1. Data we collect
When you use Pickpo, we may collect the following categories of data:
- Account data — your email address, used to sign you in with a one-time code, plus optional profile details such as an age bracket and display preferences (e.g. theme, image scaling).
- Anonymous device identifier — a random ID generated on your device: the App keeps it in secure device storage, the web application in browser local storage, and the pickpo.com website in a first-party cookie. It lets you browse public polls and vote without creating an account, and helps deduplicate votes.
- Content you upload — photos, poll questions, and tags you add when creating polls. Public polls (and their photos) are visible to other users of the Service.
- Votes and favorites — which photos you vote for or save, together with your language preference and an approximate location (country and city) derived from your IP address at the time a vote is cast. The IP address itself is not stored with the vote.
- Purchase records — when you buy credits, payment is processed by Stripe. We store transaction records (amount, currency, date); we never see or store your card number.
- Usage data — information about how you interact with the Service (e.g. screen views, feature usage), collected via analytics services such as Mixpanel and Firebase. On the pickpo.com website, analytics runs only with your consent, given through the cookie banner.
- Crash & performance logs — technical reports that help us detect and fix bugs (e.g. device model, OS version, stack traces).
- Advertising data — Google AdMob in the Android App, Google AdSense in the top-level web application and on the pickpo.com public voting website, and their advertising partners may process device or advertising identifiers, IP address, general device information, interactions with ads, and consent or privacy choices in order to select, deliver, measure, and protect advertising. The web application embedded in the pickpo.app product-page preview displays only first-party Pickpo promotional content and does not request AdSense ads. The exact data used depends on your region and the choices you make in Google’s advertising privacy form.
- Cookies & local storage — the pickpo.com website uses a strictly necessary first-party device-identifier cookie, a functional theme-preference cookie, and a cookie recording your analytics-consent choice (each kept for up to two years). Analytics storage on that website is used only with your consent. When pickpo.com or the top-level web application serves AdSense, Google and participating advertising providers may also use cookies or local storage according to your Google advertising privacy choices. The web application additionally uses browser local storage for its device identifier, preferences, Terms acceptance, and analytics.
The Service does not access your device’s GPS or request location permissions.
We do not collect personal data such as your name, postal address, or phone number unless you provide it voluntarily (for example, when contacting us).
The Service and its third-party partners use SDKs or similar technologies to collect and store information for analytics, crash reporting, and advertising purposes. Advertising privacy choices are collected through Google’s User Messaging Platform (UMP) in the Android App and Google’s certified Consent Management Platform (Privacy & messaging) in the top-level web application and on pickpo.com. You can revisit available choices through Ad privacy settings in Pickpo and through applicable device settings.
2. Purposes & legal bases for processing
- Provide the Service’s core features — polls, voting, favorites, sharing — performance of a contract (GDPR Art. 6(1)(b)) and legitimate interest (GDPR Art. 6(1)(f)).
- Process credit purchases and keep required transaction records — performance of a contract (GDPR Art. 6(1)(b)) and legal obligation (GDPR Art. 6(1)(c)).
- Generate images with AI at your request — performance of a contract (GDPR Art. 6(1)(b)).
- Moderate uploaded content and protect users, including minors — legitimate interest (GDPR Art. 6(1)(f)) and legal obligation (GDPR Art. 6(1)(c)).
- Operate and improve the Service, fix bugs and maintain stability — legitimate interest (GDPR Art. 6(1)(f)).
- Display personalized ads (where applicable) — consent (GDPR Art. 6(1)(a)).
- Deliver non-personalized or limited ads and protect advertising systems against fraud and abuse — consent where required and otherwise our or our partners’ legitimate interests (GDPR Art. 6(1)(f)), subject to applicable law and your Google advertising privacy choices.
- Comply with legal obligations — where applicable (GDPR Art. 6(1)(c)).
3. Data sharing & third parties
We do not sell your personal data. However, we use or may use third-party services to support functionality in the Service. These providers may collect data under their own privacy policies:
- Google Play Services — Privacy Policy
- Expo — Privacy Policy
- Mixpanel — analytics — Privacy Policy
- Firebase (Google LLC) — analytics & crash reporting — Privacy Policy
- Google AdMob, Google AdSense, Google User Messaging Platform, and Google Privacy & messaging (Google LLC) — advertising delivery, measurement, fraud prevention, and management of advertising privacy choices — Google Privacy Policy and How Google uses data for advertising
- Stripe — payment processing for credit purchases — Privacy Policy
- Google Cloud (Gemini) — AI image generation and automated content moderation — Privacy Notice
- Microsoft Foundry (Microsoft Corporation) — AI image generation and automated content moderation — Privacy Statement and Data, privacy, and security for Azure AI Foundry Models
Authentication is handled by software self-hosted on our own infrastructure — your sign-in data is not shared with an external authentication provider.
3.1 International data transfers
Some of our service providers (such as Google LLC, Microsoft Corporation, Mixpanel Inc., or Stripe Inc.) may process data outside the European Economic Area (EEA), including in the United States. Where that happens, transfers rely on appropriate safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
4. Data retention
- Account data — kept until you delete your account.
- Uploaded photos and polls — kept until you remove them or delete the poll (or your account).
- Vote records — kept while the related poll exists; location information is used only in aggregated statistics.
