PICK THE STICK
FUN FINE PRINT
PRIVACY POLICY

Last updated: June 3, 2026

This Privacy Policy explains how Pick The Stick collects, uses, discloses, and safeguards information when you use our website, mobile apps, and related services. It also serves as our notice at collection for California residents and describes the privacy rights available under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").

1. Information we collect

We collect information you provide directly and certain information automatically:

  • Account and profile details. Email address, password, team name, invite/league codes, and account settings.
  • Gameplay data. League memberships, picks, scores, standings-related records, and stat preference overrides.
  • Chat messages. Messages you send in league chat are transmitted to and stored by Stream.io on our behalf. Other members of your league can read these messages.
  • AI chat interactions. If you use the in-app AI assistant, the messages you submit are sent to Anthropic's API to generate a response. We do not permanently store AI conversation history on our servers.
  • Notification data. Device token, platform, activity timestamp, and notification preferences (global, per-type, and per-league controls).
  • Session and device storage. Authentication cookies, refresh tokens, browser local storage, and native app preferences used to keep you signed in and retain app settings.
  • Security and anti-abuse data. Short-lived Redis keys derived from IP and email data to enforce registration rate limits.
  • Usage and technical data. Log and request metadata used for operations, troubleshooting, and abuse detection.

2. How we use information

  • Provide, maintain, and improve the Service.
  • Authenticate accounts and administer leagues and gameplay.
  • Score picks and display standings.
  • Send optional push notifications and apply your notification preference settings.
  • Power real-time league chat via Stream.io.
  • Provide AI-assisted strategy responses via Anthropic's API.
  • Prevent abuse, monitor reliability, and protect the Service.
  • Process account deletion requests and related data removal workflows.

3. How we share information

We do not sell personal information. We may share information in the following ways:

  • With other users. Certain gameplay information (such as team names, standings, and league activity) is visible to members of your leagues.
  • With service providers. For example, Supabase (hosting, database, authentication, and Edge Functions), Stream.io (real-time league chat), Anthropic (AI assistant responses), Redis (rate limiting), Vercel (hosting and analytics), Google Analytics (product usage measurement), Apple Push Notification service (iOS push delivery), and Google Firebase Cloud Messaging (Android push delivery). These providers process information on our behalf under contract and are not permitted to use it for their own purposes.
  • For legal and safety reasons. When required by law, legal process, or to protect the rights, property, and safety of Pick The Stick, our users, or others.
  • Business transfers. In connection with a merger, financing, reorganization, or sale of all or part of our business.

3a. Analytics

We use Google Analytics and Vercel Analytics to understand how the Service is used so we can improve it. We may assign a pseudonymous identifier to your account or session so analytics can understand activity across sessions and devices. We do not send directly identifying information (such as your name or raw email address) to our analytics providers.

We do not link analytics data to advertising accounts, build advertising audiences, upload customer data to advertising platforms, or use analytics for cross-context behavioral advertising. Google Ads advertising and measurement features are not enabled. We do not use analytics for prohibited sensitive-category purposes.

4. Data retention

We retain account, league, and gameplay records until you delete your account or request deletion, unless a longer period is required for legal, security, or legitimate business needs. Rate-limit keys are short-lived and expire automatically. Device tokens are removed when you log out, delete your account, or are reported invalid.

5. Data security

We use reasonable administrative, technical, and organizational measures to protect personal information. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

6. Your choices

  • Account information. You can update information in-app and can request deletion via in-app settings or by emailing us.
  • Cookies and storage. You can control cookies and local storage through browser or device settings.
  • Push notifications. You can disable push notifications in device settings at any time.
  • Analytics controls. On our website, you can manage analytics preferences via the cookie consent banner, and we honor the Global Privacy Control (GPC) browser signal as an opt-out of analytics cookies. On our native iOS and Android apps, analytics are active by default; to opt out, email support@pickthestick.co.

7. Your California privacy rights (CCPA/CPRA)

This section applies to California residents. In the preceding 12 months we have collected the following statutory categories of personal information:

  • Identifiers — email address, account/user ID, team name, invite and league codes, device tokens, and IP-derived rate-limit signals.
  • Customer records / account information — password (stored hashed by our authentication provider) and account settings.
  • Commercial / gameplay information — league memberships, picks, scores, standings records, and stat preferences.
  • Internet or other electronic network activity — usage, log, and request metadata, and analytics events.
  • User content — league chat messages and AI assistant messages you submit.

Sources. We collect this information directly from you, automatically from your use of the Service, and from our service providers (such as authentication, analytics, and push-delivery providers).

Purposes. We use each category for the business purposes described in Section 2 (operating the Service, authentication, scoring, notifications, chat, AI responses, security/anti-abuse, and handling deletion requests).

Disclosure. We disclose the categories above to the service providers listed in Section 3 for those business purposes only. We do not sell your personal information and we do not share it for cross-context behavioral advertising (as "sell" and "share" are defined under the CCPA). We have not sold or shared personal information, including the personal information of consumers under 16, in the preceding 12 months.

Sensitive personal information. Your account login credentials are treated as sensitive personal information. We use them only to authenticate you and operate the Service — that is, only for purposes that do not trigger the right to limit, so we do not offer a separate "Limit the Use of My Sensitive Personal Information" control.

Subject to verification, California residents have the right to:

  • Know / access the categories and specific pieces of personal information we have collected.
  • Delete personal information we have collected (see Section 6 and our in-app account deletion).
  • Correct inaccurate personal information.
  • Data portability — receive a copy of your information in a portable format.
  • Opt out of the sale or sharing of personal information — although, as stated above, we do not sell or share it.
  • Non-discrimination — we will not deny service, charge different prices, or provide a different level of service because you exercised a privacy right.

How to submit a request. Delete your account in-app (Account → Delete Account), or email support@pickthestick.co from the email tied to your account to make any other request. To verify your identity we match the request to the email address on your account and may ask you to confirm account details; we do this to protect your information and will not use it for any other purpose. You may use an authorized agent to submit a request on your behalf by providing the agent with written permission, which we may ask you to confirm directly. We will respond to a verifiable request within 45 days, and may extend by an additional 45 days where reasonably necessary, with notice to you.

7a. Notice of financial incentive

From time to time we offer giveaways, prize promotions, and a referral program. Entering a giveaway or referring a friend may require you to provide personal information (such as your email address or to create an account), and participation may be considered a "financial incentive" under the CCPA because it is connected to the collection of personal information.

  • Material terms. When you enter a giveaway or join the referral program, we collect identifiers and gameplay information to administer the promotion, verify eligibility, and award prizes. The specific terms of each promotion are presented at the time you participate.
  • How to opt in / withdraw. Participation is voluntary and you opt in by entering. You may withdraw at any time before a prize is awarded by emailing support@pickthestick.co, which forfeits the related entry or reward.
  • Good-faith estimate of value. We do not assign a monetary value to your personal information or use it for advertising; any difference in value between the information you provide and a promotion is reasonably related to the cost of running the promotion and is presented to you at entry.

8. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will investigate and remove it where appropriate.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When changes are material, we will post the updated version in the Service and may provide additional notice.

10. Contact

Questions about this Privacy Policy? Email support@pickthestick.co.