Privacy Policy
Effective August 16, 2026 · Policy version 2026-08-16.v2
WON Recruit ("we," "us") is a recruiting outreach platform operated by World of NIL, Inc. This policy explains what information we collect, how we use it, how we protect it, and the choices you have.
Information we collect
- Account information: email address, password (stored as a secure hash by our authentication provider), and whether the account holder is a parent/guardian or an athlete.
- Athlete profile information:name, date of birth, graduation year, grade level, sport, position, physical and academic details, school and club affiliations, contact details, and highlight/social links — entered by you to power recruiting outreach.
- Consent records: we keep an append-only log of consent events (terms acceptance, privacy acceptance, parental consent, and Gmail authorization), including timestamps, to meet our legal obligations.
- Payment information: processed by Stripe. We never see or store full card numbers.
Google user data
WON Recruit lets athletes connect their own Gmail account so that recruiting emails send from the athlete's own inbox. When you connect Gmail, we request only the gmail.send permission — the ability to send email on your behalf. We do not request or receive access to read your inbox, contacts, or any other Gmail data.
We use this permission solely to send the recruiting emails you compose and approve inside WON Recruit. The Google OAuth refresh and access tokens issued to us are encrypted at rest using AES-256-GCM, with encryption keys stored separately from the encrypted data, and are never shared. You can revoke this access at any time from your Google Account security settings, and revocation takes effect immediately and deletes the stored tokens.
WON Recruit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Because WON Recruit uses a send-only permission and never reads mailbox contents, no Google user data is retained, aggregated, transferred to third parties, or used to develop, improve, or train any generalized or foundational artificial intelligence or machine-learning model.
Data protection and security
We apply technical and organizational safeguards designed to protect your information, including sensitive data such as authentication tokens and the personal details of minor athletes.
- Encryption in transit: all data exchanged between your browser, WON Recruit, and our service providers is encrypted using TLS 1.2 or higher (HTTPS).
- Encryption at rest: sensitive credentials, including Google OAuth tokens, are encrypted at rest using AES-256-GCM. Encryption keys are stored separately from the encrypted data and are not accessible to end users.
- Access controls: application data is stored in an access-controlled PostgreSQL database protected by row-level security, so each account can access only its own records. Administrative and service credentials are restricted to authorized personnel and are never exposed to the browser.
- Data minimization: we request only the narrowest permissions a feature requires. For Gmail, we request send-only access and never request read, modify, or delete permissions.
- Revocation and deletion: disconnecting a connected Google account, or revoking access in your Google Account settings, immediately deletes the stored OAuth tokens and ends our access.
Artificial intelligence
WON Recruit uses artificial-intelligence features to help athletes draft and refine their recruiting messages. These features operate only on information you provide to WON Recruit — such as your athletic profile, statistics, target schools, and the message text you choose to write.
Because we use a send-only Gmail permission and never read your mailbox, no Google Workspace user data (raw, aggregated, or derived) is ever processed by, transferred to, or used to train any artificial intelligence or machine-learning model. Where we use third-party AI services to power drafting assistance, we do so under business terms that prohibit those providers from training their models on our inputs or outputs. We do not sell your data, and we do not use it, or any AI-derived output from it, for advertising.
Children and minors
WON Recruit serves student-athletes entering 9th grade and above. For any athlete under 18, we require documented parent or guardian consent before coach outreach can begin, and we record that consent in our audit log. We do not knowingly collect information from children under 13.
How we share information
We never sell your information. Athlete profile information is shared with the college coaches you (or your athlete, with your consent) choose to contact — that is the product. We use service providers to operate the platform: Supabase (database and authentication), Stripe (payments), Vercel (hosting), Google (Gmail sending, at your direction), and third-party AI providers used solely to power drafting assistance. Each processes data only as needed to provide their service, and our AI providers are contractually prohibited from training their models on our data.
Retention and deletion
We retain your information while your account is active. You may request deletion of your account and associated data by contacting us; consent records may be retained where required for legal compliance.
Contact
Questions about this policy: support.wonrecruit@gmail.com.