Privacy Policy.

Information we collect

We collect the name, email address, leaderboard handle, age and residency eligibility confirmation, and Verona account address that you provide during registration.

If you choose to connect WHOOP, we request the minimum permissions needed to read your WHOOP workout activities and maintain that connection. This may include workout identifiers, sport or activity type, workout start and end times, workout status, and kilojoule or calorie values. We do not request WHOOP sleep, recovery, cycle, body-measurement, or profile scopes.

We also receive technical information needed to operate and secure the Campaign, such as browser and device information, IP address, request timestamps, and security logs.

How we use information

We use registration information to administer eligibility, associate a proof with its participant, operate the leaderboard and prize draw, prevent fraud and duplicate entries, communicate about the Campaign, provide support, and comply with legal obligations.

We use WHOOP workout data only to identify eligible tennis activities within the Campaign window, calculate the qualifying calorie total and session count, generate or validate the Campaign proof, and refresh your leaderboard position when you ask us to re-sync.

We do not sell WHOOP data, use it for advertising, or use it to make medical, employment, insurance, credit, or other eligibility decisions unrelated to this Campaign.

What appears publicly

Your chosen handle, verified aggregate tennis-calorie total, qualifying session count, rank, and proof reference may appear on the public leaderboard. Your legal name, email address, WHOOP credentials, OAuth tokens, individual workout records, and other private WHOOP data are not displayed publicly.

A proof or transaction written to a public blockchain may be permanent. We design the proof not to include your email address, legal name, WHOOP credentials, or raw workout records. Public blockchain records generally cannot be deleted.

How information is shared

We share information only with service providers that help us host, secure, verify, and operate the Campaign; when you direct or consent to the sharing; when required by law; or when reasonably necessary to protect participants, the Campaign, and our rights. Service providers may process information only to provide their contracted services and must protect it appropriately.

WHOOP is an independent service. Information held by WHOOP remains subject to the WHOOP Privacy Principles. WHOOP does not sponsor or administer this Campaign unless expressly stated in the official Campaign rules.

OAuth tokens and security

You enter WHOOP credentials only on WHOOP’s authorization service. We do not receive or store your WHOOP password. Access and refresh tokens are kept server-side, encrypted in transit and at rest, restricted to authorized systems, and never placed in client-side code or the public proof.

No system is completely secure. We use reasonable administrative, technical, and organizational safeguards and will provide legally required notices if a security incident affects your information.

Retention and deletion

We retain registration and Campaign records only for as long as needed to operate the Campaign, award and document the prize, resolve disputes, prevent fraud, and meet legal obligations. We retain WHOOP OAuth tokens and private WHOOP-derived workout data only while your connection is active and they are needed for the Campaign, then delete or de-identify them, subject to limited security backups and legal requirements.

You may withdraw WHOOP access at any time through your WHOOP account’s connected-app settings. When access is withdrawn, we stop collecting new WHOOP data and revoke or delete the stored connection credentials. You may also contact us to request access to or deletion of Campaign information. Deletion cannot remove information that must be retained by law or an already-published public blockchain record.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, and to appeal a privacy decision. You may exercise those rights without discriminatory treatment. We may need to verify your identity before completing a request.

The Campaign is intended only for people aged 18 or older and is not directed to children.

Contact and support

For privacy requests, WHOOP-connection deletion, or Campaign support, email hello@builtonverona.com. Please include “US Open Campaign Privacy” in the subject line and do not send health data or passwords by email.

Changes to this policy

We may update this policy as the Campaign or applicable requirements change. We will post the revised version here and update the effective date. Material changes will be communicated where required by law.