VideoPicks Privacy Policy

1. Information We Collect

1.1 Your phone number. The Services have no usernames, passwords, or email sign-up. Your mobile phone number identifies your wallet, your Star balance, and your unlocks. We collect it when you type it into a square or the wallet.

1.2 Verification codes. When we text you a one-time code, we store a hashed or short-lived copy of that code, the time it was sent, and the number of attempts, only long enough to check it.

1.3 Star balance and unlock ledger. We keep a per-number ledger of every Star credited (welcome credit, promotional unlock, purchase, support adjustment) and every Star spent, with the square unlocked and the time. This is how your balance and your unlocks work.

1.4 Purchase history. When you buy a pack, our payment processor, Stripe, sends us the fact and amount of the purchase, the pack you bought, a Stripe transaction identifier, and whether the payment succeeded. WE NEVER SEE OR STORE YOUR FULL CARD NUMBER, EXPIRATION DATE, OR SECURITY CODE. Those go directly to Stripe.

1.5 Device session. After you verify, we place a session cookie on your device so you can open your unlocks and wallet without a new code. The cookie holds a signed token tied to your number, not your number in plain text.

1.6 Approximate location. To show sportsbook offers that are available where you are, we read the country and state that our hosting provider infers from your IP address on each request, and, if you choose a state in the offer card, we remember it in a cookie. We do not collect precise GPS location.

1.7 Preferences. Your language choice (English or Spanish), your board filters, and whether you dismissed the install hint are stored in cookies or in your browser's local storage.

1.8 Usage and log data. Like most websites, our servers record the IP address, browser type, device type, referring page, pages and squares viewed, and time of each request, and which sportsbook links were followed. We use this data to keep the Services working, prevent abuse, and understand which picks and videos people watch.

1.9 Support messages. If you email help@videopicks.io or reply to a text, we keep the message and your contact details so we can help you.

1.10 What we do not collect. We do not ask for your name, email address, or postal address to use the Services (Stripe may ask for a billing name and postal code at checkout). We do not collect government identifiers, biometric data, health data, or precise location, and we do not knowingly collect anything from anyone under 21.

2. How We Use Your Information

We use the information above to:

• identify your wallet and show you the squares you have unlocked;
• text you verification codes, and confirmations about picks you unlock;
• credit Stars you buy and debit Stars you spend, and keep the ledger accurate;
• show sportsbook offers that are available in your state;
• remember your language and filters;
• send you texts about your picks and related offers, where you have consented (you can stop at any time, see Section 5);
• answer your support requests;
• detect and prevent fraud, promotion abuse, content sharing, and other violations of our Terms;
• keep the Services secure and fix problems;
• understand, in aggregate, which games and videos people watch, so we can make the board better;
• comply with law and enforce our Terms.

We may also use de-identified or aggregated data (for example, how many squares were unlocked on a given day) for any lawful purpose. Such data cannot reasonably be used to identify you.

3. NO SALE OR SHARING OF YOUR PERSONAL INFORMATION

WE DO NOT SELL YOUR PERSONAL INFORMATION. WE DO NOT SHARE, RENT, OR TRADE YOUR PHONE NUMBER, PURCHASE HISTORY, UNLOCK HISTORY, OR ANY OTHER PERSONAL INFORMATION WITH THIRD PARTIES FOR THEIR OWN MARKETING OR ADVERTISING PURPOSES. We do not "share" personal information for cross-context behavioral advertising as that term is defined in California law, and we do not engage in targeted advertising as defined in other state privacy laws.

Your mobile number and your consent to receive texts are never shared with anyone for any purpose other than delivering our own messages to you through our messaging providers.

The only people who receive your information are the service providers that run pieces of the Services on our behalf (Section 4), our own corporate affiliates acting on our behalf (Section 4.3), and, in the limited situations below, the law.

3.1 Sportsbook links. When you follow a sportsbook offer from an unlocked square, the link may carry a referral tag so the sportsbook can credit VideoPicks for the referral. That tag does not contain your phone number or any other personal information about you. Anything you provide to a sportsbook after you leave our site is governed by that sportsbook's own privacy policy, not ours.

3.2 Legal requirements and safety. We may disclose information if required by law, subpoena, court order, or governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of VideoPicks, our users, or the public, to investigate fraud, or to enforce our Terms.

3.3 Business transfers. If VideoPicks is involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the successor as part of that transaction, subject to this Privacy Policy. We will post notice on the site before your information becomes subject to a materially different privacy policy.

