Privacy notice

1. Who operates the service

This proposed notice concerns pickroom.ai. The operating legal entity, business address, privacy contact, and any legally required representative have not yet been supplied. They must be added before this notice becomes effective.

2. Information you provide

Account creation uses your email address and password through the authentication service. If you choose Google or Lovable sign-in, the sign-in service handles authentication and may supply account identity information according to its own permissions and privacy notice.

The app stores your bankroll and risk settings, goal and period, stop-loss preferences, selected platform connections, and betting records. Betting records may include market, side, stake, price, profit or loss, status, and order identifiers. These records may be self-reported for manual sportsbook and Polymarket bets.

If you use the assistant, the app processes the messages you submit. Do not include passwords, API private keys, payment details, or other sensitive information in assistant conversations.

3. Kalshi credentials and manual platforms

Connecting live Kalshi order assistance submits your API key ID and private key to the server, where they are stored and used to authenticate requests to Kalshi. Saved private keys are not returned to the browser. This draft does not claim a particular encryption-at-rest method or security certification; storage safeguards must be confirmed before launch.

Sportsbooks and Polymarket are manual-link and tracking only. The current tracking flow does not request their login passwords, sync their accounts, or automatically submit bets. Following an external link takes you to a separate provider whose privacy notice applies.

4. How information is used

Information is used to authenticate users, save budget and risk-tolerance settings and tracking records, calculate probability-based suggested stakes and supported risk checks, display AI recommendations, respond to assistant requests, and carry out individually approved Kalshi orders. Operational information may also be processed to diagnose errors and protect the service.

Budget, profit goals and risk tolerance personalize fractional Kelly stake calculations; they do not establish suitability or guarantee wins, fewer losses or returns. Sportsbook betting remains manual regardless of your saved settings.

5. AI processing and service providers

Assistant requests send your supplied conversation messages, selected risk settings, and selected public feed picks to an AI gateway and model provider. Market scanning sends public market details for AI estimates. The current assistant and scanning code does not intentionally include saved Kalshi private keys in these AI requests.

Lovable Cloud provides app hosting, authentication, and data services; Google or Lovable may process optional sign-in; AI services process submitted inputs; and Kalshi receives authenticated requests and approved order details. Provider contracts, subprocessors, processing locations, retention, and any use of AI inputs for training must be reviewed and disclosed before this notice is finalized. This draft makes no promise of zero retention or no training.

6. Session storage and diagnostics

Authentication uses browser session storage mechanisms such as local storage and may use cookies depending on the sign-in flow. External services and font requests may receive technical connection information when your browser contacts them.

The app contains error-reporting hooks that may capture error messages, stack traces, page paths, and context, and server-side errors may be logged. A complete inventory of cookies, analytics, technical data, recipients, and log retention has not yet been confirmed. Any required consent choices must be established before launch.

7. Retention and security

Account data, settings, connections, and trade records are stored to operate the service. Fixed retention periods, backup deletion schedules, log retention, and legal recordkeeping requirements have not yet been defined in this draft; the operator must establish and publish them.

Access restrictions are used for account-specific data, and stored exchange private keys are handled server-side. No system is risk-free. The operator must validate safeguards, access practices, and incident-response procedures rather than treating this notice as evidence of a completed security review.

8. Your choices and privacy requests

You can sign out and remove an individual platform connection in Accounts. Removing a connection does not revoke an API key at Kalshi; revoke it directly at Kalshi if necessary. Removal does not promise erasure from backups, logs, or a third party’s records.

Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of personal information, or object to or restrict certain uses. A working privacy-contact channel, identity-verification process, response deadlines, and account-deletion procedure must be established before launch. There is currently no verified self-service account-deletion flow.

Whether any practices constitute a legal ‘sale’ or ‘sharing,’ require opt-out controls, or trigger additional regional disclosures must be assessed. This draft does not claim that such practices have been comprehensively audited.

9. Age limits, transfers, and updates

The proposed service is intended for adults 21 or older, subject to higher local limits and provider rules. Current account creation alone does not establish a verified age. Procedures for handling information from ineligible minors must be finalized.

Providers may process information in different countries. Actual locations and any required international-transfer safeguards must be confirmed. Material policy changes should carry an updated effective date and any notice or consent required by law.