Privacy policy

Controller

The controller is Poggers Oy (Business ID 3171525-2), Tohtorinpolku 3, 33720 Tampere, Finland. Poggers Oy has not appointed a separate data protection officer. Privacy and support requests can be sent to [email protected].

Data we process and where it comes from

We receive data directly from you and your browser, from Google when you choose Google Sign-In, and from other members through shared group actions. API-Football supplies factual match data, not personal data. KickPick.club processes:

• Account and profile data: Google’s stable account identifier and Google-verified email address, the KickPick.club nickname you choose when you register, the public profile slug generated from it, the illustrated avatar you select, your Finnish/English language and sign-in timestamps. We ask Google only for the “openid” and “email” permissions, so we never receive your real name or your Google profile picture, and we never receive your Google password.
• Your nickname, filtering and reservations: your nickname is the only name anyone sees in KickPick.club, and it must be unique across the whole service. We reject locally listed prohibited names after moderate normalisation intended to catch accents, separators, repeated characters and common number substitutions; this automatic filter cannot understand every context. We store a normalised nickname reservation with your internal member ID. We also generate and reserve a permanent lowercase ASCII slug for your public /players/<slug> profile. A nickname is permanent — it cannot be changed after you register. Deleting your account releases the nickname for someone else, removes the profile link to you and leaves only the bare slug and release time reserved so your old URL can never point to a different player.
• Group and game data: member and commissioner roles, group names, creator member-removal choices, group-scoped rejoin blocks, current lobby presence, matchday settings, immutable draft actions, card ownership, scores, settlement evidence and recap output. Nicknames, avatars, current presence and game activity are visible to the other members of the same group. If the group chooses deferred missed turns, current absence may also let later turns skip without another wait until a live connection registers return. Presence itself and the stored block list are not added to the permanent game history or shown publicly.
• Crew data: if you form or join a persistent crew of up to 10 players, we process its name, your role (owner or member), its membership and its invite link. A crew links the games its members create; those games remain otherwise ordinary group data as described above, and every other crew member is told by email when a new one is created inside the crew. Your crew name, role and roster are visible to the other members of the same crew.
• Site-wide competition and public profile data: registration, your nickname, profile slug and illustrated avatar, independently selected fixture and round-wide cards, save times, scores, settlement evidence and leaderboard totals. Anyone can open your unindexed player profile and see your nickname, illustrated avatar and current rank and points in each open site-wide competition you have joined. Anyone who opens a competition can also see participant nicknames, profile links, illustrated avatars, points and the opaque internal participant reference used to retrieve that competition avatar; neither reference is a Google identifier or session credential. Registered participants can see each selection group only after its server-owned deadline: fixture kickoff for fixture cards and first kickoff for round-wide cards. Email addresses, Google identifiers, private groups and card selections are not shown on a player profile.
• Security and device data: an opaque session cookie; keyed hashes of session, invite and public-share tokens; IP address, user-agent and request metadata in access/security logs; and short-lived realtime connection identifiers.
• Optional notification data: the browser push endpoint and encryption keys. A turn notification contains the group name and a first-party group link in an encrypted Web Push payload.
• Strictly bounded product analytics: internal member, group, crew, competition and round identifiers, the event type from a fixed list of ten product actions, a timestamp, group size, turn duration and a technical duplicate-prevention identifier. An event has no field for names, email addresses, Google identifiers, tokens or free-form text.

Purposes and legal bases

Google account data is required to create and maintain an account. If you do not provide it, you can view the public pages but cannot create or join a group or play in a site-wide competition. We do not ask for precise location, contacts, payment details or an advertising profile, and we do not use personal data for marketing or track you across other sites.

• Contract: account, group, crew, site-competition entry, scoring, recap and sharing data are necessary to provide the service and perform the terms. Generating the optional written recap from already-settled results — with an AI language model when that feature is enabled — is part of providing the game. The draft-start and crew-game-created service emails are necessary for the asynchronous private group and crew to proceed and are not marketing.
• Legitimate interests: limited product analytics, access/security logging, service protection, abuse prevention and support are necessary for Poggers Oy’s interests in operating, securing and improving the service. We minimize the fields and retention and balance those interests against your rights. You may object as described below.
• Consent: browser turn notifications are optional. You can withdraw consent at any time by disabling notifications; this does not affect processing before withdrawal.
• Legal obligation: during the free launch KickPick.club holds no records on this basis — there are no payment or accounting records. If a law later requires a specific record to be kept, that record is restricted, kept only for the legal purpose and named here.

