Legal
Security & privacy
Last updated 2 November 2026.
In plain words, for schools, camps and anyone who has to ask.
Where data lives
Event and account data, and our backups, are stored in the EU, on Cloudflare. Pages are served from Cloudflare's network near each visitor, and Resend, our email provider, may process email outside the EU.
How it's protected
- All traffic is encrypted with HTTPS, and stored data is encrypted by Cloudflare.
- There are no passwords. Organizers log in with a one-time code by email.
- Each organizer sees only their own events. Each person gets a private code, and sees only their own result.
- Forms are checked for automated abuse and limited to stop guessing.
- Ties are settled by a secure random draw created for each event. Organizers can't see it or change it.
- Our logs record faults, not names, emails, rankings or codes.
- We look at event data only when we need to fix a fault or answer a request from its organizer.
- Backups run regularly, and we test restoring them.
What we collect
A name, a group if the event has groups, an email address if the organizer asks for one, and rankings. Organizers can ask for first names only. Our privacy policy has the full list.
Who handles data for us
- Cloudflare: hosting, storage and security checks.
- Resend: email delivery.
- Polar: payments for upgrades, as our seller of record.
We don't sell data or show ads.
How long we keep it
Events are deleted automatically 12 months after they close. Organizers can download everything and delete an event at any time. Backups are kept for 30 days, so deleted data is gone from them within 30 days.
Children
Organizers working with children are responsible for having the permission they need. PickAndRank doesn't need an account or email address from participants unless the organizer asks for one.
If something goes wrong
If a breach affects your data, we'll tell the organizers involved without delay, with what happened and what we've done about it.
Reporting a problem
If you've found a security problem, contact us. We'll reply as soon as we can.