3.4 With your consent. We may share information in other ways if you ask us to or give us your express consent.

4. Service Providers

We use a small number of companies to run the Services. Each is bound by contract to use your information only to provide its service to us, and none may use it for its own purposes:

• Vercel, Inc.: hosts the website and runs our server code; its edge network also infers your approximate country and state from your IP address for the offer card.
• Upstash, Inc.: the database that stores phone numbers, verification state, Star balances, the unlock ledger, and device sessions.
• Stripe, Inc.: processes payments. Stripe collects your card details directly under its own privacy policy; we receive only the transaction outcome and identifiers described in Section 1.4.
• Twilio Inc. (and, where configured, SlickText): deliver verification codes and text messages to your number.
• Amazon Web Services, Inc.: stores and serves the pick videos. When your browser loads a video, AWS receives your IP address and standard request data.
• Email and support tools we use to answer messages sent to help@videopicks.io.

4.1 Advertising measurement. We use Meta (Facebook and Instagram) to measure whether our own ads bring people to VideoPicks. To do that we load the Meta pixel in your browser and send Meta server-side events (the Meta Conversions API) when you take a few specific actions: verifying a number (a lead), buying a Star pack (a purchase), and unlocking a square (an unlock). The match key for those events is your phone number in hashed form (SHA-256), never in plain text, plus the usual browser signals such as IP address, browser type, and the page you were on. Meta uses this to attribute the action to an ad and to report aggregate results to us; Meta's own use of the data is governed by Meta's Data Policy. We do not send Meta your Star balance, your unlocks' contents, or the picks you watched. This measurement is done with our own vendor on our behalf; it is not a sale of your information and it does not give any sportsbook or other partner access to it. You can opt out at any time with the "Do not share my personal information" link at the bottom of every page, which sets a cookie that stops the pixel from loading and stops server events for your session, or by blocking the pixel with your browser or a content blocker (Section 6). We do not load ad networks or cross-site analytics beyond this measurement.

4.2 Partners are not service providers. Sportsbooks, prediction markets, and other operators whose offers appear after an unlock are independent third parties. See Section 3.1.

4.3 Corporate affiliates. Our corporate affiliates, including GSI Media LLC, a Texas limited liability company that may act as our billing or operations agent, may process information on our behalf under this Privacy Policy and only for the purposes in Section 2. Our affiliates do not use your information for their own marketing and do not add your number to any other brand's lists.

5. Text Messaging Program (SMS)

5.1 What we send. By entering your number you agree to receive texts from VideoPicks, including one-time verification codes, messages about the picks you unlock, and related offers. Consent is not a condition of purchase. Message frequency varies with your activity. Message and data rates may apply.

5.2 STOP and HELP. Reply STOP to any message to stop receiving texts; we will send one final message confirming you are unsubscribed, and after that we will not text you again unless you re-enter your number. Reply HELP for help, or email help@videopicks.io. Carriers are not liable for delayed or undelivered messages.

5.3 Codes still work. If you have texted STOP, you can still use the Services on a device that holds your session. If you later need a new verification code, re-entering your number on the board is your consent to receive that code.

5.4 No sharing of SMS consent. Your mobile number and your text-messaging consent are not shared with any third party for promotional or marketing purposes. Any sharing described elsewhere in this Policy excludes mobile opt-in data.

6. Cookies and Local Storage

We use a small set of first-party cookies and browser storage, all of which are needed for the Services to work or to remember your choices:

• vp_session: your device session after you verify your number. Lives for up to 30 days, or until you use "Not you? Use another number." Strictly necessary.
• vp_lang: your language (English or Spanish). Lives one year. Functional.
• vp_state: the state you chose in the offer card, so offers match it next time. Lives one year. Functional.
• Browser local and session storage: your board filters, the squares you unlocked in this session, and whether you dismissed the install hint. Functional.
• Stripe: during checkout, Stripe sets its own cookies for fraud prevention and to complete your payment, under Stripe's privacy policy.
• Meta pixel (_fbp, and _fbc when you arrive from a Meta ad): advertising measurement as described in Section 4.1. Lives up to 90 days. Advertising. Not set when you have opted out.
• vp_no_ads: records that you chose "Do not share my personal information." Lives one year. Strictly necessary for honoring your choice.

Apart from the Meta pixel in Section 4.1, we do not use third-party advertising or analytics cookies. To opt out of advertising measurement, use the "Do not share my personal information" link at the bottom of every page; we treat that choice, and a Global Privacy Control signal from your browser, as an opt-out and stop loading the pixel and sending server events for your session. You can also delete or block cookies through your browser settings at any time; deleting cookies signs you out of your wallet until you verify again and clears your opt-out, so you may need to choose it again.

