Privacy Policy

Last updated: August 14, 2026

This policy describes how Pick7 (the “App”) collects and uses your personal data, under Regulation (EU) 2016/679 (“GDPR”).

1. Data controller

The data controller is Alessandro Facchini, the developer of Pick7, reachable at info@pick7.app. The full postal address is provided on request at the same address.

2. Data we process

• Account — email address and password, kept encrypted by our authentication provider and never visible to us. If you sign in with Google or Apple we receive your email from the provider and, where you allow it, your name; with Apple you can use a private relay address.
• Profile — username, profile picture if you upload one, nationality and preferences (language, theme, followed teams, notification settings).
• Gameplay — lineups, scores, collected cards, trades, participation in leagues, tournaments, divisions and challenges, badges and milestones.
• Technical data — push notification token and device identifier, device model and operating system, language, service logs containing your IP address.
• Diagnostics and usage — crash and error reports (Sentry) and pseudonymised usage statistics (PostHog, servers in the European Union).

We process no payment data: the App is free and has no in-app purchases. We do not collect your location and we do not sell your data to anyone.

3. What other users can see

Pick7 is a social game: username, profile picture, level, scores, collection, badges and leaderboard positions are visible to other users of the App. Your email, preferences and technical data never are. If you would rather not be recognisable, pick a made-up username and don’t upload a photo of yourself.

4. Purposes and legal bases

• Providing the service (account, scores, leaderboards, cards, trades, tournaments) — performance of a contract (Art. 6.1.b GDPR).
• Push notifications (goals, lineup reminders, results) — consent (Art. 6.1.a), revocable at any time from device or App settings.
• Security and abuse prevention (anti-fraud, multi-accounting, leaderboard integrity) — legitimate interest (Art. 6.1.f).
• Diagnostics, usage statistics and App improvement — legitimate interest (Art. 6.1.f). You can object by writing to info@pick7.app.
• Legal obligations — Art. 6.1.c.

5. Service providers

We rely on third-party providers that process data on our behalf:

• Supabase — database, authentication and profile picture storage. Servers in Ireland (EU).
• Google Cloud Run — the App’s servers, europe-west1 region, Belgium (EU).
• Expo — push notification delivery and update distribution (United States).
• Sentry — crash and error monitoring.
• PostHog — usage statistics, with servers in the European Union.
• API-Football — supplies public match and player data; receives no user data.
• Cloudflare — this website and @pick7.app mail forwarding.

6. Transfers outside the EU

Database, authentication, servers and usage statistics stay within the European Union. Expo and Sentry may process data in the United States: those transfers rely on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission.

7. Retention

• Account and gameplay data: for as long as the account exists. When you delete it, the data is erased immediately, with no waiting period.
• Database backups: overwritten within 30 days.
• Technical and security logs: up to 12 months.
• Aggregated, anonymous data (usage statistics, closed leaderboards): indefinitely, as it cannot be linked to a person.

8. Your rights

You can exercise the rights under Arts. 15–22 GDPR at any time: access, rectification, erasure, restriction, portability and objection. Write to info@pick7.app; we reply within 30 days. You may also lodge a complaint with your supervisory authority (in Italy, the Garante).

To delete your account and associated data, see Account deletion.

9. Children

The App is intended for users aged 13 or older. Across Europe the age at which someone can consent to online data processing on their own is set between 13 and 16 (in Italy it is 14). Below the threshold set by your country, using the App requires the consent of a parent or guardian. We do not knowingly collect data from children under 13; if you believe this has happened, write to us and we will delete the account.

10. Changes

We may update this policy. Material changes will be announced in the App. The current version is always available at pick7.app.

11. Contact

Any questions about this policy: info@pick7.app.