Privacy

Your account. Your email address, your display name, and - if you sign in with Google - the avatar picture Google gives us. If you signed up with a password, we store it hashed (bcrypt), never as text. We also keep the date you joined and the date you last signed in. And we store your country as two letters, worked out from your internet address the first time you sign in. It is never more precise than the country, we never store the address itself, and we keep it for one reason: so we know which privacy rules cover most of the people who use PickChill.

Your decisions. The title you give a decision, the options you put in it, and every pick you make between them. We keep the picks because they are what lets you replay a decision, undo a step, and see how you reached your top pick. This content is stored so that you can come back to it - it is visible to you, and not to anyone else, unless you choose to share it.

Notes you add. A decision or a ranking can carry a free-text note - where a list came from, why you ruled something out, what you are judging by. It is stored with that list and it is private: it is never included when you share a decision or a ranking, or send a decision to someone to compare, and it is not used for anything else.

When you share. If you turn on a share link for a decision or a ranking, or send someone a decision to compare, that decision or ranking becomes readable by anyone holding the link - that is what the link is for. The shared copy is stripped down first: it never carries your account id, your note, your reminders, or your other lists, and a shared ranking does not show anything still waiting to be ranked. Shared pages are not listed in search engines. You can turn a link off at any time, which stops it working.

The name on a shared page. A shared decision or ranking shows who made it. It uses your account name unless you change it, and you can set it to anything you like in the share panel, or clear it, in which case the page shows no name at all. The name also appears on the small preview picture that chat apps and social sites build from the link. Nothing else about your account appears there.

When someone picks for you. If a friend follows your compare link, we store the name they type in and the single option they picked. They stay anonymous otherwise - no account, no email, no tracking.

When you use a paste, a screenshot, a photo or your voice to fill in your options. This is the one place where something you put into PickChill is sent to another company. When you press "Extract options", what you gave us - the pasted text, the image, or the recording - together with the list topic you typed, is sent out to be turned into a list of option labels. Text and images go to Anthropic. A recording goes first to OpenAI, which writes down what you said, and that text then travels on to Anthropic like any other text. It is used only to produce your list of options, neither company uses it to train their models, and we do not keep the recording once it has been written down. Three things are worth knowing before you use it. First, an image carries whatever else it caught- other people's names, your location, your account details, whatever was behind the thing you photographed - so crop it to just the list where you can. Your camera is only ever opened if you choose it yourself from your phone's own picker, and the picture goes nowhere until you press "Extract options". Second, a recording catches whatever else is audible - other people in the room, background conversation. Your microphone is switched on only when you press "Start recording", it stops the moment you press stop or after 30 seconds, and the recording goes nowhere until you press "Extract options". Third, we keep the result in our short-lived cache for 30 days, so that sending the same thing again is instant and free; after that it is gone. Options you type, or paste straight into the option rows, are never sent anywhere - that path does not use AI at all.

The demo stays on your device. Anything you do in the demo at /demo lives in your browser's local storage and is never sent to us - unless you create an account, at which point we offer to bring those decisions with you.

We use PostHog to understand how people use PickChill: which features get used, where people get stuck, whether the demo leads anywhere. Our PostHog project runs on PostHog EU Cloud, so the data stays in the European Union.

There are three kinds of thing we measure, and that is the whole of it:

• Which features you use. That a decision or a ranking was created and how many options it had; that a pick was made and which round it was in; that a decision was completed; that you used the tie-helper, an export, a reminder, or a compare link; that you signed up, and whether by email or Google. These carry counts, yes/no flags and fixed labels only - a number of options, a round number, the word "png". Never what the decision or the ranking was about.
• Which pages you visit. The address of each page you open in the app, where you arrived from, and how far down you scrolled. The address of a decision or ranking page contains that page's id - a random string like 1eb7dde0-c26a - never its title.
• Your device, and roughly where you are. Your browser and operating system, screen size, language and time zone, and an approximate location worked out from your IP address - country, region, city and postal district. This is the standard web-analytics picture: it tells us which devices to build for and which countries people are in. We do not use it to locate you, and we never combine it with what you are deciding.

The first of those is the one that could have carried your words, and it cannot: the rule that an event may hold counts, yes/no flags and fixed labels only is enforced in our code, so an event that tried to carry your text would not build.

What we deliberately do not do:

• No session recording. We do not replay your screen. Ever.
• No autocapture. Many analytics setups hoover up the text of everything you click. That would scrape your option labels straight off the page, so it is switched off - both in the code and on the PostHog project itself.
• No decision content. Titles, notes and option labels never leave your device for our analytics.
• No advertising networks, no data brokers, no cross-site tracking.