- Purchase records — kept for as long as tax and accounting law requires.
- Analytics data and crash logs — retained for up to 12 months.
- Cookies & local storage — the pickpo.com cookies expire after two years; browser local storage persists until you clear your browser data.
- Advertising and consent data — retained by Google and participating advertising providers according to their policies and your privacy choices. The Android App asks UMP for an updated consent status on each launch, while the top-level web application and pickpo.com obtain the current choice through Google Privacy & messaging. None uses Terms acceptance or the pickpo.com analytics choice as an advertising-consent record.
Where retention for a longer period is required for legal reasons, we will retain only the minimum necessary data and apply appropriate safeguards. After the retention period, data is deleted or irreversibly anonymised.
5. Security
- Encryption in transit (HTTPS/TLS).
- Access controls and least-privilege procedures for staff and subprocessors.
- Periodic security reviews and monitoring.
6. User controls
- You can use the Service’s public features — browsing, searching, and voting on public polls — anonymously, without creating an account. Only the anonymous device identifier is used.
- You can delete your account directly in the App or the web application (Account screen). This deletes the personal data associated with it.
- You can remove your own polls and photos at any time.
- You can retract a vote you have cast.
- You can open Ad privacy settings in Pickpo to review or change available advertising choices: through Google UMP in the Android App and through Google Privacy & messaging in the top-level web application and on pickpo.com. In an environment where no Google privacy form is available, the same entry opens this Privacy Policy.
- On the pickpo.com website you can accept or refuse analytics storage in the cookie banner, and change that choice at any time via the Cookies control in the footer. This analytics choice is separate from the Google advertising choices available through Ad privacy.
7. Data controller
The data controller responsible for personal data collected via the Service is:
I-TRENDS sp. z o.o.
Email: contact@pickpo.com
If you have questions about this policy or wish to exercise your rights, please use the contact details above.
8. Your rights (EU/EEA)
Under the GDPR you have the right to:
- Request access to the personal data we hold about you.
- Request rectification of inaccurate or incomplete data.
- Request erasure (“right to be forgotten”), subject to legal exceptions.
- Request restriction of processing.
- Request data portability where applicable.
- Object to processing based on legitimate interest.
- Withdraw consent at any time (without affecting processing before withdrawal).
- Lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).
To exercise these rights, contact us at contact@pickpo.com. We will respond in accordance with applicable law.
8.1 US state privacy rights
If you are a resident of California or another US state with a comprehensive privacy law (e.g. the CCPA/CPRA, Virginia CDPA, Colorado CPA), you have the right to:
- Know what categories of personal information we collect and how we use them (described in this policy).
- Access the personal information we hold about you.
- Request correction of inaccurate personal information.
- Request deletion of your personal information, subject to legal exceptions.
- Opt out of the “sale” or “sharing” of personal information and targeted advertising where those concepts apply. We do not sell personal information for money. Advertising-related disclosures may qualify as “sharing” or targeted advertising under some US state laws, and available controls are provided through Pickpo’s Ad privacy settings and applicable device controls.
- Not receive discriminatory treatment for exercising any of these rights.
To exercise these rights, contact us at contact@pickpo.com. We will verify your request and respond within the timeframes required by applicable law. You may designate an authorized agent to make requests on your behalf.
9. Children’s privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect, store, or process personal data from children under this age, including children under 13 as defined by the US Children’s Online Privacy Protection Act (COPPA). If we become aware that we have inadvertently collected data from a child without verified parental consent, we will take immediate steps to delete that information.
Pickpo is committed to ensuring the online safety and protection of minors. We actively adhere to our published Child Safety Standards, which outline our zero-tolerance policy toward child sexual abuse and exploitation (CSAE), including:
- Automated screening of every uploaded photo, plus moderation and reporting mechanisms for suspected CSAE content or behavior.
- Immediate cooperation with law enforcement and child protection authorities where necessary.
- Educational links and resources promoting child safety awareness.
Parents and guardians are encouraged to monitor and guide minors’ use of the Service and ensure that children understand appropriate online behavior. If you believe that a child has provided personal data to Pickpo, please contact us immediately at contact@pickpo.com so we can take appropriate action.
10. Consent & acceptance
Acceptance of the Pickpo Terms and acknowledgement of this Privacy Policy are recorded separately from advertising privacy choices. Where consent is required for personalized advertising or device storage, it is requested through Google UMP in the Android App or Google Privacy & messaging in the top-level web application and on pickpo.com, and may be withdrawn through Pickpo’s Ad privacy settings. The web application embedded in the product-page preview displays only first-party promotional content and does not start the AdSense consent or ad-request flow. On the pickpo.com website, consent for analytics storage is requested through the site’s own cookie banner, separately from Google’s advertising privacy tools, and can be withdrawn there. Refusing personalized advertising does not remove free credits or access to the Service’s core features; depending on your choices and applicable law, you may receive non-personalized or limited ads instead.
11. Changes to this policy
We may update this Privacy Policy from time to time. The latest version will always be available at https://pickpo.app/policies/pp.html. We encourage you to review this policy periodically for updates.
12. Contact & data deletion requests
For questions, data access, or deletion requests, please contact:
Email: contact@pickpo.com
You can also delete your account, and the personal data associated with it, directly in the App or the web application. We aim to respond to requests promptly and in accordance with applicable law.