Privacy Policy
Effective · Last updated
How StoryBound Tech LLC collects, uses, shares, and protects personal information when you use PickBound. We do not sell your personal information and we do not run advertising.
01Introduction
This Privacy Policy explains how StoryBound Tech LLC ("we", "us", "our"), operating as PickBound, collects, uses, discloses, and protects personal information when you use the PickBound website, mobile applications, and related services (together, the "Services"). It applies to everyone who uses the Services, and it forms part of our Terms of Use.
If you do not agree with this policy, please do not use the Services. If you have questions after reading it, contact us using the details at the end.
02Personal Information We Collect
Information you give us
- Account information — the email address, password, username, and display name you provide when you register. Passwords are handled and stored in hashed form by our authentication provider; we never see or store your password.
- Sign in with Apple — if you sign in with Apple, we receive the identifier Apple issues for your account and the email address you choose to share, which may be a private relay address rather than your real one.
- Purchase information — if you buy a season pass, our payment processor gives us the transaction identifiers, amount, currency, and status. We never receive or store your full payment card number.
- Support and reports — the content of messages you send us, and the content of any report you file about another player, including the reason you select and any duel you reference.
Information we collect automatically
- Technical and log data — IP address, browser and device characteristics, operating system, referring pages, and timestamps, recorded in the request logs kept by our hosting provider.
- Approximate location — a country- and region-level estimate derived from your network connection, used only to determine whether the Services are available where you are.
- Product analytics — a closed set of server-side events describing how the Services are used (for example, that a screen was viewed or a duel was created). These are recorded on our servers rather than through third-party tracking scripts.
- Diagnostics — error and performance information generated when something goes wrong.
- Push notification tokens — if you turn on notifications in our iOS app, Apple issues an anonymous device token identifying that installation, and we store it so we can send you notifications about your own activity: a duel settling, a challenge or friend request arriving, or a ranked entry finding an opponent. The token identifies a device and app installation, not you personally, and is never used for advertising or shared with anyone but Apple in the course of delivering a notification. We delete it when you delete your account, when Apple tells us the app has been uninstalled, and after a prolonged period with no activity; we also try to delete it when you sign out, though if your device is offline at that moment it is removed by one of the other routes instead. Signing out stops your device receiving notifications either way. You can turn notifications off at any time in your device settings, and nothing else about the Services changes if you do.
03Gameplay and Profile Information
Playing the Services necessarily creates a record of play. We store your duels, the picks and chip stakes on each slip, settlement outcomes, coins, cosmetic items owned and equipped, rating and tier, win/loss/tie record, streaks, achievements, season progress, daily play allowance, friends, blocks, and head-to-head records against other players.
What other players can see
The Services are social by design. Your username, avatar frame, equipped badges, rating tier, record, streaks, achievements, and your head-to-head record against a given player are visible to other players, including on player profiles, the friends leaderboard, and duel screens.
What stays private
- An un-submitted slip draft is never shown to anyone but you.
- A submitted slip is hidden from your opponent until both players have locked in — or until the event begins — and is then shown to that opponent, which is how the game works.
- Your email address, coin balance, purchase history, blocks, and reports are not shown to other players.
- The list of players you have blocked is visible only to you. We do not tell anyone that they have been blocked.
Shareable result cards
The Services can generate an image summarising a player's record or a head-to-head rivalry so it can be shared. Those images live at web addresses that anyone holding the link can open, without signing in. They contain only public profile information — username, tier, record — but if you share one, treat the link as public.
04Sensitive Personal Information
We do not seek, and the Services have no field for, sensitive personal information as defined under the California Consumer Privacy Act or comparable laws — no government identifiers, precise geolocation, financial account numbers, health, biometric, racial or ethnic origin, religious belief, sexual orientation, or union membership data.
We do not sell or share sensitive personal information, and we do not use it to infer characteristics about you. Please do not include sensitive information in a username, display name, or support message.