Cookies and browser storage

KickPick.club uses first-party storage needed to provide the requested service. Cookies: the HttpOnly, Secure and SameSite=Lax session cookie expires after at most 30 days, and during sign-in the API sets a separate single-use HttpOnly challenge cookie holding the one-time OAuth state and PKCE code verifier — it expires after at most ten minutes and is consumed by the sign-in callback; no page script can read either cookie. Local storage remembers your language, your turn-sound preference and, on the device of a player who created a group or crew, that group’s invite link so the lobby can still show it after a page reload; signing out removes every stored invite link. Session storage holds only tab-scoped markers: one recording that a sign-in attempt left this tab and one that an app update triggered a reload. The service worker caches versioned application files for offline/reliable use. KickPick.club does not use advertising or third-party analytics cookies and does not load Google scripts on its pages. Google may read or set its own cookies after you activate sign-in and the browser is redirected to Google; Google processes those under its own terms as the identity provider.

Recipients and service providers

We disclose only the data needed for each function. Authorized Poggers Oy personnel may access data when required for support, security, incident response or legal obligations. The active external recipients are:

• Amazon Web Services (processor) — hosting, database, queues, logs, content delivery and transactional email. Primary application data is held in the EU (Ireland). A draft-start email contains the destination address, group name and the first player’s nickname; a crew-game-created email contains the destination address, crew name, the new game’s name and its creator’s nickname.
• Cloudflare (processor) — DNS, TLS termination, content delivery, firewall and rate limiting. It processes IP addresses and HTTP/network metadata at its global edge.
• Google (independent identity provider) — renders the sign-in control and supplies the Google account identifier and your verified email address after your sign-in choice. It supplies nothing else: we do not request the permission that would give us your name or profile picture.
• Your browser’s push service, such as Apple, Google or Mozilla — routes encrypted notifications when you enable them. The provider sees the push endpoint and delivery metadata but cannot read the encrypted payload in transit.
• OpenAI (processor) — writes the optional matchday recap text after a private group’s matchday has fully settled. We send OpenAI the group name, the matchday label and, for each member, the nickname, points, won/lost/void pick counts and the card texts of the best and worst pick — never email addresses, Google identifiers or tokens. We instruct OpenAI not to store the request (store: false); OpenAI may keep API inputs briefly for abuse monitoring under its data processing addendum. OpenAI never decides game results, and a deterministic recap replaces the AI text whenever OpenAI is unavailable.
• Google Workspace (processor) — hosts the [email protected] mailbox. When you email us, it processes your address, message and any attachments so we can answer; Google’s infrastructure and subprocessors may be global.
• Other players, public profile/site-competition visitors and public-share visitors — nicknames, avatars, current lobby presence and group activity are disclosed inside a private group; the same applies to crew name, role and roster inside a shared crew; a player profile publicly shows the nickname, illustrated avatar and open-league standings; site-competition nicknames, profile links, illustrated avatars and points are visible to anyone, while locked entries remain visible only to registered participants; avatars are not included in public recaps, and a recap is public only when a member deliberately creates and distributes a share link.

Inactive and data-free providers

API-Football and The Odds API supply football facts; KickPick.club sends them no personal data. Stripe billing is disabled for the free launch, so it receives no data. It cannot be enabled until the processing register, contracts, transfer assessment, retention and this notice are reviewed and updated.

International transfers

Primary application storage is configured in AWS’s Ireland region. Cloudflare’s global network, Google, OpenAI, browser push providers and provider support/sub-processors may process data outside the EU/EEA; the main third country involved is the United States. Cloudflare, Inc., Google LLC and Amazon’s US group companies are certified under the EU–US Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023. Where a transfer is not covered by that certification — including OpenAI, browser push providers and provider subprocessors — we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914) included in the provider’s data processing agreement, together with an assessment of supplementary safeguards. You may request more information or a copy of the applicable safeguards from [email protected].

Retention and deletion

You can delete your account from the profile page or ask for help at [email protected]. Deletion removes every private group the account created, for all of its members. In a private group created by someone else, your membership is depersonalised in place instead: your nickname is replaced by a neutral placeholder, your internal member ID is removed from that row, and your remaining draft turns are skipped, while the picks, scores and settlement evidence that form the group’s shared ledger are retained without identifying you. If that group is still a lobby with no draft, nothing has been recorded yet and your membership is removed outright. The confirmation explains this before deletion. In a site-wide competition, deletion removes only your registration, entries, scores and settlement records, not other players’ history.

