This Privacy Policy describes how SquadPicks ("we", "us", "our") collects, uses, and protects your personal information when you use our platform at squadpicks.io ("Service"). It applies to users worldwide, with specific provisions for users in Canada and India.
This policy is designed to comply with:
| Data | Source | Why we collect it | Legal basis |
|---|---|---|---|
| Name | Google / Telegram OAuth | Display your name in your squad; identify you to other members | Consent (signup) |
| Email address | Google OAuth | Squad invites, digest emails, account recovery | Consent (signup) |
| Profile photo | Google / Telegram OAuth | Display your avatar in squad interfaces | Consent (signup) |
| Notification preferences | You set them at signup | Determine which emails to send you | Consent (signup) |
| Picks, votes, ratings | You create them | Core functionality — sharing picks with your squad | Consent / contract performance |
| Consent record | Signup flow | Compliance audit trail (T&C accepted, timestamp, version) | Legal obligation |
| Approximate country | IP-derived header (Cloudflare) | Apply the correct legal framework; serve relevant regional content | Legitimate interest |
| Session cookie | Browser | Keep you logged in for 7 days | Consent / legitimate interest |
We collect only the data listed above. We do not access your messages, call logs, banking information, contacts, or device location.
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
Depending on where you are located, you have the following rights over your personal data:
To exercise any of these rights, email privacy@squadpicks.io. We will respond within 30 days (or the shorter period required by applicable law). Identity verification may be required before we process your request.
Canadian residents may also file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. Quebec residents may also contact the Commission d'accès à l'information du Québec (CAI).
Indian residents ("Data Principals") have the rights of access, correction, erasure, and grievance redressal under the DPDP Act. You may also nominate a representative to exercise rights on your behalf. To file a complaint with the Data Protection Board of India, visit the Board's official portal when available.
We use a single session cookie to keep you logged in (valid 7 days, HTTP-only, secure). We do not use third-party advertising cookies or cross-site tracking pixels. If we add analytics in the future we will update this policy and request fresh consent if required.
We implement industry-standard technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), HTTP-only secure session cookies, HMAC-based Telegram auth verification, and role-based access controls in our database. No system is 100% secure; if you discover a vulnerability please report it responsibly to security@squadpicks.io.
Our database is hosted on Supabase, which may store data in AWS regions outside Canada or India. By using the Service and providing consent, you acknowledge this transfer. We ensure our hosting providers maintain adequate data-protection standards. Canadian users: transfers are made under PIPEDA's cross-border transfer provisions. Indian users: we will comply with any data-localisation requirements as mandated under the DPDP Act once corresponding rules are notified.
The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us at privacy@squadpicks.io and we will delete it promptly. Users aged 13–17 may only use the Service with parental consent.
We send marketing emails only to users who have provided explicit (express) consent at signup or in account settings. Every marketing email includes:
Transactional emails (pick notifications, squad invites, weekly digest) are sent based on your notification preferences, which you can change at any time in Settings → Notifications.
We will notify you of material changes by email (if we have your address) or by displaying a banner on the platform at least 14 days before changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. We record which version of the Privacy Policy you consented to.
Our Privacy Officer is responsible for overseeing compliance with PIPEDA and Quebec Law 25 and handling access and correction requests from Canadian residents.
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer for Indian residents ("Data Principals").
This policy covers users globally with specific provisions for Canada (PIPEDA, Quebec Law 25, CASL) and India (DPDP Act 2023, IT Act 2000). See our Terms of Service for platform usage rules.