Privacy Policy

Who we are and what this covers

Pickster ("we", "us") operates the Pickster mobile app (iOS and Android) and pickster.app (the "Services") — private pick'em pools for the NFL and major soccer competitions. This policy explains what personal data we collect, why, who processes it for us, and the rights you have over it. It applies to the app, the website, and our emails.

If anything here is unclear, or you want to exercise any right described below, write to privacy@pickster.app.

Information we collect

Account: first name, last name, display name, email address, and an optional profile picture, collected when you sign up (with email/password or via Google or Apple sign-in).

Gameplay: your pools, picks, scores, standings, and optional bonus predictions.

Chat: messages, reactions, and images you post in your pool's chat.

Purchases: if you upgrade a pool, our billing partners process the transaction — we receive purchase records (product, date, store transaction identifiers) but never your card details.

Device and usage: push-notification tokens, app version, and diagnostic data (crashes, performance) and analytics events about how the app and website are used.

Messages to us: support requests and contact-form submissions, and — if you opt in on the website — your email address for league-launch notifications.

Pool entry fees and payouts, where pool organizers use them, are arranged between members outside Pickster: we let organizers TRACK amounts, but we never collect, hold, or process the money.

How we use it — and our legal bases

To run the Services (contract): accounts, pools, picks, standings, chat, purchases, and support.

To notify you (contract / legitimate interest): push notifications and transactional emails about your pools — invites, results, deadlines. You can turn push notifications off in your device settings.

To improve the Services (legitimate interest / consent): aggregated analytics and crash diagnostics. Website analytics only run if you accept them in the cookie banner (consent).

To market to you (consent): the league-notification emails you opt into on the website. Every marketing email includes an unsubscribe link.

We do not sell your personal data, and we do not use it for third-party advertising.

Who processes data for us

We use a small set of service providers, each bound by data-processing terms:

• Google Firebase (authentication, file storage, push notifications, analytics, crash reporting) — Google LLC, USA
• Apple and Google Play (sign-in and in-app purchases on their platforms)
• RevenueCat (purchase management) — USA
• Stream (chat infrastructure for pools created before mid-2026) — USA
• Loop Chat (chat infrastructure for newer pools) — The Loop
• Resend (email delivery) — USA
• Railway (database hosting) and Vercel (website hosting) — USA
• Google reCAPTCHA (spam protection on website forms) and Google Analytics (website analytics, only with your consent)

Sports schedules and results come from licensed sports-data providers and involve no personal data.

International transfers

Our providers process data primarily in the United States. Where data of users in the European Union, United Kingdom, or other regions with transfer rules is processed there, our providers rely on recognized safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

How long we keep it

Account and gameplay data: for as long as your account exists. Deleting your account removes your personal data from our systems (chat providers and processors delete on their own short schedules).

Chat messages: for the life of the pool they belong to; deleting a pool removes its channel.

Purchase records: kept as long as required for accounting and tax obligations.

Diagnostic and analytics data: retained by the respective providers for their standard rolling windows, then aggregated or deleted.

Your rights

Depending on where you live (including the EU/UK under the GDPR, Argentina, and Ecuador), you can:

• Access a copy of the personal data we hold about you
• Correct inaccurate data (name and picture can be edited in the app)
• Delete your account and data — directly in the app (Profile → Settings → Delete Account) or via the Account Deletion page on this website
• Receive your data in a portable format
• Object to or restrict certain processing, and withdraw consent at any time (e.g. unsubscribe, or decline analytics cookies)

To exercise any of these, use the in-app options or email privacy@pickster.app — we respond within 30 days. EU/UK residents also have the right to complain to their local data-protection authority.

Cookies and website analytics

The website uses one essential cookie for your language choice, one to remember your cookie decision, and — only if you accept — Google Analytics. Details, including how to change your choice at any time, are in our Cookie Policy (linked in the footer).

Children

Pickster is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has created an account, contact us at privacy@pickster.app and we will delete it.

Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to production systems is restricted to the small Pickster team. If a breach ever affects your personal data, we will notify you and the relevant authorities as required by law (including within 72 hours where the GDPR applies).

Changes to this policy

When we make material changes we will update the effective date above and, for significant changes, notify you in the app or by email. Continued use of the Services after a change means the updated policy applies.

Contact

Privacy questions and requests: privacy@pickster.app General support: the in-app Contact Us form or the contact page on this website.