Privacy Policy

What this policy covers

This is the privacy policy for picklefriend.net, which includes the PickleMixer web app and the Android app. It describes what we collect, why, and who else gets to see it.

Account data we collect

When you create an account we store the following. We only store what's needed to run the service; not every field is set for every account.

Required:

• Username
• Email address
• Full name
• Password (stored only as a salted hash; we cannot read it)

Recorded at signup:

• The IP address and browser user-agent of the device you signed up from
• How you arrived: the site that linked you here (if any), the first page you landed on, and any campaign tags on the link (see Acquisition source below)
• Referral code (only if you signed up via a referral link)

Optionally populated:

• Timezone (detected from your browser)
• Email-preference flags (which you can toggle in settings)
• Last-login timestamp

Player data you add

When you add players to your roster, we store:

• Name (required)
• Email (optional)
• Rating (optional)
• Gender (optional)
• DUPR ID (optional)
• Notes (optional)
• An internal opt-out token used to power one-click unsubscribe links in player emails

Your players, and their results, stay private to you and your group's co-organizers unless you turn on a public page (next section).

Public pages and embeds

Nothing about a group is public until its organizer switches it on. Each switch is off by default.

• Public ratings page (/ratings/…): shows player names as entered in the roster, ratings and standings, and game results. DUPR IDs appear only if the group turns that on as well. This page can be found by search engines; the standings are included in its page markup.
• Club-website embeds: an organizer can paste the standings or recent results into their own website. The embed shows the same data as the public page, with names either in full or as first name and last initial, as the organizer chooses. Embeds are marked not to be indexed by search engines. We record the website address (hostname) each embed is shown on and how often, per group, and nothing about the people viewing it.
• Public schedule (/events/…): shows only the events the organizer marks as listed, and for each only the date and time, event name, location as typed, spots left or waitlisted, and whether it was cancelled. Never who is coming, never the description. Marked not to be indexed.
• Hide from public pages: an organizer can tick this for any player. That player is left out of standings and embeds, and their name reads “Private player” on public game rows. Their games still count toward everyone's ratings. If you are a player and want to be hidden, ask your organizer; they own the switch because many players have no email on file for us to ask.

Roster links you emailed yourself (legacy)

You can use the mixer without an account. We used to offer to email you a link that brings your list of players back next time; we no longer offer new links, but any link you already received keeps working. If you took the offer while it existed:

• We store your email address, plus when you asked for a link, when you first opened one, an unsubscribe token, and a simple log of what we've sent you. That is all we keep.
• We do not store the player names. They are carried inside the link itself, in the part after the #, which your browser never sends to our server. The names exist in your email and in your own browser, not in our database, not in our server logs, and not in our analytics. The one exception: the email we send you naturally contains your link, so it sits in our outgoing-mail system like any sent email, and is cleaned out within about a month.
• What we send you: that link, and occasionally a tip about using PickleMixer. Nothing else, and we do not share or sell your address.
• Unsubscribing: every email has a one-click unsubscribe link. You can also unsubscribe without an account; we keep the record of your opt-out precisely so we can honor it.

We only send the occasional tip to addresses that have opened one of these links, which is how we confirm the address is yours. If someone mistyped an address back when links were being sent, the person who received it never gets those tips; they have not opened anything, so we never treat the address as confirmed. Every email carries a one-click unsubscribe.

Cookies

We set three first-party cookies. None of them track you:

• auth_token: keeps you logged in between visits. Lasts 30 days (90 if you tick “Remember me”), renewed while you keep using the site.
• picklefriend_session: session state (including the token that protects forms from forgery). Lasts 24 hours.
• pf_action_buttons_pos: remembers where you put the mixer's action buttons (top or bottom). A preference only; lasts one year.

That is all: no tracking cookies and no third-party cookies.

Analytics (pageviews)

We use self-hosted Matomo. IP addresses are truncated to the first three octets before storage. No cookies. Your data never leaves our servers.

No name or email is ever sent to it. When you are signed in, pageviews carry a one-way salted hash of your account number so that visits from the same account can be grouped together. The hash cannot be turned back into your account, and Matomo never holds anything that identifies you by name; it does mean we can look at how one (pseudonymous) account uses the site over time.

We sometimes show two versions of a page or message to different visitors and count which one works better. Which version you see is worked out from your account number (or, if you are not signed in, your session) each time; nothing extra is stored about you to run these tests.

Product analytics (how the mixer is used)

When you generate a mix we record the mixer settings and counts (players, courts, game number), a truncated IP address, and a basic flag for whether the request looks like a bot. This stays on our servers; we use it to improve the mixer. It is never sold or shared.