7. Data Retention

• Verification codes: deleted or expired within minutes of being sent; attempt counters expire within hours.
• Device sessions: expire on their own within 30 days and are deleted when you switch numbers.
• Phone number, Star balance, and unlock ledger: kept for as long as your wallet is active, and for up to three (3) years after your last activity so we can honor your balance, answer disputes, and prevent promotion abuse; earlier on request (Section 9).
• Purchase records: kept for at least seven (7) years as required for tax, accounting, and payment-dispute purposes. Stripe keeps its own records under its policy.
• Server logs: kept for up to ninety (90) days, then deleted or aggregated.
• Support messages: kept for up to three (3) years after the last reply.

When information is no longer needed we delete it or de-identify it so that it can no longer be linked to you.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including TLS encryption for everything in transit, signed session tokens, short-lived verification codes with attempt limits, rate limiting on phone entry, access controls so that only the people who need it can reach the database, and payment handling entirely inside Stripe.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Your number is your account: anyone who controls your phone or a device holding your session can open your wallet. If you believe your wallet has been accessed without your permission, use "Not you? Use another number" on that device and email help@videopicks.io right away.

9. Your Rights and Choices

9.1 Access, correction, and deletion. You may ask us what personal information we hold about your phone number, ask us to correct it, or ask us to delete it, by emailing help@videopicks.io from any address and including the phone number. We will text a code to that number to confirm you control it before we act. We respond within thirty (30) days, or sooner where the law requires. Deleting your information closes your wallet and forfeits any unused Stars; we will tell you that before we proceed. Purchase records that the law requires us to keep are retained in a form that is no longer linked to your number wherever possible.

9.2 Texts. Reply STOP to any text to stop receiving messages (Section 5).

9.3 Cookies. Clear them in your browser at any time (Section 6).

9.4 Portability. On request we will provide your unlock ledger and purchase history in a portable, machine-readable format.

9.5 No discrimination. We will not deny you the Services, charge you a different price, or provide a different level of service because you exercised any of these rights.

9.6 Authorized agents. An agent may submit a request on your behalf if you give the agent written permission and we can verify your identity through your phone number.

10. California and Other U.S. State Privacy Rights

10.1 California (CCPA/CPRA). If you are a California resident you have the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising those rights. In the preceding twelve months we have collected the categories in Section 1 (identifiers, commercial information, internet activity, approximate geolocation, and the content of support messages) from the sources in Section 1, for the purposes in Section 2, and disclosed them only to the service providers in Section 4. WE HAVE NOT SOLD PERSONAL INFORMATION AND WE DO NOT SHARE IT WITH THIRD PARTIES FOR THEIR OWN MARKETING. Advertising measurement with our own vendor (Section 4.1) may count as "sharing" for cross-context behavioral advertising under California law, so we offer the "Do not share my personal information" link at the bottom of every page and honor Global Privacy Control signals. We do not use or disclose sensitive personal information for purposes that require a right to limit. To exercise your other rights, email help@videopicks.io.

10.2 Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Utah, and other states. Residents of states with comprehensive privacy laws may have rights of access, correction, deletion, portability, and to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. We do not sell personal data and do not profile you in a way that produces legal or similarly significant effects. Advertising measurement (Section 4.1) may be treated as targeted advertising in some states; the "Do not share my personal information" link is your opt-out. To exercise your other rights, or to appeal a decision we make on a request, email help@videopicks.io with "Privacy request" in the subject line.

10.3 Nevada. We do not sell covered information as defined in NRS Chapter 603A.

11. Age: 21 and Older Only

THE SERVICES ARE STRICTLY FOR ADULTS AGED 21 AND OLDER. We do not knowingly collect personal information from anyone under 21, and we prohibit anyone under 21 from using the Services. If we learn that we have collected information from someone under 21 we will delete it promptly and close the associated wallet. If you believe a person under 21 has used the Services, email help@videopicks.io.

12. Where Your Information Is Processed

The Services are operated from the United States and intended for people in the United States. If you use them from anywhere else, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those where you live.

13. Third-Party Sites

Sportsbook offers and other links on the Services lead to sites we do not control. This Privacy Policy does not apply to them. Read each site's privacy policy before you give it any information. VideoPicks is not responsible for the privacy practices of any third party.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised Policy at videopicks.io/privacy with a new "Last updated" date. If a change materially reduces your rights or changes how we use information already collected, we will give notice on the board or by text before it takes effect. Your continued use of the Services after a revision takes effect means you accept it.

15. Contact Us

Questions, requests, or concerns about privacy: help@videopicks.io.

SkyBurst Technology, Inc., d/b/a VideoPicks, Attn: Privacy, 251 Little Falls Drive, Wilmington, DE 19808.

Data controller: SkyBurst Technology, Inc..