PRIVACY POLICY

We collect the minimum data needed to run the Service:

• Account: email address, bcrypt-hashed password, account creation date.
• Payment: processed entirely by Stripe. We do NOT store card numbers or CVCs. We store a Stripe customer ID, subscription status, and renewal date only.
• Usage: which picks you save to "My Picks" (tied to your account), page views for anonymous analytics, and basic server logs (IP address, browser type, timestamps).
• Cookies: a single httpOnly cookie (access_token) used to keep you signed in. No third-party ad tracking cookies.

• Government IDs or social security numbers
• Bank account or credit card details (Stripe holds these)
• Location data beyond what your IP address reveals
• Contact lists, photos, microphone, or camera data

• To authenticate you and keep your account secure.
• To process your subscription (via Stripe).
• To personalize the "My Picks" watchlist feature.
• To send transactional email (receipts, password resets, subscription changes). We do NOT send marketing email unless you opt in.
• To operate and improve the Service (anonymous aggregate analytics only).
• To comply with legal obligations (e.g., tax records for Stripe payouts).

We share data only with the service providers required to operate:

• Stripe — payment processing. See Stripe's Privacy Policy.
• MongoDB Atlas — encrypted database hosting.
• Emergent Cloud — application hosting on Kubernetes.

We never sell your personal data. We do not share it with advertisers, data brokers, or affiliates.

We may disclose data if legally compelled by a valid court order, subpoena, or law enforcement request from a jurisdiction with authority over us.

Account and subscription data is retained while your account is active and for up to 24 months after cancellation for tax/audit purposes. Ephemeral data (pick_results TTL, server logs) is auto-deleted after 48 hours to 30 days.

Depending on your jurisdiction (GDPR, CCPA, PIPEDA, etc.), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable format
• Opt out of any non-essential processing

To exercise these rights, email privacy@gppicks.com. We respond within 30 days.

We use industry-standard measures — bcrypt password hashing, JWT with short expirations, httpOnly cookies, TLS everywhere, and encrypted database at rest — to protect your data. No system is 100% secure. If we ever detect a breach that affects you, we will notify you within 72 hours as required by applicable law.

The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If we learn we have collected data from a minor, we will delete it immediately.

Our infrastructure is hosted in North America. If you access the Service from outside North America, your data will be transferred to and processed in North America under the safeguards described in this Policy.

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated "Last updated" date and, for existing subscribers, an email notification.

Questions about this Policy or your data? Message us on Instagram: @gppickdotcom.