Privacy

Who we are

pickone.day is a product of Bitfox Tech Ltd, a UK private limited company registered in England and Wales, company number 17205667, registered office 4 Winchester Close, Bromley BR2 0PX. Bitfox Tech Ltd is the data controller for the personal data described here.

For questions about this page, or to use any of your rights, email [email protected].

What we store

• For each event: its name, its link and a one-way hash of the group password (never the password itself).
• For each person in an event: the name, emoji and colour they pick, a one-way hash of their 4-digit PIN (never the PIN itself), and the answer they give for each day.

That's all. We don't ask for, and don't store, your email, phone number, real name or location.

Why we're allowed to: we use this only to run the event you or your group set up, and to keep the site safe from abuse. Under UK GDPR that is our legitimate interest (Article 6(1)(f)). We don't sell personal data, and we don't use it for advertising.

Passwords and PINs

Group passwords and PINs are never stored as you type them. We keep only a one-way hash, which can check a password but can't be turned back into it. That's also why a forgotten PIN can't be recovered.

Who can see what

Only people with the event's link and password can get in. Everyone in an event can see who has joined and each person's answers. The host can rename the event, change its dates or password, remove people and delete the event.

Cookies and this device

We only use cookies that are needed for the site to work. There are no tracking, analytics or advertising cookies.

• Group access (30 days): remembers that you entered an event's password.
• Sign-in (up to 180 days, renewed while you use it): keeps you signed in to your profile in that event.
• Host setup (up to 7 days): lets whoever created an event finish setting it up as the host.

Your browser also keeps a few things on this device only: the list of your recent events, answers you haven't saved yet, the profile you used last, and, just once after creating an event, its password so we can show you the share card. These never leave your device and you can clear them by clearing this site's data.

IP addresses

We never store your IP address. To slow down password guessing we keep a scrambled, one-way version of it for a short time, and those records are deleted within a day or two.

Who else handles your data

Only one company: Cloudflare. It hosts the site and the database, and acts as a processor on our behalf under its data processing terms. Like any host, it sees technical details of each request (your IP address, browser and the page you asked for) in order to deliver the site and block abuse, and it keeps its own logs of those for a limited time.

Fonts and icons are served from this site, so your browser doesn't contact anyone else when you use it.

The database is kept in Western Europe. Cloudflare runs a global network, so a request may be handled outside the UK or EEA. Where that happens, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard.

How long we keep things

We only keep event data, and every event deletes itself:

• Events nobody else joined (only one person in them) are deleted after 7 days without a visit.
• Every other event is deleted 30 days after its last date (or after it was created, if no dates were picked), or 30 days after someone last opened it if that's later.
• The host can delete an event at any time.

Deleting an event removes everything in it: people, PINs, answers and sign-ins. Leaving an event deletes your profile and answers.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it's wrong;
• delete it;
• restrict or stop how we use it;
• give it to you in a portable format.

The quickest way is usually inside the event: you can change your profile and answers, and leaving the event deletes them straight away. Otherwise email [email protected] with the event's link and your profile name. Because there are no accounts, we may ask you to show the profile is yours before we act. We aim to reply within one month.

You can also complain to the UK Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first, but it's your call.

Children

pickone.day isn't aimed at children under 13, and we don't knowingly collect their personal data. If you think a child has given us some, email [email protected] and we'll delete it.

Reporting a security problem

If you think you've found a security issue on this site, email [email protected]. We aim to acknowledge reports within a few working days.

Changes to this page

We may update this page as pickone.day changes. The date at the top shows the latest version. We can't email you about changes, because we don't have your address.