Privacy Policy
- Version 2026-10-22.1
- Effective 22 October 2026
On this page
This policy explains what personal data Pick Of The Day (the "App") collects, why we collect it, who we share it with, and the choices and rights you have.
1. Who we are
The controller of your personal data is Edouard Munck, doing business as GOTD, based in the United States ("GOTD", "we", "us"). Privacy contact, including data protection requests: privacy@pickoftheday.app. General support: support@pickoftheday.app.
We have no establishment in the European Union or the United Kingdom, and the App is not currently offered on the App Store in the European Union, the European Economic Area or the United Kingdom. If we offer it there, we will appoint the representatives that data protection law requires and name them in this policy before then.
2. What we collect
| Category | What exactly | Source |
|---|---|---|
| Account identifiers | A user ID created by Firebase Authentication, and the stable user identifier that Sign in with Apple provides. | You, when you sign in |
| Contact details | Your email address (possibly an Apple "Hide My Email" relay address) and your name, only if you choose to share them with Sign in with Apple. They are stored by our authentication provider. | Apple, with your permission |
| Profile | The username you choose. | You |
| Group activity | The groups you create or join, group names, the daily items you are shown, your scores and votes, your nominees, your "of the day" picks, your emoji, and when you did these things. Group members can see this activity. | You |
| Invites | The invite codes you generate, and when they expire. | You |
| Device and push data | An app-specific device identifier (Apple's "identifier for vendor"), a push-notification token, your device model, the app version, and the date of the last update. | Your device |
| Subscription data | Whether you have Premium, which is linked to your Pick Of The Day account only. To confirm it, we keep a record of each subscription that Apple sends us: an app account token derived from your user ID (it links the purchase to your account), the App Store original and latest transaction identifiers, the plan (weekly, monthly or yearly) and the plan you will renew to, whether automatic renewal is on, any offer used (free trial, introductory, promotional, offer code or win-back) and its identifier, the subscription status (active, in a billing grace period, billing problem, expired, or refunded or revoked, with Apple's reason code), the expiry and grace-period dates, and whether the purchase was real or a test. Apple sends us notices when your subscription starts, renews, changes, fails to renew, expires or is refunded (App Store Server Notifications); we keep the ID and type of each notice we processed. Apple processes your payment; we never receive your card or bank details, your name or your Apple Account email from the purchase. | Apple (App Store), your device |
| Advertising data | If you do not have premium: ad interactions, an approximate location inferred from your IP address, and, only if you allow tracking through Apple's App Tracking Transparency prompt, your device's advertising identifier (IDFA). Collected by Google AdMob. | Your device / Google |
| Crash reports | When the App crashes: the stack trace, device model, OS and app version, free memory and disk space, orientation, and a random installation identifier. We do not attach your user ID or username. Collected automatically; the App does not yet have a setting to turn it off (one is planned). | Your device (Firebase Crashlytics) |
| Performance data | App start time, screen rendering, and the timing of network requests (the address that was called, response time, payload size). Not linked to your user ID or username. Collected automatically; the App does not yet have a setting to turn it off (one is planned). | Your device (Firebase Performance Monitoring) |
| Data export files | A copy of your data that you ask for in the App. | Generated by us on request |
| Support messages | What you send us by email. The support email pre-fills your app version and OS version. | You |
We do not collect your phone number, contacts, photos, precise location or payment card details.