05How We Use Personal Information
We use personal information to:
- create and maintain your account and authenticate you;
- run the game — matching opponents, accepting slips, settling duels, updating ratings, minting coins, granting cosmetic items and achievements, and tracking your daily play allowance;
- operate the social features you use, including friends, rivalries, the activity feed, blocking, and reporting;
- process season pass purchases and handle refunds, disputes, and chargebacks;
- send you service messages such as account verification, security notices, and changes to these policies;
- respond to your support requests;
- protect the Services — detecting and preventing multi-accounting, collusion, automation, abuse, fraud, and security incidents, and enforcing our Terms of Use;
- understand how the Services are used in aggregate so we can fix problems and improve the product;
- comply with legal obligations and establish, exercise, or defend legal claims.
We do not use your personal information for advertising, and we do not build advertising or marketing profiles about you.
Where a law such as the GDPR requires a legal basis, we rely on: performance of our contract with you (running the Services); our legitimate interests (security, integrity, and product improvement); your consent, where we ask for it; and compliance with legal obligations.
06How We Disclose Personal Information
WE DO NOT SELL YOUR PERSONAL INFORMATION, AND WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING.
We disclose personal information only in these situations:
- To other players — the public profile and gameplay information described above.
- To service providers — the vendors listed below, who process information on our behalf and under contract, and who may not use it for their own purposes.
- For legal reasons — where we are required by law, subpoena, or other legal process, or where disclosure is necessary to investigate a violation, protect our rights or property, or protect someone's safety.
- In a business transfer — if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will tell you if it becomes subject to a materially different privacy policy.
- With your consent — for anything else.
07Retention and Deletion
We keep personal information for as long as you have an account, and afterwards only for as long as we need it for the purposes described in this policy or as the law requires.
Deleting your account
You can permanently delete your account — from within the Services where that control is available, or by emailing support@pickbound.app from the address on your account. For your protection, we re-verify who you are before deleting: with your password, or with a fresh Sign in with Apple authorization. Deletion is immediate and irreversible — your profile, cosmetic items, coins, rating, season progress, friends, and blocks are removed, and we cannot restore them.
If you signed in with Apple, deleting your account also revokes the authorization Apple issued to us, so the connection between your Apple ID and the Services is severed.
What survives deletion, and why
- Your completed duels remain in your opponents' history, re-attributed to an anonymized placeholder player. Your username and account are gone from them. This exists so that deleting your account cannot erase another player's record, rating history, or results.
- Records of payments are retained for as long as tax, accounting, audit, and anti-fraud law requires — this is evidence of a transaction, and it is the one category we cannot delete on request.
- Safety records, including reports filed about conduct, are retained where we need them to protect other players or to establish or defend a legal claim.
- Product analytics events are linked to your account internally, are never shared, and are deleted automatically after 13 months.
- Routine backups and server logs age out on their normal schedule; deleted data disappears from them as those cycles complete.
08Data Security
We protect personal information with technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), managed authentication with hashed credentials, database-level access rules that scope records to the account they belong to, server-side enforcement of every economy and settlement operation, and restricted internal access to production systems.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you send information to us at your own risk. Use a strong, unique password and tell us immediately if you suspect unauthorized access to your account.
10Service Providers
We rely on a small number of vendors to run the Services. Each processes personal information on our behalf, under contract, and is not permitted to use it for its own purposes.
- Supabase — Database, authentication and file storage. Privacy policy
- Vercel — Application hosting, edge delivery and server logs. Privacy policy
- Stripe — Payment processing for season pass purchases. Privacy policy
- Apple — Sign in with Apple authentication, where you choose it. Privacy policy
We may add or replace providers as the Services evolve; we will keep this list current.
11Sports Data Providers
Schedules, prices, scores, and player statistics come from third-party sports-data providers. Information flows from them to us, not the other way. We do not send your personal information to any sports-data provider, and they receive nothing that identifies you or your play.
