Privacy Policy for Jimbo’s Pick’Em Challenge

Effective date: August 28, 2026

Operator: Jim Hand

Privacy contact: jpc.app.support@gmail.com

This policy describes how Jimbo’s Pick’Em Challenge (the “App”) handles information when you create an account or use the App.

Information we handle

We handle the following information to operate the App:

  • Your email address and authentication account information, including an account identifier managed through Supabase Auth.
  • Your profile information: display/profile name, selected preset avatar, and age division. The App does not request a date of birth.
  • Your private-group information: group names, memberships, administrative roles, join code, and passcode verification data. Group passcodes are stored as bcrypt hashes, not as readable passcodes.
  • Your game activity: college-football picks, confidence values, submission status, standings, and historical competition results.
  • Safety and moderation information, including reports about fellow group members, report reasons and optional details, and group-admin block records.
  • Basic technical and security information generated by Supabase and related infrastructure, such as IP address, user agent, request and authentication logs, and timestamps.

The current App does not include advertising, cross-app tracking, an analytics SDK, a crash-reporting SDK, push notifications, or collection of location, contacts, health information, payment information, advertising IDs, photos, or audio. We do not sell personal information.

How we use information

We use information to create and secure accounts, authenticate users, provide private groups, save and lock picks, calculate standings, enforce group and pick-visibility rules, respond to support requests, prevent misuse, and operate and secure the App.

The App has no real-money wagering, deposits, withdrawals, gambling, or cash prizes. Confidence points are game-scoring points used only for private-group standings; they have no monetary value and cannot be exchanged for money or anything of value.

Community protections

The App has no public social feed, chat, or media-posting feature. Profile and group names are checked at the server-side write boundary for configured objectionable terms. From Groups -> Members, a current group member may report another current member using a listed reason and optional short description. Reports are not visible to other members or the reported player and are available only for authorized service handling.

Group admins may block an eligible non-admin member and later unblock them. Blocking removes that player’s access to the group and prevents rejoining until an admin unblocks them; unblocking does not restore membership automatically. Completed standings and legitimate historical competition results remain intact.

Service providers and disclosures

We use Supabase to provide authentication, database services, Edge Functions, and related infrastructure. Supabase processes the account, profile, private-group, game, and basic technical/security information described above on our behalf.

The App’s server-side service obtains public college-football schedule, ranking, and scoreboard data from CollegeFootballData.com (CFBD). The implementation does not send your email address, account identifier, profile, group, selections, or device data to CFBD.

We do not sell personal information or share it for targeted advertising. We may disclose information where required by law or to protect the security, rights, or operation of the App.

Retention and account deletion

You can permanently delete your account in the App from More → Delete Account. The App asks you to reauthenticate and confirm the deletion. When the deletion completes, the authentication identity and user-owned raw App data are deleted according to the implemented deletion flow.

To preserve legitimate completed competition standings in a private group that remains active, we may retain a de-identified, frozen aggregate completed-game result. It is displayed only as Deleted player. This archive does not retain your account identifier, email address, profile, display name, raw pick, or selected team. Deleted identities do not remain displayed as personally identifying user profiles. We do not retain unfinished, live, or simulation history in that archive.

If you owned a group with other members, the App transfers ownership under its server-side group rule so the group can continue. If you were the sole member, the group is removed.

Application data is retained while needed to provide the service or until it is deleted according to the account-deletion flow. Supabase Pro project logs are currently available to the operator for approximately 7 days, and Supabase Pro daily database backups are currently available for approximately 7 days. We do not promise that all provider-side operational or security data is deleted after exactly seven days: Supabase may retain or process data according to its own service, security, and legal obligations.

Security

We use access controls, authentication, server-side authorization, and transport security designed to protect App information. No security system is perfect, so please use a unique password and keep your account credentials private.

Children and age considerations

The App is intended for users age 13 and older and is not directed to children under 13. We do not knowingly seek personal information from children under 13. If Jim Hand learns that an under-13 child provided personal information, he will take reasonable steps to delete it. Parents or guardians may contact jpc.app.support@gmail.com.

Your questions and choices

For privacy questions, safety concerns, or to exercise applicable privacy rights, contact jpc.app.support@gmail.com. You can also request account deletion in the App as described above.

Changes to this policy

We may update this policy when our practices or the App change. We will post the current version at the public Privacy Policy URL and update the effective date.