What we don't do, and the audit hooks that prove it.

Free tier always sees 3 SHAP picks per day, posted at the same time as Pro and Elite, on the same Discord channel and the same /picks endpoint. We do not delay free-tier delivery to nudge upgrades. We do not show free-tier users a different pick than Pro users on the same game.

Audit hook: Pick rows in the database have one publish timestamp; the Discord cron post and the /picks endpoint read the same row. /verify-pick exposes the publish timestamp on every pick.

Every capper that meets the published /apply/capper bar appears on /leaderboard sorted by the metric you choose (CLV, ROI, units, follower count). We do not boost or hide cappers based on revenue impact, founder mood, or any other opaque signal. If we ever remove a capper, it goes in the changelog with a date and reason.

Audit hook: /leaderboard query is a single SQL ORDER BY against the public capper_picks aggregation. No allowlist column, no shadow-rank column. Capper removals are logged in /capper-marketplace/changelog.

If we ever flag an account for any reason — TOS violation, suspected automation, payment dispute — the user gets an email within 24 hours stating the specific reason and the appeal path. We do not silently restrict feature access. We do not let a flag persist after the trigger condition resolves.

Audit hook: account_flags table has a (user_id, reason, created_at, resolved_at, notification_sent_at) shape. Notification gate is enforced by a database trigger that blocks flag-insert when notification_sent_at is null past a 24-hour window.

Every picks row gets locked_at = NOW() on insert. A Postgres trigger rejects any UPDATE or DELETE that touches a locked column. Only grading fields (result, graded_at, closing_odds) stay mutable, and those changes are themselves append-only. We cannot quietly re-write history if we wanted to.

Audit hook: Migration 0017 (shipped 2026-04-21) defines picks_immutable_guard. /verify-pick recomputes the SHA-256 hash chain from raw inputs in the browser; if a row had been edited, the hash would not match.

If we change pricing, refund windows, capper marketplace economics, or any user-facing policy, the change goes into the changelog with the old version, the new version, and the date the change takes effect. Existing users keep the policy that was in force when they signed up; we will not retroactively shorten a refund window or change a capper rev split.

Audit hook: /cancel-refund and /capper-marketplace pages each carry a dated changelog. Source markdown lives in repo so the diff is publicly visible on GitHub.

Some operators copy picks from outside sharp accounts and re-post them as house-branded. Our picks come from one of two sources: (a) our XGBoost + SHAP model, hashed at post time; or (b) a capper account on /apply/capper, with hash receipt and capper handle on every pick. We never re-post external picks as model picks.

Audit hook: Every pick row has source ∈ {ai, capper, founder}, and source = capper rows must reference a capper_id with a public profile at /c/[handle]. Source is recorded at insert time and locked.

Each pledge above is reproduced verbatim in the customer-facing terms at /terms section 8 (Product Transparency). If we break one, the public chargeback or dispute process is open to you. We cannot quietly settle by changing the pledge after the fact because the changelog (pledge 05) catches the rewrite.

Audit hook: /terms section 8 mirrors the pledge text verbatim and dates each pledge to its publish day.