Privacy policy

Who is responsible

PicIt is run by Nikolaos Polychroniou, based in Greece — "we" in this policy. For anything about your data, email privacy@picit-app.com.

What PicIt collects

• Your account: your email address, a password (stored only in scrambled form — we never see it) and your date of birth. The date of birth is used once to check that you are 16 or older and then stays with your account.
• Your profile: a username, and optionally a name, a profile photo, a short bio, a link and a glow colour.
• Your phone number, only if you choose to add it. It is stored as a keyed one-way code, never as the number itself, so friends who have your number in their contacts can find you. You can turn this off at any time. Nothing else in PicIt uses it.
• Contacts you pick, if you use contact matching (available on Android). Only the entries you select are sent. They are turned into the same one-way code, compared with PicIt users who opted in, and discarded. We keep only a count of how many lookups you made each day.
• What you post: poll questions, the photos or text of each option, how long a poll runs and who can see it; your votes; your comments; polls you pin to your profile; groups you create and their members; friend requests and friendships; your invite code.
• Technical data: when you use PicIt, our providers' servers record your IP address, your browser or device type and the time of each request in ordinary server logs, so that the service works and abuse can be spotted.

What PicIt stores on your device

A login token so you stay signed in, and a few small settings: when the launch animation last played, which hand holds the camera, whether taps buzz, whether you've learnt how to vote, and whether you've dismissed the reminder to add your name. If you vote through a poll's link without an account, PicIt keeps a random number on that device so it can't vote twice. PicIt sets no advertising or analytics cookies and runs no advertising trackers.

How PicIt uses it

• To run the app: show your polls to the friends you chose, count votes, deliver comments and results.
• To keep accounts safe: sign-in codes by email, a bot check on the email sign-up and password-reset steps, and limits on how often things can be tried.
• To check that you are old enough to use PicIt.
• To find friends, only when you ask it to.
• To find and fix problems, using server logs and crash reports.

PicIt does not sell your data, does not show ads, and does not use your data to train AI models.

Who can see what

• PicIt is friends-only. Your polls, votes, comments and pinned polls are visible to the audience you chose for each poll: all your friends, or one group you made. Votes are not anonymous — friends see who voted for what.
• Your username and profile photo can be found by other signed-in PicIt users searching by username, so that friends can find you. Your full profile is visible to your friends.
• Polls are private to your friends, but a poll link you share can be opened by anyone who has it. Nothing is shared with advertisers.

Services that process data for PicIt

• Supabase — the database, sign-in and photo storage. PicIt's data lives on servers in Frankfurt, Germany, in the European Union.
• Vercel — serves the app itself. Its servers may be outside the European Union, including in the United States.
• Resend — sends the sign-in and password codes to your email address.
• Cloudflare — the bot check on the email sign-up and password-reset steps, which processes signals from your browser and your IP address.
• Sentry — receives a report when the app fails in your browser, so the fault can be found and fixed. The report carries your account's id — never your email or phone. Its servers are in the European Union.

Each of them acts on our instructions under a data-processing agreement. Where data leaves the European Economic Area, the transfer relies on the safeguards EU law provides, such as standard contractual clauses.

How long PicIt keeps it

• Your account and what you post: for as long as your account exists. Closed polls stay in your history and your friends' history.
• Server logs: for a limited time, as set by the providers above.
• After you delete your account: everything is removed within 30 days. Backups may hold a copy for up to 30 days more, and are then gone.

Your rights

Under EU data-protection law you can ask to see the data PicIt holds about you, correct it, receive a copy of it, restrict or object to how it is used, withdraw a consent you gave (for example, remove your phone number), and have it deleted.

Email privacy@picit-app.com from the address on your account and we will answer within a month. You can also complain to the Hellenic Data Protection Authority (dpa.gr) or the data-protection authority where you live.

Deleting your account

Delete your account any time from Profile → Settings → Delete account. Your account, your photos, your polls, votes and comments are removed within 30 days; polls your friends already answered disappear with them. If you cannot get into the app, email privacy@picit-app.com from the address on your account and we will do it for you.

Age

PicIt is for people aged 16 and over. We do not knowingly keep an account for anyone younger; if we learn of one, we delete it. If you believe someone under 16 is using PicIt, write to us.

Security

Everything travels encrypted between your device and PicIt. Every table in the database has per-user access rules, and photos are served through short-lived links that only the right people can open. No method is perfect; if you find a problem, please tell us first.

Changes to this policy

When this policy changes, the new version is posted here with a new date at the top. For a significant change, we will also tell you in the app.