• Sessions expire after 30 days, and signing out deletes the server-side session immediately.
• Account, profile, group/game, crew, delivery-marker and related product-analytics data remain while the account is active — except that a game linked to a crew is also deleted, for all of its players, if the crew’s owner deletes the crew, as described in the terms. If you do not sign in for 13 consecutive calendar months, an hourly process deletes the account and the same related data. A successful sign-in restarts the period.
• Site competition registration, entries, scores and settlement evidence remain while your account is active. Self-service or inactivity deletion removes your rows and decrements the participant count; other participants’ rows remain.
• A permanent lobby rejoin block stores only the group ID, your internal member ID and the block timestamp. It remains until that group is deleted or your account is deleted; it is used only to reject another invite redemption for that lobby.
• Poggers Oy’s AWS access, security and application logs, including IP addresses and pseudonymous internal identifiers, are retained for at most 90 days in production. Providers may retain their own narrowly scoped security records for the periods stated in the applicable processing agreement.
• An address added to the AWS SES account-level bounce/complaint suppression list is retained for at most 90 days. KickPick.club requests deletion of the current address sooner when the account is deleted.
• Privacy, support and security correspondence to [email protected] is kept for at most 24 months after the case is closed, then deleted; a case connected to a legal claim may be kept restricted for as long as that claim requires.
• Recap text requests sent to OpenAI are not stored by OpenAI for training and are sent with storage disabled; abuse-monitoring copies are deleted by OpenAI within the period stated in its API data controls, currently up to 30 days. The generated recap itself is stored by KickPick.club as part of the group’s recap data.
• Push subscriptions remain until you disable notifications, the browser reports that the subscription has expired, or the account is deleted. A queued push payload expires after one hour.
• Public recap links and their frozen snapshots expire after 30 days. A copy loaded before expiry or account deletion may remain in a browser or intermediary cache for at most five further minutes and, only during a temporary origin failure, for at most one additional minute. Realtime tickets expire after 60 seconds and connection records after at most three hours.
• Self-service and inactivity deletion remove sessions, profile and Google account data, your nickname reservation, the owner linkage from your profile-slug reservation, your avatar selection, push subscriptions, memberships, lobby rejoin blocks, the groups the account created, invitations, drafts, site competition registrations and entries, published cards, email delivery markers, picks, scores, recaps, related analytics events and active public recap links. Releasing the nickname reservation returns your nickname to the pool, so another player can later choose it. The bare slug and release time remain reserved without an owner, so the old public URL returns not found and is never reassigned; we keep that reservation on the basis of our and your legitimate interest in ensuring your old public address can never identify or be reassigned to another person. In a group created by someone else, the drafts, published cards, picks, scores and settlement evidence are retained without your nickname or member ID, and the group’s recaps and public recap links are still deleted. If you own a crew, deleting your account deletes the crew itself and, in full, every crew game you created; a game another member created inside your crew is not deleted — it is detached from the deleted crew and continues as an ordinary group. Deleting a crew from the app while your account remains is different: that deletes every game linked to the crew, for all of those games’ members, including games created by others. Leaving or being removed from someone else’s crew only removes your own membership row.
• Deleted active database data can remain only in encrypted disaster-recovery backups until the backup retention period ends, currently no more than 35 days. Backups are not used for ordinary product access and deleted data is not intentionally restored to active use.
• Where applicable law requires specific records to be retained, those records may be restricted and kept only for that legal purpose. KickPick.club does not currently collect payment records during the free launch.

Shared recap links

Sharing a recap is an explicit action that creates a public link. The page shows the group name, recap text, nicknames, ranks and points — nothing else — and expires after 30 days. Anyone with the link can open it, so share it as you would any public page.

Automated processing

Private-group draft order and card ownership, site-entry locking, scoring and settlement are decided by deterministic application rules from validated match data. The inactivity process automatically deletes accounts after 13 months, but KickPick.club does not make decisions based solely on automated processing that produce legal or similarly significant effects, and it does not profile players for advertising. AI never decides game results.

Your rights

Where GDPR applies, you may request access, correction, deletion, restriction and portability of your data; object to legitimate-interest processing; and withdraw notification consent. Email [email protected]. We may verify your identity and normally respond within one month; requests are normally free. You may complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local EEA supervisory authority.

One correction we cannot make is your nickname. It is chosen by you, it is unique across the service, and it is permanent by design — there is no way to change it, in the app or through support. If you no longer want the nickname you chose, delete your account; that releases it and you can register again with a different one. Your avatar and language can be changed at any time from your profile.

Service emails

KickPick.club sends two emails, both about something you are part of: one when a draft starts in a group you belong to, and one when another member creates a game in your crew. They go to the Google-verified address on your account, in the language you last chose. There is no marketing email and never will be. You can switch both off at any time from your profile page, and every message repeats where that setting lives; turning them off does not affect the games themselves, only the notifications.

Age limit

KickPick.club is intended for adults. Because the game is built on betting-style mechanics — prediction cards priced from bookmaker odds — we set an 18-year age limit even though no real money, deposit, withdrawal or cash prize is involved. The limit is a condition of use that you confirm when you sign in: we do not ask for a date of birth, store an age or run any age verification, so we cannot check it and rely on your confirmation. The service is not for people under 18 and does not knowingly collect their data. If you believe an under-18 person has created an account, or you are a parent or guardian who wants one removed, contact us so we can investigate and delete it.

Changes to this notice

If this notice changes in a way that matters, the change is announced in the app before it takes effect. This page always shows the current version.