Privacy policy
How PICKED handles your data when you visit this site and join the waitlist.
1. Who is responsible
Mariia Busarieva, Quellenweg 23 c 20535 Hamburg Germany.
Email: picked.de@gmail.com
2. What we collect, and why
Visiting this site. The server that delivers the site receives your IP address and the technical details your browser sends (date and time, page requested, browser type). This is needed to show you the site and keep it secure. It is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR). This site sets no cookies, uses no analytics or advertising tools, and loads its fonts and images from its own server.
Joining the waitlist. If you join the waitlist we store your name, your email address, the time you signed up, and the fact that you ticked the consent box. We then send you one email with a confirmation link (double opt-in). We store the time you confirmed and a random confirmation code, and we only send you news after you have confirmed. If you don't confirm, we send you no news. We use your details only to send you information about PICKED: event announcements, launch dates and offers. Every email contains an unsubscribe link. The legal basis is your consent (Art. 6(1)(a) GDPR).
3. Event data (when you play the PICKED game)
This section applies if you join a PICKED event with the companion app, in addition to sections 1 and 2.
What we process. The name, age, short bio, interests, gender and photo you enter; your answers and reactions during the rounds; your rankings and picks; confessions you submit; matches and hints that result from the game; and a record that you gave consent (the version and the time). Your photo is re-encoded on your device before it is uploaded, which removes hidden location data. We do not collect your location, contacts or device identifiers.
Why, and the legal basis. We process this data only to run the game for you and the other guests. The basis is your explicit consent (Art. 6(1)(a) GDPR). Your picks and reactions, taken together with the gender you enter, can reveal information about your sexual orientation, which is a special category of data. We therefore ask for your explicit consent to that (Art. 9(2)(a) GDPR) on the consent screen before you join. You cannot join without it, and you can withdraw it at any time.
Who sees it. Other guests in the same event see your name, age, bio, interests, gender and photo. Only the host sees the matches that result from mutual picks, and announces them in person; the app shows matches to no other guest. Other guests never see your reactions, rankings or picks. The host can also read the confessions guests submit, without names shown to other guests.
How long we keep it. All event data is deleted within 7 days after the event ends. You can delete your own data immediately at any time with the "Leave and delete my data" button in the app. Deleting removes your profile, answers, picks and confessions from the event.
Where it is stored. The game server is run by us in Germany. Traffic between your phone and the server passes through Cloudflare (see section 4), which can see your IP address while you play. The app stores some of your entries on your own device so it can resume after a reload; "Leave and delete my data" clears them too. We do not make copies of the event data.
Entry codes. If the event uses entry codes, the code you enter is checked against a stored hash and is linked to your guest record for the duration of the event.
Photos and video taken by the host. The host takes photos and video at the event to show what it is like and may publish them online, for example on the PICKED website and on social media. This material is separate from the app data above and is not covered by the 7-day deletion of event data. The legal basis is your consent (Art. 6(1)(a) GDPR). The host announces the filming at the door; you can opt out there by wearing a "no photos" sticker, and you can withdraw your consent at any time by writing to picked.de@gmail.com. Material is kept until you withdraw or the host deletes it. Once published on a platform, it is also processed by that platform under its own terms.
4. Who processes your data
- Waitlist storage: sign-ups are stored in a Google Sheet through Google Apps Script. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data can be transferred to Google LLC in the USA. The transfer relies on the EU–US Data Privacy Framework and standard contractual clauses.
- Website hosting, domain name service and event traffic: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Data can be transferred to the USA; the transfer relies on the EU–US Data Privacy Framework and standard contractual clauses.
- Sending emails: the confirmation email and later news are sent from our own mailbox (Gmail, provided by Google, see above). We use no separate newsletter tool.
5. How long we keep it
Event data: see section 3. We keep your waitlist details until you withdraw your consent or ask us to delete them. We keep no server logs of our own; the hosting provider keeps technical logs for a short period under its own policy.
6. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. You can withdraw your consent at any time with effect for the future: write to picked.de@gmail.com or use the unsubscribe link in any email. Withdrawing does not affect processing that happened before.
You can also complain to a data protection authority. For a provider based in Hamburg this is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de.
7. Links to other sites
This site links to our Instagram and TikTok profiles. If you follow a link, that platform's own privacy policy applies.
8. Changes
We will update this policy when our setup changes. Last updated: 9 October 2026.