict, or object to certain processing of your personal information, to withdraw consent where consent is the basis for processing, or to complain to a privacy regulator or supervisory authority.

These rights have limits. We may retain information where needed for legal compliance, sanctions, fraud prevention, security, accounting, dispute resolution, contest integrity, or other permitted reasons. We cannot delete or change public blockchain data.

You can unsubscribe from marketing emails through the unsubscribe link in those emails. You can also make a privacy request by emailing [email protected].

16. Children

The Platform is intended for adults. You must be at least 18 years old or the age of majority in your jurisdiction, whichever is greater, to use the app or enter contests. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us.

17. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users through the Platform, email, or another appropriate method. The "last updated" date will show when the policy was last revised.

18. Contact

Questions about privacy? Email [email protected].