Privacy

Your account. Your email address, your display name, and - if you sign in with Google - the avatar picture Google gives us. If you signed up with a password, we store it hashed (bcrypt), never as text. We also keep the date you joined and the date you last signed in. And we store your country as two letters, worked out from your internet address the first time you sign in. It is never more precise than the country, we never store the address itself, and we keep it for one reason: so we know which privacy rules cover most of the people who use PickChill.

Your decisions.The title you give a decision, the options you put in it, any details you add under an option, and every pick you make between them. We keep the picks because they are what lets you replay a decision, undo a step, and see how you reached your top pick. This content is stored so that you can come back to it - it is visible to you, and to anyone you give its link to - see "When you share" below.

Notes you add. A decision or a ranking can carry a free-text note - where a list came from, why you ruled something out, what you are judging by. It is stored with that list and it is private: it is never included when you share a decision, and it is not used for anything else.

Images.A list can hold images instead of text. Before an image leaves your device, your browser makes two smaller copies of it - one about 1,000 pixels on the long side and one about 320 pixels - and only those are sent. Your original file is never uploaded. Making the copies also removes the hidden details a photo file can carry, such as where it was taken and which camera took it. We keep the image's original file name, but we never show it anywhere; it is used only to name the file in your data download. The images are stored with Cloudflare(their R2 storage) and are shown from the address img.pickchill.com. Each image has a long random address with nothing about you or your account in it, so nobody can find one by guessing - but anyone who has an image's address can open it. Cloudflare compares every image it delivers with lists of known child-abuse images (including the list of the US National Center for Missing & Exploited Children) and blocks a match. If that happens, we report it to the authorities, as the law requires. Images you add but never save are deleted after one day. If you are signed in and save someone else's shared image list to your decisions, we make your own copies of its images and keep them in your account, named "Image 1", "Image 2" and so on - never with the original file names. Those copies stay in your account until you delete them, even if the person who shared the list deletes theirs.

When you share.When you open "Share to pick", we save a shared copyof your list as it is at that moment: its title, its options, any details under them, and on an image list, its images and how you cropped them. The link leads to that copy. Anyone who has the link - or the decision's own address from your browser - can open it, go through the options and send you their top pick. That is what the link is for. If you change your list later, the copy does not change; the next time you share, you get a new copy and a new link. If you leave "Preview will show your result" on, the page and its preview picture also show your top pick or your ranking before they pick. If you turn it off, they show only your options. Links you shared before 5 October 2026 now lead to this same page. The links are long and random, so nobody can find one by guessing. The shared page is stripped down first: it never carries your account id, your note, your reminders, or your other lists. It shows all your options, with any details under them, because the people you ask pick from them - and on an image list, all your images, but never their file names. A result it shows never includes options you have not ranked yet. Shared pages are not listed in search engines.

When someone picks from a shared copy, it stays public, even if you later delete the option, the decision or your whole account. People who picked from it may have shared their own result, and those links lead to the same copy. A shared copy nobody picked from is deleted with your decision. A shared copy is deleted 90 days after the last pick, unless it is the newest copy of a decision you still have. Once your decision or account is deleted, a shared copy belongs to no account. To have a shared copy deleted sooner, write to us (see Contact) with any of its links; we delete it within one month, together with every link shared from it.

No name on a shared page.A shared page and its preview picture do not show your name or anything else about your account. A preview picture of a result says "My top pick" or "My ranking", with no name. (Until 5 October 2026 a shared decision showed the name on your account.)

When someone picks for you. When someone runs your list from a link you sent, or from a result someone else shared, we store the one option they picked as their top pick, and whether they came from your own link or a shared result. We do not ask for their name. They stay anonymous - no account, no email, no tracking.

When someone reports an image.Every image on a shared page has a "Report" button. A report stores three things: which image, a random number the reporter's browser made for reports, and the time. It stores no account, no name and no internet address. (We use the internet address only to count reports in our short-lived cache for one day, so one person cannot report the same image again and again. It is never stored with the report.) When three different browsers report the same image, it is hidden at once on the shared page and its preview picture, and the owner of PickChill gets an email. We look at the image, and either delete it or show it again - showing it again deletes its reports. The image stays on your own list while it is hidden. Reports are deleted when their image is deleted.

