Privacy Policy

1. Who controls your data

GoldenPicks is the data controller for the personal data described here. Contact us at support@goldenpicks.app about anything in this policy.

2. What we collect

• Account details — your email address, an optional display name, and a bcrypt hash of your password. We never store your password itself and cannot recover it.
• Consent records — the times you confirmed your age and accepted our terms, kept so we can show that confirmation happened.
• Usage — which matchups you request reports for and when, so we can enforce your plan’s monthly allowance.
• Subscription state — your plan, status and billing period, synced from Stripe.
• Security data — a short-lived record of requests by IP address for rate limiting, and hashed password-reset tokens.
• Technical data — standard server logs generated by our host, including IP address and request time.

3. What we deliberately do not collect

We do not store card details — payments run entirely through Stripe and card data never reaches our servers. We do not ask for identity documents, home address, or date of birth: age eligibility is a self-certification at signup. We do not track you across other websites, and we run no advertising or analytics trackers.

4. Why we process it, and on what basis

• To provide the service (account, reports, allowances) — necessary to perform our contract with you.
• To take payment — necessary to perform our contract.
• To keep the service secure (rate limiting, abuse prevention) — our legitimate interest in preventing fraud and misuse.
• To meet legal obligations — tax and accounting records.
• To record age and terms confirmation — our legitimate interest in operating a betting-adjacent service responsibly.

We do not use your personal data to train AI models, and we do not make automated decisions with legal effect about you.

5. Who we share it with

We use a small number of processors, each for a single purpose:

• Stripe — payments and subscription management (receives your email and payment details directly from you)
• Anthropic — generates the written analysis. The prompt contains match data and team or player names. It does not contain your email, name, or account identifiers.
• Vercel — application hosting and server logs
• Neon — database hosting
• Resend — sends password reset emails (receives your email address)
• Sports data providers — we send them team, player and fixture queries, and nothing about you

We do not sell your personal data, and we do not share it with advertisers or data brokers. We may disclose data if legally required, or to establish or defend legal claims. If the business is ever sold or merged, your data may transfer to the buyer under this same policy.

6. International transfers

Our processors operate in the United States and elsewhere, so your data may be transferred outside your country. Where the law requires it, these transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. Cookies

We set a session cookie to keep you signed in, and a CSRF token cookie to protect forms against cross-site request forgery. Both are strictly necessary for the service to work, so we do not ask for consent to set them. We use no advertising, profiling or cross-site tracking cookies.

8. How long we keep it

• Account data — while your account is open, then deleted on request or closure
• Usage records — kept so allowances and billing periods compute correctly; typically 24 months
• Rate limiting records — hours, then automatically deleted
• Password reset tokens — one hour, or until used
• Billing records — as long as tax and accounting law requires, typically six to seven years, even after account closure

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and get a copy;
• correct data that is wrong or incomplete;
• delete your data (subject to records we must keep by law);
• receive your data in a portable format;
• object to, or ask us to restrict, processing based on legitimate interests;
• withdraw consent where we rely on it, without affecting earlier processing.

If you are in California, you also have the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these, email support@goldenpicks.app from the address on your account. We will respond within the period your local law requires — one month under UK and EU law, 45 days in California. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we handled your data, you may complain to your local data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk).

10. Security

Traffic is encrypted in transit. Passwords are stored only as bcrypt hashes and reset tokens only as SHA-256 hashes, so neither can be recovered from our database. Access to production data is limited to those who need it. No system is perfectly secure, but if a breach affects your personal data and poses a risk to you, we will notify you and the relevant regulator as the law requires.

11. Children

GoldenPicks is strictly for adults of legal gambling age and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

12. Changes

If we change this policy in a way that materially affects how we handle your data, we will notify registered users rather than only updating this page.

13. Contact

support@goldenpicks.app