← Back to Football Pick'em

Privacy Policy

Effective date: October 15, 2026

Football Pick'em is operated by Bluetrace Entertainment, LLC ("Bluetrace," "we," "us") at pickem.bluetrace.net. It is software that lets a league's Commissioner run a weekly football pick'em pool. This policy explains what we collect and how we handle it. A league's Commissioner manages that league's players, picks and payment records within the service.

Football Pick'em is for adults 18 and older in the United States.

Information we collect

• Account and profile. Your first and last name, optional nickname, email address (your sign-in), optional phone number, and optional payment handles (Venmo handle, Cash App $Cashtag, PayPal.Me name). A Commissioner may enter or update these details for members of their league. We store a password hash, never your password itself, along with account verification and security records.
• League activity. Your league memberships and role, your picks and tiebreak guesses, when and how each pick was entered (by you, or by a Commissioner entering a paper sheet), standings, and participation status.
• Payment records. Whether your weekly entry is unpaid, claimed, paid, waived or out; the payment method you or a Commissioner reports; the history of those changes; and payouts recorded by a Commissioner. Football Pick'em does not process, hold or verify money. It opens prefilled links to Venmo, Cash App or PayPal, or shows a Commissioner's Zelle email or phone for you to copy. Those services handle any payment under their own terms and privacy policies. We never collect card or bank account numbers.
• Change history. Each league keeps a change log of picks, payment status and player-profile changes, readable by that league's Commissioners. Email addresses, phone numbers and payment handles are masked in the log (for example n•••@example.com, •••-•••-1234). Entries are deleted automatically after 3 years.
• Sign-in and account-recovery events. When someone asks for a password reset link, completes a reset, asks which email address their account uses, or accepts an invitation, we record the event in the change log of every league the account belongs to. The record includes a partially masked version of the network (IP) address the request came from, for example 73.162.x.x. We never store the full address in the log. It lets a league's Commissioners spot account-recovery requests that didn't come from the player, and it is deleted with the rest of the log after 3 years.
• Security and operational information. Sign-in sessions, one-time links (password reset, email confirmation, invitations), failed sign-in and rate-limit counters, and server logs. Our hosting provider processes technical data such as IP address, browser type and request logs to deliver and protect the service.
• Messages. We send service email (email confirmation, password recovery, invitations, and account notices such as a password change or account deletion) from noreply@bluetrace.net. If your league's Commissioner turns them on, we also send reminder emails before a week's first kickoff when your picks aren't finished or your entry isn't marked paid; you can turn these off for each league in My Profile. If you write to info@bluetrace.net, we keep your message to answer it.

We do not use analytics, advertising, crash-reporting or tracking tools, and we do not build advertising profiles.

How we use information

To create and secure accounts; let players join, switch and leave leagues; run weekly picks, locking, scoring, standings and season totals; record the payments and payouts a Commissioner confirms; send the service email described above; keep an accurate change history for each league; and investigate problems, misuse and security incidents.

Who can see information

• Other members of your league see your display name (your nickname, or your first name), your standings, and your picks once they are revealed under the league's lock rules. They do not see your email, phone or payment handles, except that a Commissioner's email address is shown to their league's members (on Contact your Commish) so players can reach them.
• A league's Commissioner(s), when you ask to join a league from Find a league or by its League ID, see the name and email address you give and any note you add, so they can decide. A league listed in Find a league shows only its name, logo, description and number of players, never who its members are.
• Your league's Commissioners can see and manage member details, payment records, the change log, and picks, including picks before they are revealed to other players (they need this to enter paper sheets).
• Bluetrace, as the platform operator, can access league information to run and support the service.
• Other leagues: membership in one league gives no access to another league's information, even if you belong to both.
• Service providers: Google (Firebase / Google Cloud: hosting, database, file storage for league logos, server functions, and Google sign-in for Commissioners); Resend (service email); Cloudflare (Turnstile: when you sign in, register, start a league, ask for a password reset or ask to join a league, Cloudflare checks that a person rather than a bot is using the form, which means it sees your browser and network address under its own privacy policy); Anthropic (when a Commissioner scans a photo of a paper pick sheet, the photo is sent to Anthropic's Claude to read the picks, name and tiebreaker; we don't keep the photo, only the picks the Commissioner reviews and saves); and Google Fonts (the website loads its fonts from Google). Payment links take you to Venmo, Cash App (Block, Inc.) or PayPal, which handle anything you do there under their own policies.

We do not sell personal information and do not share it for cross-context behavioral advertising.

Where information is stored

In the United States: the database in Google Cloud's US multi-region (nam5), league logo files and server functions in Iowa (us-central1), and service email through Resend in the US (us-east-1).

Your browser's local storage

The website keeps your sign-in session (or a legacy personal-link code) in your browser's local storage so you stay signed in, plus a few display preferences: a Commissioner's selected league, and a marker so a week-winner celebration isn't shown twice. Clearing it signs you out. No cookies are used for tracking.

Security

Passwords are stored only as salted hashes. Sign-in attempts are rate-limited and accounts lock after repeated failures; rate limiting counts requests per network (IP) address in counters that store only a one-way hash of the address, never the address itself. Account-recovery events are logged with a partially masked network address (see Change history). Sessions expire after 60 days of inactivity and end on every other device when you change your password or email. When you choose a password, we check it against Have I Been Pwned's Pwned Passwords service and refuse one that has appeared in a known data breach: only the first five characters of a one-way hash of the password are sent, never the password itself. The sign-in and sign-up forms also check that a person, not a bot, is using them (Cloudflare Turnstile). Browsers never read the database directly; everything goes through our server, which enforces league boundaries. No online service can guarantee absolute security.

Retention

• Your account (email, password hash, sessions, contact details and payment handles) is kept until you delete it (see below). A Commissioner can also remove a member who has never played; if that was their only league, the account is removed too. Members with league history are retired instead, which keeps their history and account.
• League history (picks, tiebreaks, standings, payment status, recorded payouts) is kept for the life of the league, so every member's results and season totals stay accurate.
• The change log is kept for 3 years, then deleted automatically.
• One-time links expire within 30 minutes (password reset), 24 hours (email confirmation) or 7 days (invitations), and are single-use.

Deleting your account and your choices

You can delete your account yourself at any time: sign in, open My Profile, and choose Delete my account (you'll enter your password and type DELETE). Instructions are also at pickem.bluetrace.net/#/delete-account.

Deleting your account immediately erases your sign-in, email address, phone number, payment handles and names, ends every session, and removes you from every league. Your past picks, payment status and recorded payouts remain in your leagues under the label "Former player", without your name, so other members' standings, season totals and payouts stay accurate. Change-log entries about you are rewritten to that label and still expire after 3 years. A league's only Commissioner must make someone else Commissioner first. We send a confirmation to your email address just before it is erased.

You can view and correct your profile in the app at any time. For any other request (a copy of your information, a correction you can't make yourself, or deletion if you can't sign in), email info@bluetrace.net from the address on your account. We may need to verify that the account is yours.

Children

Football Pick'em is not for anyone under 18. We do not knowingly collect information from children; if we learn that an account belongs to someone under 18, we will delete it. Players confirm they are 18 or older when they register.

Changes and contact

We may update this policy as the service changes. We will post the new version here with its effective date and give any additional notice the law requires.

Questions or requests: Bluetrace Entertainment, LLC, info@bluetrace.net.