When you use a paste, a screenshot, a photo or your voice to fill in your options. This is the one place where something you put into PickChill is sent to another company. When you press "Extract", what you gave us - the pasted text, the image, or the recording - together with the list topic you typed, is sent out to be turned into a list of option labels. From text and images it also copies the short description printed next to each option, such as the ingredients under a dish on a menu - it copies only what is there and adds nothing of its own. If you switch on "Translate into" your language, it also translates that description and adds what each option's name means. It works out your language from your browser's language setting, and it sends only that language, never anything else about you. Text and images go to Anthropic. A recording goes first to OpenAI, which writes down what you said, and that text then travels on to Anthropic like any other text. It is used only to produce your list of options, neither company uses it to train their models, and we do not keep the recording once it has been written down. Three things are worth knowing before you use it. First, an image carries whatever else it caught- other people's names, your location, your account details, whatever was behind the thing you photographed - so crop it to just the list where you can. Your camera is only ever opened if you choose it yourself from your phone's own picker, and the picture goes nowhere until you press "Extract". Second, a recording catches whatever else is audible - other people in the room, background conversation. Your microphone is switched on only when you press "Start recording", it stops the moment you press stop or after 30 seconds, and the recording goes nowhere until you press "Extract". Third, we keep the result in our short-lived cache for 30 days, so that sending the same thing again is instant and free; after that it is gone. Options you type, or paste straight into the option rows, are never sent anywhere - that path does not use AI at all.

The demo stays on your device. Anything you do in the demo at /demo lives in your browser's local storage and is never sent to us - unless you create an account, at which point we offer to bring those decisions with you.

We use PostHog to understand how people use PickChill: which features get used, where people get stuck, whether the demo leads anywhere. Our PostHog project runs on PostHog EU Cloud, so the data stays in the European Union.

There are three kinds of thing we measure, and that is the whole of it:

• Which features you use. That a decision or a ranking was created and how many options it had; that a pick was made and which round it was in; that a decision was completed; that you used the tie-helper, an export, a reminder, or a link that lets others pick; that you signed up, and whether by email or Google. These carry counts, yes/no flags and fixed labels only - a number of options, a round number, the word "png". Never what the decision or the ranking was about.
• Which pages you visit. The address of each page you open in the app, where you arrived from, and how far down you scrolled. The address of a decision or ranking page contains that page's id - a random string like 1eb7dde0-c26a - never its title.
• Your device, and roughly where you are. Your browser and operating system, screen size, language and time zone, and an approximate location worked out from your IP address - country, region, city and postal district. This is the standard web-analytics picture: it tells us which devices to build for and which countries people are in. We do not use it to locate you, and we never combine it with what you are deciding.

The first of those is the one that could have carried your words, and it cannot: the rule that an event may hold counts, yes/no flags and fixed labels only is enforced in our code, so an event that tried to carry your text would not build.

What we deliberately do not do:

• No session recording. We do not replay your screen. Ever.
• No autocapture. Many analytics setups hoover up the text of everything you click. That would scrape your option labels straight off the page, so it is switched off - both in the code and on the PostHog project itself.
• No decision content. Titles, notes, option labels, images and their file names never leave your device for our analytics.
• No advertising networks, no data brokers, no cross-site tracking.

There are two modes, depending on whether you are signed in:

• Signed out - analytics runs in cookieless mode. It writes nothing at all to your device: no cookie, no id, nothing to carry you between visits.
• Signed in - we already know who you are from your session cookie, so events are attached to your account id, and so is the device and approximate-location picture described above. Even then, analytics stores nothing on your device; the id is handed to it fresh on each page load and forgotten when you close the tab.

We only set cookies the app cannot work without - which is why you have never been asked to accept any. They keep you signed in, protect the sign-in and sign-up forms so that nobody can submit them on your behalf, carry you safely through the trip to Google and back if you sign in that way, and remember where to send you afterwards. A couple more live for two minutes around signing up or signing out, so we can welcome you properly and leave the demo clean for the next person on the device.

There are no advertising cookies, no analytics cookies and no third-party trackers. Our analytics writes nothing to your device at all.

Your browser also keeps a few things locally that are never sent to us: everything you make in the demo, whether you prefer light or dark, a note of which button you last signed in with, and - if you run a list from a link - your progress through it, so that a reload does not lose your place. Only your top pick goes back, with a random number made for that one run, so a reload does not count it twice. The number says nothing about you. If you report an image, your browser keeps one more random number, used for all your reports, so that reporting the same image twice counts once. It is sent with each report and says nothing about you either.

We email you when you ask us to: a password reset link when you request one, and a reminder about a decision when you set one. Reset links expire after an hour. Those emails are part of the service, so they always arrive.