If you use the mixer without an account and then create one in the same browser session, we save a short summary of that earlier use on your new account: when you first mixed, how many games you mixed, your highest game number and largest player count, and whether you were shown the “session ending” notice. It holds no player names. If you never create an account, the summary is discarded with your session. We use it only to understand how people come to sign up, and it is never sold or shared.

Email delivery logs

We log sends, bounces, and opens for account emails and game-reminder emails so we can keep deliverability healthy. The operator can see bounce counts and masked addresses (e.g. j***@g***.com) on an internal dashboard.

Diagnostic data

If the app hits an error we log the error message, stack trace, URL, and browser user-agent. These logs are not tied to your account.

Messages you send us

When you use the “Send us a message” form we store your message, the email address you give (or your account email if you’re signed in and leave it blank), the page you were on, and your browser user-agent, and email a copy to the operator. We use these only to answer you and to fix what you reported.

If you tick “Include my mix details from this device” with a message, we also store a snapshot of the mixer on that device: player count, courts, settings, and your recent games, with every player name replaced by P1, P2… before it leaves your device. We use it only to see why a rotation came out the way it did.

Now and then the app asks a one-question survey (for example, what we could improve, or where you first heard about PickleMixer). Your answer is stored with your account unless you tick “send without my name”, in which case we discard who sent it and keep only the day it arrived. Answers from visitors without an account are always stored without any identity. If you give a reason when deleting your account, that reason is kept (see Delete your account).

Service providers

We use two third-party services:

• Cloudflare Turnstile: bot protection at signup. Cloudflare receives a one-time challenge token and your IP address, used only to decide whether the signup looks legitimate.
• PayPal: processes subscriptions and donations on the upgrade and donate pages. PayPal receives the amount and, if you are signed in, your user id, and returns your PayPal email address and subscription id to us. PayPal's own privacy policy governs what PayPal collects on its checkout.

Outbound email (verification, password reset, game reminders) is sent from our own server through the standard mail infrastructure provided by our hosting provider. We do not use a third-party email-sending service such as SendGrid, Mailgun, or Amazon SES.

Push notifications. If you (as a player or an organizer) turn on notifications in your browser or the Android app, we store the push address and keys your browser hands us so we can reach that device. Each notification travels through the push service run by the maker of your browser: Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox. They see that a message was delivered to your device, not your name or email, and the content is encrypted so only your browser can read it. Turning notifications off removes the address from our servers.

No other third parties are used. We do not use Google Analytics, Firebase Analytics, advertising SDKs, or any social-login providers.

Acquisition source

If you arrive from a link we use in our own advertising or referrals, we record the campaign tags on that link (such as the source, medium, and campaign name) in your browser session, and (only if you create an account) save them on your account so we can understand which of our own efforts bring people to PickleMixer. In the same way we note the website that linked you here (the referrer your browser sends, if any) and the first page you landed on, and save those on your account if you create one.

This is first-party data: it stays on our servers, is never sold, and is never shared back with the advertising platforms or any other third party. We do not use advertising pixels, conversion APIs, or third-party advertising SDKs, and we do not store the platform click identifiers (such as gclid or fbclid) some ad links append.

We also keep a first-party count of visits that arrive on these links: the campaign tags, the landing page, a timestamp, a flag for whether the visit looks like a bot, and whether the visit went on to generate a mix. This count holds no personal data (no name, email, account, IP address, or cookie) and exists only so we can measure how our own campaigns perform.

Some of the places a player sees their organizer's group carry a quiet “run your own group” line: the TV board, the check-in and score pages, player emails, calendar entries, the player's schedule page, public event and ratings pages, and the small PickleFriend.net credit on a club website embed. Its link is tagged with the surface it came from and a random code for the group. The tag holds no group name, no organizer, and no personal data. When you click one we record the surface and the group in your browser session, and save them on your account, with the time, if you create one or are already signed in. These clicks are counted the same way as the campaign visits above: the surface, the group, a timestamp, a flag for whether the click looks like a bot, and whether that browser session went on to generate a mix, with no name, email, account, IP address, or cookie. We use this to learn which places bring new organizers. The organizer of that group earns referral credit when someone signs up through their group's link, as described in Free years & gifting.

Player emails

Player email addresses you enter are stored so you can reach those players through the service. Every email a player receives is set in motion by their organizer: event invitations, game reminders, announcements, and the links players use to RSVP, see the schedule, or enter scores. We never email a player on our own initiative, and player addresses are never added to any newsletter or mailing list. Every player email includes a one-click unsubscribe link.

