Privacy

Your account. Your email address, your display name, and - if you sign in with Google - the avatar picture Google gives us. If you signed up with a password, we store it hashed (bcrypt), never as text. We also keep the date you joined and the date you last signed in.

Your decisions. The title and description you give a decision, the options you put in it, and every pick you make between them. We keep the picks because they are what lets you replay a decision, undo a step, and see how you reached your top pick. This content is stored so that you can come back to it - it is visible to you, and not to anyone else, unless you choose to share it.

When you share. If you turn on a share link or send someone a decision to compare, that decision becomes readable by anyone holding the link - that is what the link is for. The shared copy is stripped down first: it never carries your account id or your other decisions. You can turn a link off at any time.

When someone picks for you. If a friend follows your compare link, we store the name they type in and the single option they picked. They stay anonymous otherwise - no account, no email, no tracking.

When you use a screenshot, a photo or a paste to fill in your options. This is the one place where something you put into PickChill is sent to another company. If you paste text, paste or add a screenshot, or take a photo with your camera, and press "Extract options", that text or image - and the list topic you typed - is sent to Anthropic, whose AI reads it and sends back a list of option labels. It is used only to produce that list, and it is not used to train their models. Two things are worth knowing before you use it. First, an image carries whatever else it caught- other people's names, your location, your account details, whatever was behind the thing you photographed - so crop it to just the list where you can. Your camera is only ever opened if you choose it yourself from your phone's own picker, and the picture goes nowhere until you press "Extract options". Second, we keep the result in our short-lived cache for 30 days, so that sending the same thing again is instant and free; after that it is gone. If your list was already a clean list of lines, we split it on your own device and nothing is sent anywhere at all.

The demo stays on your device. Anything you do in the demo at /demo lives in your browser's local storage and is never sent to us - unless you create an account, at which point we offer to bring those decisions with you.

We use PostHog to understand how people use PickChill: which features get used, where people get stuck, whether the demo leads anywhere. Our PostHog project runs on PostHog EU Cloud, so the data stays in the European Union.

There are three kinds of thing we measure, and that is the whole of it:

• Which features you use. That a decision was created and how many options it had; that a pick was made and which round it was in; that a decision was completed; that you used the tie-helper, an export, a reminder, or a compare link; that you signed up, and whether by email or Google. These carry counts, yes/no flags and fixed labels only - a number of options, a round number, the word "png". Never what the decision was about.
• Which pages you visit. The address of each page you open in the app, where you arrived from, and how far down you scrolled. The address of a decision page contains that decision's id - a random string like 1eb7dde0-c26a - never its title.
• Your device, and roughly where you are. Your browser and operating system, screen size, language and time zone, and an approximate location worked out from your IP address - country, region, city and postal district. This is the standard web-analytics picture: it tells us which devices to build for and which countries people are in. We do not use it to locate you, and we never combine it with what you are deciding.

The first of those is the one that could have carried your words, and it cannot: the rule that an event may hold counts, yes/no flags and fixed labels only is enforced in our code, so an event that tried to carry your text would not build.

What we deliberately do not do:

• No session recording. We do not replay your screen. Ever.
• No autocapture. Many analytics setups hoover up the text of everything you click. That would scrape your option labels straight off the page, so it is switched off - both in the code and on the PostHog project itself.
• No decision content. Titles, descriptions and option labels never leave your device for our analytics.
• No advertising networks, no data brokers, no cross-site tracking.

There are two modes, depending on whether you are signed in:

• Signed out - analytics runs in cookieless mode. It writes nothing at all to your device: no cookie, no id, nothing to carry you between visits.
• Signed in - we already know who you are from your session cookie, so events are attached to your account id, and so is the device and approximate-location picture described above. Even then, analytics stores nothing on your device; the id is handed to it fresh on each page load and forgotten when you close the tab.

We only set cookies the app cannot work without - which is why you have never been asked to accept any. They keep you signed in, protect the sign-in and sign-up forms so that nobody can submit them on your behalf, carry you safely through the trip to Google and back if you sign in that way, and remember where to send you afterwards. A couple more live for two minutes around signing up or signing out, so we can welcome you properly and leave the demo clean for the next person on the device. And if a friend sends you a decision to compare, one keeps that run tied to your browser, so you can finish it and the link cannot be used twice.

There are no advertising cookies, no analytics cookies and no third-party trackers. Our analytics writes nothing to your device at all.

Your browser also keeps a few things locally that are never sent to us: everything you make in the demo, whether you prefer light or dark, a note of which button you last signed in with, and - if someone sent you a decision to compare - your progress through it, so that a reload does not lose your place. Only your final pick goes back to them.

We email you only when you ask us to: a password reset link when you request one, and a reminder about a decision when you set one. There is no marketing email and no newsletter. Reset links expire after an hour.

PickChill runs on a handful of outside services, and we keep that number small on purpose. Each one is there to run a piece of the app for us: hosting, the database your account and decisions live in, a short-lived cache, and an email service (which sends the password-reset and reminder emails, and carries anything you write to us). Analytics is PostHog, on their EU cloud, as described above. And if - and only if - you pick "Continue with Google", Google tells us your email address, name and avatar, and nothing more.

One more, and only when you ask for it: Anthropicreads the text, screenshot or photo you hand to "Extract options" and hands back the list of options, as described above. Nothing is sent to them unless you press that button, and nothing else in your account is ever sent - not your other decisions, not your picks, not your email.

None of them is given your data for their own purposes, none of them may use it for advertising, and nothing is ever sold. If you want to know exactly who they are, ask us and we will tell you.

Some of your data leaves the EU. A few of the services above are run by companies based outside the European Union, so some of your data is processed outside it. Where that happens, it is covered by the standard data-protection terms the EU provides for exactly this - the standard contractual clauses - and it is still only ever used to run PickChill, never for anything of their own.

Your account and your decisions are kept until you delete them.

When you delete a decision it goes out of the app straight away - but we keep a copy of it for up to 30 minutes, so that the Undo can put it back. After that the copy expires on its own and the decision is gone for good. The Undo itself is only offered for a few seconds, in the bar that appears when you delete: once that bar goes, so does your way back.

Analytics events are kept by PostHog under their standard retention.

You can delete any decision from the app at any time. You can delete your whole account from your profile page. That removes your account and everything attached to it - your decisions, your options, your picks, your share links - immediately and for good. There is no soft-delete and no grace period, so please be sure.

If you are in the UK or the EU, you also have the right to ask for a copy of your data, to have it corrected, or to object to how we use it. Email us and we will sort it out.

Passwords are hashed with bcrypt. Password-reset links are stored hashed, so even we cannot read them. Traffic is served over HTTPS only, and every request for a decision is re-checked against its owner before anything is returned.

If we change what we collect, we will change this page and update the date at the top. If we ever want to store something on your device that is not strictly necessary, we will ask you first - properly, with a real choice.

Questions, requests, or something here that does not look right: privacy@pickchill.com.