Who we are

PICKUP ("we", "us") is an app developed by an independent developer based in Spain, who is the data controller for the information described here. You can reach us at the developer contact email shown on PICKUP's Google Play listing.

What we collect

When you use the app

• Account: your display name, email address and, if you sign in with Google, your profile photo. A unique account ID is created by Firebase Authentication.
• What you create: groups, plans, options, candidate dates, your votes, your availability and the invitations you generate.
• Notifications: a push token for your device and the notification preferences you choose.
• Subscriptions: if you buy PICKUP PRO, the product, its status and expiry date, and the Google Play purchase token used to verify it. We never receive your payment card details.

When someone votes as a guest on the web

• The name the guest types, their choices and availability, and a random identifier stored in their browser so they can change their vote.
• A one-way hash of the IP address, used only to limit abuse. It cannot be turned back into the IP address and expires within a day.

When you send a report

• What you write in the report form (the reason, where it happened and the details) and, only if you give it, your email so we can reply. A one-way hash of the IP address limits abuse of the form.

Technical data

• Our hosting provider keeps standard request logs (such as IP address, time and the requested address) to keep the service secure and working.

PICKUP does not include advertising, analytics or tracking SDKs, and does not request your location, contacts, camera or microphone. The photo picker only shares the image you choose.

How we use it

• To provide the service (performance of our contract with you): showing plans to the people in your groups, counting votes, finding the best date, sharing tickets and keeping your devices in sync.
• To send notifications you enable, such as invitations, reminders and confirmations. You can turn each type off in Profile or in your phone's settings.
• To verify purchases with Google Play and unlock PRO features.
• To keep PICKUP safe (our legitimate interest): rate limits, preventing spam votes and investigating misuse.

Who can see your information

• Members of your groups and plans see your name, photo, the availability you share and whether you have voted.
• Your individual ballot is private. Others only see totals, and only when the plan's results setting allows it.
• Organizers can see the names of web guests who voted in their plans.
• Anyone with an invite link can see the plan's title, options, dates and organizer name until the link expires (7 days) or is revoked.

Service providers

We use trusted providers who process data only on our instructions:

• Google Firebase (Google Ireland Ltd / Google LLC): sign-in, database, push notifications.
• Vercel Inc.: hosts PICKUP's API and web pages (functions run in the EU, Frankfurt region).
• Google Play: app distribution and subscription billing.

Some of these providers may process data outside the European Economic Area. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Retention & deletion

• We keep your data while your account exists.
• Delete your account at any time in the app (Profile → Delete account) or on our account deletion page. Deletion happens immediately: your profile, ballots, availability, notifications, push tokens and group memberships are removed, and plans you organize are cancelled.
• Anonymous vote totals that already include your vote may remain in plans that other people still use; they don't identify you.
• Reports are kept only as long as needed to handle them and to meet legal obligations, such as reporting illegal content to the authorities.
• Guest votes stay with the plan they belong to. Abuse-prevention hashes expire within a day. Hosting logs are kept for the provider's short standard retention period.
• Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play.

Your rights

You can ask to access, correct, delete or export your data, and you can object to or restrict how we process it. You can edit your name and delete your account directly in the app. For anything else, contact us at the developer email on our Google Play listing. You also have the right to complain to a data protection authority; in Spain, that is the Agencia Española de Protección de Datos.

Security

Data travels encrypted (HTTPS/TLS). Votes, invitations and memberships can only be changed through our server, which checks who you are and what you're allowed to do. Database rules make sure people only read the groups and plans they belong to. Invitation codes are random, and only their fingerprints are stored.

Children

PICKUP is not directed at children under 14, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We have zero tolerance for child sexual abuse and exploitation. Read our child safety standards and report any concern on our report page.

Changes

If we change this policy, we'll update the date above. If the change is significant, we'll also tell you in the app.