Two things to know so this is complete:

• Many player emails end with a one-line note that the organizer runs their group on PickleFriend, with a link for anyone who wants to start a group of their own. The note is the same in each of them (invitations, reminders, cancellations, waitlist and sign-in notices, partner digests, ladder movement and box league mail) and in the calendar feed described below, and it is the only promotional content a player ever receives from us. The link carries a random tag for the group, so we can tell which groups' players go on to start one; the tag holds no name and no personal data. If someone signs up through it, the organizer gets referral credit, as with their referral link. The Acquisition source section above says what we record when the link is clicked.
• We count how many players who were invited to an event later open a PickleFriend account of their own, by matching player addresses against account addresses. This produces aggregate numbers that tell us whether the service grows that way. Nobody is contacted, flagged, or treated differently because of it.

Beyond that, we do not sell, share, or use player emails for any other purpose.

Calendar subscriptions

From their schedule page, a player can add their events to Google Calendar, Apple Calendar, Outlook, or any other calendar app. No account is needed: the feed link (/calendar/feed.ics?token=…) carries the same personal token as the player's schedule link, so anyone holding the link can read the feed; treat it like a personal link. Depending on the option chosen, the feed lists one event, the events the player is in, the events they are invited to (for a ladder league, every event across the ladder, with ones they are not invited to marked “[Watch]”), or those plus upcoming events they will be auto-invited to.

Each calendar entry contains the event name and division, start and end time, location, the organizer's description of the event, the organizer's name, the player's own RSVP status, a link back to their schedule page, and the same one-line “run your own group” note that player emails carry. Its link goes to PickleFriend.net tagged as coming from a calendar entry, with a random code for the group; the tag holds no personal data (see Acquisition source above). No other player's name appears in the feed.

Once subscribed, the player's calendar provider fetches the feed on its own schedule and keeps its own copy of the events under that provider's privacy policy; we do not control that copy. On our side we record, per player and feed option, when the feed was first and last fetched, how many times, and the calendar app that fetched it (its user-agent string), so the schedule page can show a “Subscribed” badge. To stop, remove the calendar from your calendar app; the feed is not sent anywhere on its own.

Email to account holders

Some email comes with having an account and needs no opt-in: verifying your address, resetting your password, confirmation of a subscription or renewal, and courtesy notices about a plan you pay for (a warning that it is about to end without renewing, or, on Lite, that your free month of score entry is ending). Address verification, password resets and subscription confirmations are always sent while the account exists. The plan notices respect the “unsubscribe from all email” switch: if you have turned that on, you will not get them by email, though the same notice still appears in the app. On a free account, the end of the free month of score entry is announced in the app; it is also emailed only if you have opted in to Technical announcements or News & Offers.

Everything else (tips, product news, and offers) is sent only if you ticked News & Offers, and stops as soon as you untick it or use the unsubscribe link in any such email. Which of those emails you get depends on how you use your account: for example, someone who has never run a mix gets a different note than someone who schedules events, and someone whose plan lapsed may hear from us about coming back. Automated emails of this kind are spaced at least two weeks apart per account; an occasional announcement to everyone who opted in is separate from that spacing. Your usage is not shared with anyone to do this; it all happens on our servers.

Children

This service is not intended for people under 13. We do not knowingly collect data from children under 13. If we find out a child under 13 has an account we will delete the account and its data.

Data retention

• Cloud session backups (mixer sessions saved to the cloud) are removed after 30 days without access. If a paid plan lapses, the account's cloud session backups are removed 30 days after the lapse.
• Mixer sessions on the free tier, or with no account, are retired after about a day without mixing (a few days if the session has never been mixed); the Mixer always asks first whether to save the players into your group, and nothing is removed until you choose. Without an account, the session itself lives entirely in your browser's local storage, not on our servers.
• Diagnostic logs (client errors, cron history) are pruned by our daily cleanup job after 14 days. Append-only application logs are rotated by size.
• Queued email records are pruned after 30 days.
• Account data is kept until you delete your account. Deletion removes your account and everything in the groups you own at once. A few things outlive it: an archive of your subscription and donation transactions (amounts, dates, plan, status; no name or email), the optional reason you give for leaving, rolling database backups for up to 14 days, and anything you created inside another organizer's group, which stays with that organizer. The full list is on Delete your account.

Where data is stored

Our servers are located in Canada, hosted by Web Hosting Canada (GloboTech Communications) in Montréal, Québec. By using the service you consent to data processing in Canada.

Security

• All traffic is encrypted in transit with TLS.
• Passwords are stored using a salted hashing algorithm, never in plain text.
• Session cookies are HttpOnly and Secure.
• Admin access is gated behind an IP allow-list.

Your rights

You have the right to:

• Access your personal data
• Correct your personal data
• Erase your personal data
• Port your personal data to another service
• Object to processing of your personal data
• Restrict processing of your personal data

To exercise any of these rights, email me@picklefriend.net.

Changes to this policy

We will update the "last updated" date below when this changes. Material changes will be called out on sign-in.