12California "Shine the Light" Disclosure
California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about the personal information we disclosed to third parties for their own direct marketing purposes in the previous calendar year. We do not disclose personal information for third-party direct marketing. You may confirm this by writing to support@pickbound.app.
13California Privacy Rights
If you are a California resident, the California Consumer Privacy Act, as amended, gives you the right to know what personal information we collect and how we use and disclose it; to access a copy of it; to correct inaccurate information; to delete it, subject to the exceptions described under Retention and Deletion; and not to be discriminated against for exercising these rights.
We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months, so there is no "Do Not Sell or Share My Personal Information" link to provide.
To exercise a right, email support@pickbound.app from the address on your account, or use the equivalent control inside the Services where one is offered. We will verify your request against your account before acting on it, and you may use an authorized agent.
14Other State and Regional Privacy Rights
Residents of other U.S. states with comprehensive privacy laws — and individuals covered by the GDPR or UK GDPR — have comparable rights to access, correct, delete, and obtain a portable copy of their personal information, to withdraw consent, and to object to certain processing. We honour these requests through the same channel and on the same terms as the rights described above.
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority.
15International Data Transfers
The Services are hosted and operated in the United States. If you use them from outside the United States, your information is transferred to, stored in, and processed in the United States, where data-protection law may differ from the law where you live. By using the Services you consent to that transfer.
16Data Breach Notification
If a security incident compromises your personal information, we will investigate it, take steps to contain and remediate it, and notify you and any relevant authority as applicable law requires and within the timeframes it sets.
17Children and Minors
The Services are intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18.
If we learn that we hold information from someone under 18, we will delete it and close the account. If you are a parent or guardian and believe your child has given us personal information, contact us at support@pickbound.app and we will act promptly.
18Content You Submit
You keep whatever rights you hold in the content you submit — your username, display name, and anything you send us. We use it only to operate, secure, and improve the Services, as described in the Terms of Use.
We do not share your content with third parties for their own marketing purposes, and we do not use it to train advertising models.
19Your Privacy Choices
Wherever you live, you can:
- Access and correct your account information from your profile inside the Services;
- Delete your account permanently, subject to the exceptions under Retention and Deletion;
- Request a copy of the personal information we hold about you;
- Withdraw consent where we rely on it, without affecting processing already carried out;
- Opt out of marketing email. We currently send service email only — account verification, security notices, and changes to these policies — which cannot be opted out of while you hold an account. Any marketing email we ever send will carry an unsubscribe link.
To make a request we cannot handle in-app, email support@pickbound.app from the address on your account. We respond within the time the applicable law allows, and we never charge for a first request or penalise you for making one.
20Do-Not-Track Signals
Most browsers offer a "Do-Not-Track" setting. No uniform standard for honouring it has been adopted, so we do not currently respond to DNT signals. This does not change what we do: we do not track you across other websites or services in the first place. If a standard is adopted, we will update this policy.
21Limitation of Liability
To the fullest extent permitted by law, we are not liable for indirect, incidental, special, consequential, or punitive damages, or for loss of data or other intangible losses, arising from your use of the Services or from this policy. The limitation of liability in our Terms of Use applies to this policy as well.
22Governing Law
This policy is governed by the laws of the United States and the State of Maryland, without regard to conflict-of-law principles, and disputes about it are resolved as set out in our Terms of Use. Nothing here limits any non-waivable right you have under the law where you live.
23Changes to This Policy
We may update this policy as the Services change or as the law requires. The "last updated" date at the top of this page tells you when it last changed, and an updated policy takes effect when it is posted.
Where a change is material, we will make reasonable efforts to notify you — in the app, on this site, or by email — before it takes effect. Please review this page periodically.
24Contact Us
Questions, requests, or complaints about this policy or about how we handle your personal information go to StoryBound Tech LLC at support@pickbound.app.