3. Why we use it, and our legal bases (EEA/UK users)
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account, groups, invites and daily items | Identifiers, profile, group activity, invites | Performance of our contract with you, Art. 6(1)(b) |
| Sending notifications you rely on (new items, a friend's pick) | Device and push data, username shown to group members | Contract, Art. 6(1)(b) |
| Keeping the App working and secure: fixing crashes, testing, maintaining and securing the service, preventing abuse | Crash reports, identifiers, and pseudonymized subsets of group activity in our test environment | Legitimate interests, Art. 6(1)(f): a reliable and secure service. |
| Understanding how fast the App is, so we can improve it | Performance data | Legitimate interests, Art. 6(1)(f): a fast and reliable App. The data is not linked to your account. |
| Providing Premium: confirming your subscription with Apple, letting you create unlimited groups and giving you an ad-free experience, restoring purchases, handling offers, renewals, plan changes, billing problems, refunds, cancellations and support | Subscription data | Contract, Art. 6(1)(b) |
| Showing a Premium mark on your emoji to the members of your groups | Whether you have Premium (yes or no only) | Legitimate interests, Art. 6(1)(f): letting group members see who supports the App and making Premium known, with little impact on you because nothing about your plan, price or payment is shown. You can object at any time by emailing privacy@pickoftheday.app. |
| Keeping proof of your subscription and of the renewal terms you agreed to, handling refund and billing disputes, and preventing fraud | A minimal purchase record (see §6) | Legitimate interests, Art. 6(1)(f), and legal obligation, Art. 6(1)(c), where consumer-protection law requires us to keep this proof |
| Counting subscription starts, trial conversions, renewals and cancellations | Subscription events without your user ID or transaction identifiers | Legitimate interests, Art. 6(1)(f): understanding how Premium performs. |
| Showing ads to non-premium users | Advertising data | Consent (Art. 6(1)(a)) for personalized ads, and for storing or accessing information on your device where the law requires it. Otherwise, legitimate interests for non-personalized ads. |
| Answering your requests to access or export your data | Data export files | Legal obligation, Art. 6(1)(c) |
| Answering support requests | Support messages | Legitimate interests / contract |
| Meeting legal obligations | As needed | Legal obligation, Art. 6(1)(c) |
Testing. To test new versions without risk to real users, we may copy a small, pseudonymized subset of group activity into a separate test environment. Before the copy, names, usernames, group titles, contact details, Apple identifiers, device identifiers and push tokens are removed or replaced. Test copies are deleted within 30 days.
4. Who we share it with
We do not sell your personal data for money. We share it with:
- Google (Firebase). Authentication, database, cloud functions, file storage, push messaging, Crashlytics, Performance Monitoring and Remote Config. Google acts as our processor.
- Google AdMob and its ad partners, when ads are shown (see Premium and ads below). When you consent, Google may act as an independent controller for personalized advertising. See Google's privacy policy and how Google uses data from partner apps.
- Apple, for Sign in with Apple, push notifications, and Premium purchases. Apple sells the subscription and processes App Store payments as an independent controller, under its own privacy policy. To confirm your subscription, we send Apple the transaction identifiers it gave us (App Store Server API), and Apple sends us notices about your subscription (§2).
- Other members of your groups, who see your username, emoji, picks, votes and activity in that group. If you have Premium, they can see a Premium mark on your emoji wherever it appears in that group (for example the member switcher, picks, history and member lists), so they know that you are a subscriber; the mark disappears when your Premium ends. They do not see your plan, whether you are on a trial or an offer, the price you paid, or your payment or App Store details. Your Premium does not change anything for them: it does not remove their ads or their group-creation limit.
- GIPHY (GIPHY, Inc., USA), if the App shows you GIFs from GIPHY. Those GIFs load directly from GIPHY's content delivery network: when one loads, GIPHY receives your IP address and device data (such as device type, operating system and app information sent with the request). GIPHY processes this data under its own privacy policy.
- Other content providers (for example joke and recipe databases) receive no data about you: we fetch their content on our servers, and the App does not contact them.
- Authorities, when the law requires it.
Premium and ads. Premium is personal: it only affects ads for the subscriber, not for other members of their groups. If you have Premium when you open the App, we do not start Google's ad SDK: you are not shown the ad-consent form or the tracking prompt, no ads are requested, and no advertising data is shared with Google AdMob for you. If Premium starts during a session in which the ad SDK has already started, no more ads are requested and none are shown to you; the SDK itself stays started until you close the App, and it is not started the next time you open it.
US state law notice (CCPA/CPRA and similar laws). Using advertising data for personalized ads may count as "selling" or "sharing" personal information for cross-context behavioural advertising. You can limit this at any time; see §7.
5. International transfers
Our providers may process data outside your country, including in the United States. For transfers out of the EEA/UK, we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses.