There are two modes, depending on whether you are signed in:

• Signed out - analytics runs in cookieless mode. It writes nothing at all to your device: no cookie, no id, nothing to carry you between visits.
• Signed in - we already know who you are from your session cookie, so events are attached to your account id, and so is the device and approximate-location picture described above. Even then, analytics stores nothing on your device; the id is handed to it fresh on each page load and forgotten when you close the tab.

We only set cookies the app cannot work without - which is why you have never been asked to accept any. They keep you signed in, protect the sign-in and sign-up forms so that nobody can submit them on your behalf, carry you safely through the trip to Google and back if you sign in that way, and remember where to send you afterwards. A couple more live for two minutes around signing up or signing out, so we can welcome you properly and leave the demo clean for the next person on the device. And if a friend sends you a decision to compare, one keeps that run tied to your browser, so you can finish it and the link cannot be used twice.

There are no advertising cookies, no analytics cookies and no third-party trackers. Our analytics writes nothing to your device at all.

Your browser also keeps a few things locally that are never sent to us: everything you make in the demo, whether you prefer light or dark, a note of which button you last signed in with, and - if someone sent you a decision to compare - your progress through it, so that a reload does not lose your place. Only your final pick goes back to them.

We email you when you ask us to: a password reset link when you request one, and a reminder about a decision when you set one. Reset links expire after an hour. Those emails are part of the service, so they always arrive.

Emails about the app itself - news about new features, and tips - are a separate thing, and we only send them if you say yes. We ask once, on a small bar on your home page, after you have finished a decision. You can ignore the question and it will come back. If you say no, we never ask again and we never send them. If you say yes, every one of those emails has an unsubscribe link, and you can turn them off at any time on your profile page.

When you answer, we store the answer, the date, where we asked you, and a copy of the exact words you read. We keep that so we can show what you agreed to. We never give your email address to anyone else for their own marketing.

PickChill runs on a handful of outside services, and we keep that number small on purpose. Each one is there to run a piece of the app for us: hosting, the database your account and decisions live in, a short-lived cache, and an email service (which sends the password-reset and reminder emails, and carries anything you write to us). Analytics is PostHog, on their EU cloud, as described above. And if - and only if - you pick "Continue with Google", Google tells us your email address, name and avatar, and nothing more.

Two more, and only when you ask for them: Anthropicreads the text, screenshot or photo you hand to "Extract options" and hands back the list of options, and OpenAI writes down what you said if you use a recording - both as described above. Nothing is sent to either unless you press that button, and nothing else in your account is ever sent - not your other decisions, not your picks, not your email.

If you buy the one-time unlock, the payment is handled by Paddle, who are the seller for that purchase. You give them your payment details and billing country directly - those go to them, never to us, and we never see your card. They tell us only that a payment was made and give it a reference number, and that reference and the date are all we keep. If you never buy anything, none of this applies to you.

None of them is given your data for their own purposes, none of them may use it for advertising, and we never sell it - not to them, and not to anyone else. If you want to know exactly who they are, ask us and we will tell you.

Some of your data leaves the EU. A few of the services above are run by companies based outside the European Union, so some of your data is processed outside it. Where that happens, it is covered by the standard data-protection terms the EU provides for exactly this - the standard contractual clauses - and it is still only ever used to run PickChill, never for anything of their own.

PickChill is a small business. One day it could be sold, or joined with another company. If that happens, accounts and the data described on this page move to the new owner along with the app.

Two things do not change. The new owner takes your data under this same policy: they cannot start using it for something you never agreed to, and they cannot sell it on. And we will tell you by email before it happens, so you have time to download your data or delete your account first.

This is a different thing from selling your data, which is what the rest of this page rules out. Selling the business is not a way around that promise - the promise travels with the data.

Your account and your decisions are kept until you delete them.

When you delete a decision it goes out of the app straight away - but we keep a copy of it for up to 30 minutes, so that the Undo can put it back. After that the copy expires on its own and the decision is gone for good. The Undo itself is only offered for a few seconds, in the bar that appears when you delete: once that bar goes, so does your way back.

Analytics events are kept by PostHog under their standard retention.

You can delete any decision from the app at any time. You can delete your whole account from your profile page. That removes your account and everything attached to it - your decisions, your options, your picks, your share links - immediately and for good. There is no soft-delete and no grace period, so please be sure.

You can take a copy of everything you have made here at any time, without asking us. Your profile page has a download button that gives you a zip file: every decision with its options, its comparisons and your picks, every ranking in order, and any notes you added.

If you are in the UK or the EU, you also have the right to have your data corrected, or to object to how we use it. Email us and we will sort it out.

Passwords are hashed with bcrypt. Password-reset links are stored hashed, so even we cannot read them. Traffic is served over HTTPS only, and every request for a decision is re-checked against its owner before anything is returned.

If we change what we collect, we will change this page and update the date at the top. If we ever want to store something on your device that is not strictly necessary, we will ask you first - properly, with a real choice.

Questions, requests, or something here that does not look right: privacy@pickchill.com.