Emails about the app itself - news about new features, and tips - are a separate thing, and we only send them if you say yes. We ask once, on a small bar on your home page, after you have finished a decision. You can ignore the question and it will come back. If you say no, we never ask again and we never send them. If you say yes, every one of those emails has an unsubscribe link, and you can turn them off at any time on your profile page.

When you answer, we store the answer, the date, where we asked you, and a copy of the exact words you read. We keep that so we can show what you agreed to. We never give your email address to anyone else for their own marketing.

PickChill runs on a handful of outside services, and we keep that number small on purpose. Each one is there to run a piece of the app for us: hosting, the database your account and decisions live in, a short-lived cache, and an email service (which sends the password-reset and reminder emails, and carries anything you write to us). Analytics is PostHog, on their EU cloud, as described above. And if - and only if - you pick "Continue with Google", Google tells us your email address, name and avatar, and nothing more.

Two more, and only when you ask for them: Anthropicreads the text, screenshot or photo you hand to "Extract" and hands back the list of options, and OpenAI writes down what you said if you use a recording - both as described above. Nothing is sent to either unless you press that button, and nothing else in your account is ever sent - not your other decisions, not your picks, not your email.

If you make an image list, Cloudflare stores its images and delivers them, and checks them against lists of known child-abuse images, as described above. It stores the images only for us, and gets nothing else from your account.

When you have a decision open, Ably tells your browser that someone has just made a pick on your shared link, so the count updates without a reload. Ably gets only a random number for the decision and a signal with nothing in it - never the options, the pick, a name or your email.

If you buy the one-time unlock, the payment is handled by Paddle, who are the seller for that purchase. You give them your payment details and billing country directly - those go to them, never to us, and we never see your card. They tell us only that a payment was made and give it a reference number, and that reference and the date are all we keep. If you never buy anything, none of this applies to you.

None of them is given your data for their own purposes, none of them may use it for advertising, and we never sell it - not to them, and not to anyone else. If you want to know exactly who they are, ask us and we will tell you.

Some of your data leaves the EU. A few of the services above are run by companies based outside the European Union, so some of your data is processed outside it. Where that happens, it is covered by the standard data-protection terms the EU provides for exactly this - the standard contractual clauses - and it is still only ever used to run PickChill, never for anything of their own.

PickChill is a small business. One day it could be sold, or joined with another company. If that happens, accounts and the data described on this page move to the new owner along with the app.

Two things do not change. The new owner takes your data under this same policy: they cannot start using it for something you never agreed to, and they cannot sell it on. And we will tell you by email before it happens, so you have time to download your data or delete your account first.

This is a different thing from selling your data, which is what the rest of this page rules out. Selling the business is not a way around that promise - the promise travels with the data.

Your account and your decisions are kept until you delete them.

When you delete a decision it goes out of the app straight away - but we keep a copy of it for up to 30 minutes, so that the Undo can put it back. After that the copy expires on its own and the decision is gone for good. The Undo itself is only offered for a few seconds, in the bar that appears when you delete: once that bar goes, so does your way back.

Imagesfollow the same rule. When you delete an image list, its images are deleted between 25 and 30 minutes later, so the Undo can still show them - never after the copy has expired. When you delete one image from a list, or delete your account, the images are deleted within 5 minutes. An image that a shared copy with a pick still shows is kept until that shared copy is deleted (see "When you share"). Cloudflare can still show a deleted image for up to 4 hours to someone who opened its address before, from a temporary copy it keeps to load images faster. Images you add but never save are deleted after one day.

Analytics events are kept by PostHog under their standard retention.

You can delete any decision from the app at any time. You can delete your whole account from your profile page. That removes your account and everything attached to it - your decisions, your options, your picks, and the shared copies nobody picked from - immediately and for good, and your images within 5 minutes (see above). Shared copies that someone picked from stay public, belonging to no account, until they expire or you ask us to delete them (see "When you share"). There is no soft-delete and no grace period, so please be sure.

You can take a copy of everything you have made here at any time, without asking us. Your profile page has a download button that gives you a zip file: every decision with its options, its comparisons and your picks, every ranking in order, any notes you added, and the images of your image lists, in a folder for each list.

If you are in the UK or the EU, you also have the right to have your data corrected, or to object to how we use it. Email us and we will sort it out.

Passwords are hashed with bcrypt. Password-reset links are stored hashed, so even we cannot read them. Traffic is served over HTTPS only, and every request for a decision is re-checked against its owner before anything is returned.

If we change what we collect, we will change this page and update the date at the top. If we ever want to store something on your device that is not strictly necessary, we will ask you first - properly, with a real choice.

Questions, requests, or something here that does not look right: privacy@pickchill.com.