6. How long we keep it
We keep personal data only as long as we need it for the purposes above.
| Data | How long we keep it | What happens then |
|---|---|---|
| Account and profile | As long as your account exists | Deleted when you delete your account, or after inactivity (below) |
| Deleted accounts | Deleted immediately when you delete your account in the App. This cannot be undone. | Erased, except the minimal purchase record described below |
| Backups | 7 days at most | Backup copies expire. If we ever restore a backup, we delete again any account that was deleted in the meantime. |
| Inactive accounts | 24 months without signing in | We notify you and delete the account 30 days later unless you sign in |
| Group activity (votes, scores, nominees, picks, emoji) | While you are a member of the group, and at most 24 months per daily round | Older rounds are deleted. Your activity is removed when you leave or delete your account. Groups that are empty or unused for 12 months are deleted. |
| Subscription data | While your account exists. When you delete your account, we delete your subscription records and the link between your account and your purchases, except a minimal purchase record: the App Store original transaction ID, the plan, the purchase, expiry and any refund dates, and whether the purchase was real or a test. It contains no user ID, username or email. We keep it for 3 years after the subscription ends, as proof of the purchase and for refund and billing disputes. | Deleted. Apple keeps its own payment records. |
| Records of Apple's subscription notices | 90 days | Deleted |
| Invite codes | 7 days | Deleted when they expire or are replaced |
| Push tokens and device data | Until you sign out, or 6 months without use | Removed |
| Data export files | 24 hours | The download link expires and the file is deleted |
| Server logs | 30 days | Deleted |
| Crash reports (Crashlytics) | 90 days | Deleted by Firebase |
| Performance data | 30 days (IP-related events) and 60 days (other data) | Deleted by Firebase |
| Support emails | 12 months after our last exchange | Deleted |
| Test-environment copies | 30 days | Deleted |
7. Your choices and rights
- Delete your account in the App: Account › Delete account. This deletes your profile, your group memberships and activity, and your login. You can also email privacy@pickoftheday.app. Your account is erased at once, and this cannot be undone (§6). Other members' copies of shared group items that do not identify you may remain. Deleting your account does not cancel your Premium subscription: cancel it first in Settings › [your name] › Subscriptions, or Apple will keep charging you.
- Crash reports and performance data. The App does not yet have a setting to turn these off; we plan to add one. They are not linked to your account.
- Ads and tracking. If you do not allow tracking when iOS asks, or you turn it off later in iOS Settings › Privacy & Security › Tracking, your device's advertising identifier is not shared with Google. Where the law requires an ad-consent choice in your region, the App shows the consent form and an Account › Privacy choices option to change your choice. Premium users see no ads, and they are covered by Premium and ads in §4.
- Opting out of "sharing" (US). You can limit advertising use of your data by not allowing tracking (above) and, where it is shown, through Account › Privacy choices. You can also email privacy@pickoftheday.app.
- Notifications can be turned off in iOS Settings.
Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent at any time. Withdrawing consent does not affect processing that happened before. To exercise these rights, email privacy@pickoftheday.app to access or export your data, and use the App: Account › Delete account to delete it, and, where it is shown, Account › Privacy choices to withdraw ad consent. You can also email privacy@pickoftheday.app for any of these requests, including correction, objection and restriction. We answer within one month (EEA/UK) or 45 days (California). We will not discriminate against you for exercising your rights.
You may also complain to a data protection authority. Because we have no establishment in the EU, there is no "lead" authority: if you live in the EU or EEA, you can complain to the authority in the country where you live or work, or where you think the infringement happened (a list is at edpb.europa.eu). In the UK, you can complain to the Information Commissioner's Office (ico.org.uk). In Switzerland, you can complain to the Federal Data Protection and Information Commissioner (FDPIC).
8. Children
You must be at least 16 to use the App if you live in the European Economic Area, and at least 13 elsewhere (or older, if the law of your country sets a higher age of digital consent). We do not knowingly collect data from children below these ages. If you believe a child has given us data, contact privacy@pickoftheday.app and we will delete it.
9. Security
Data is encrypted in transit and stored with Google Cloud. Access is limited to people who need it, and our test environment cannot write to production data. No method of storage is perfectly secure.
10. Changes
Each version of this policy has a version number, an effective date and a summary of changes. The current version is at https://pickoftheday.app/privacy, and earlier versions stay available at https://pickoftheday.app/privacy/<version>. We classify every change as material or minor:
- Material changes, for example a new purpose, a new category of data or of recipient, or a longer retention period, are shown to you in the App before they apply, and you must acknowledge them to continue using the App. Where the law requires your consent for the change, we ask for it separately.
- Minor changes, such as clarifications, corrections or new contact details, are announced in an in-App notice and apply from their effective date.
We may also send a push notification if you have allowed notifications.
11. Contact
Edouard Munck, doing business as GOTD, United States. Privacy questions and requests: privacy@pickoftheday.app. General support: support@pickoftheday.app.