Legal
Privacy policy
Last updated 2 November 2026.
PickAndRank collects as little as it can to place people fairly. We don't sell data or show ads, and we don't use advertising or cross-site trackers.
Who's responsible for what
For organizer accounts and messages sent to us, we decide how data is used. For an event, the organizer does: they choose what to ask and who can take part, and we handle the answers on their instructions. If you signed up to an event, the organizer is your first contact.
What we collect
From organizers
- Your email address, and your plan.
- If you pay: what you bought, when, the amount, and Polar's reference for it. Polar, not us, holds your payment details and billing address.
- The events you create.
- Your IP address and browser details, stored with your login so that sessions stay secure.
From people taking part
- Your name, and your group if the event has groups.
- Your email address, if the organizer asks for it.
- Your rankings, your private code and your placement.
- A priority level, if the organizer sets one for you.
- When you first opened your result.
Organizers can see all of this for their event. Other participants can't.
From anyone who contacts us
- Your name, your email address and your message.
We also use IP addresses for a short time to limit repeated requests and stop abuse.
Why we use it
- To run events: to place people, explain each placement and show it to them. We do this on the organizer's instructions.
- To provide accounts you asked for, and to send the emails the service needs: login codes, personal codes, results and notices about your data.
- To keep the service secure and fix faults, which we have a legitimate interest in doing.
- To answer messages you send us.
- To meet legal duties, if we have any that apply.
We don't use your data for marketing, and we don't use it to train AI models.
Automated placement
Placements are worked out automatically from people's rankings, the event's settings and any priority the organizer sets. Results reach participants only after the organizer publishes them, and the organizer can review and change them. If you have a question about your placement, ask the organizer.
Who handles it for us
- Cloudflare hosts the site and stores its data, and keeps request logs. On our public pages, Cloudflare may measure anonymous page performance. No cookies, no cross-site tracking. On sign-in, event sign-up and contact forms, Cloudflare Turnstile checks for automated abuse.
- Resend delivers our email, including messages from our contact form.
- Polar sells our paid upgrades as the seller of record. When you pay, you give your payment details and billing address to Polar directly, under Polar's own privacy policy. We tell Polar your email and an account reference so that it can link your purchases to your account.
We store event and account data in the EU. Pages are served from Cloudflare's network near you, and Resend may process email outside the EU, so data can pass through other countries. We share data with others only if the law requires it, or to protect people's safety or the service. If the service ever changes hands, your data would move with it under this policy, and we'd tell organizers first.
Cookies and storage
We don't use advertising or cross-site tracking cookies, so we don't show a cookie banner. Nothing below is stored until you do what the last column says. Reading a public page stores nothing.
| What | Why | How long | Stored when |
|---|---|---|---|
| Login cookie | Keeps organizers logged in | 7 days, renewed as you use the site, until you sign out | You log in |
| Logged-in marker (a cookie) | Holds no details about you. It lets our public pages point the logo to your events. | 7 days, renewed as you use the site, until you sign out | You log in |
| Device marker (a cookie) | A random value that stops one device from sending too many requests, which protects events from abuse. It says nothing about you. | 1 day | You open an event's sign-up page |
| Sign-up cookie | Remembers your sign-up on this device, so you can come back to your picks | Until 14 days after the deadline or results, or until you use the sign-out button on your event | You join an event or enter your code |
| Colour mode (browser storage) | Remembers light or dark mode | Until you clear your browser's storage | You press the colour mode button |
| Dismissed hints (browser storage) | Remembers which tips an organizer has closed | Until you clear your browser's storage | You close a tip |
Two Cloudflare services also run on some pages. Neither sets a cookie on our site:
- Web Analytics measures anonymous page performance on our homepage, how it works, pricing and use case pages.
- Turnstile checks for automated abuse on the sign-in, event sign-up and contact pages.
How long we keep it
- Events and all their data are deleted automatically 12 months after sign-ups close. A draft that's never opened is deleted 12 months after it was started.
- Organizers see the date on the event, and on upgraded events we email them 30 days before. An organizer can remove a person or delete an event sooner, and can download everything first.
- Each event keeps a history of its changes, so the organizer can explain them. If an organizer removes a person, the history keeps their name and where they were placed until the event is deleted. If an organizer erases a person, their name leaves the history, downloads and published results straight away, and only a line saying a participant was erased remains.
- An event that started as an interest check keeps how many people ranked each option, as counts only, with no names. Groups under 5 people are combined or left out, and if fewer than 5 people ranked, those counts are deleted when anyone is erased.
- Account data stays until the account is deleted, which also deletes all of its events.
- Deleted and erased data leaves the live service straight away, and our backups expire within 30 days.
- Messages to us are kept for as long as we need them to deal with what you asked, then deleted.
- Login codes expire after 10 minutes. Our providers keep their own logs for a limited time.
Security
Our security page explains how data is protected. If a breach affects your data, we'll tell the organizers involved without delay, and anyone else the law says we must.
Children
PickAndRank is run by organizers, including schools and camps. An organizer who uses it with children is responsible for having the permission they need from the school, parent or guardian. Children under 13 should only take part through an organizer who has that permission. Organizers can ask for first names only, and needn't ask for email addresses.
Your rights
Depending on where you live, you may have the right to see, correct, delete or move your data, to limit or object to how it's used, and to withdraw any permission you gave. For event data, ask the organizer, who can erase you from the event. If you can't reach them, or for anything about an organizer account, contact us. We'll reply within 30 days. You can also complain to your local data protection authority.
Changes
We'll update this page when anything changes, and tell organizers by email about anything important.
Contact
Questions about this policy? Contact us.