Privacy policy

In short

BlindPick uses your data only to run your club and the game. No ads, no analytics, no tracking, no selling of data. Your club name and display name are public in the game.

Who is responsible

Controller under the GDPR for blindpick.net and the BlindPick apps:
Beda Reichlin
Stubenrauchstraße 36
12161 Berlin
Germany
Email: [email protected]

Playing as a guest

When you open BlindPick, we create an anonymous account for you without asking for any details. We store a random account ID and sign-in tokens, your club (name, league, lineup, signings and sales, scores, Elo), your display name, your friend leagues, your fan MVP votes and a play-time counter (when you used the app, for the free hours).

Legal basis: Art. 6(1)(b) GDPR, because we need this data to provide the game you use.

Signing in

With an email code we store your email address and send the code through our email provider Resend. With Google or Apple we receive your account ID with that provider and, if the provider shares them, your name, email address and profile picture. Apple can hide your real address behind a relay address.

Legal basis: Art. 6(1)(b) GDPR. Signing in is optional; it keeps your club on every device and lets you restore a purchase.

What other players can see

Your club name, display name, lineup, results, rank and Elo appear in leaderboards, matchups and public club pages, which anyone can open without an account. Members of a friend league see the other members' clubs. Do not use your real name if you do not want it to be public.

Purchases

On the web, the €2.99 unlock is paid through Stripe (Stripe Payments Europe, Ltd., Ireland). Your card details go to Stripe, not to us. We receive the payment ID, amount, currency, status and the email address you used.

In the apps, Apple or Google sell the unlock and process the payment. RevenueCat, Inc. (USA) checks the store receipt for us and tells us that your account bought the unlock.

Legal basis: Art. 6(1)(b) GDPR; we keep purchase records as German tax and commercial law requires (Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB).

Hosting and service providers

Convex, Inc. (USA) runs our backend; your game data is stored in the EU (Ireland). Cloudflare, Inc. (USA) delivers the website and, like every web server, processes your IP address and request details to deliver pages and fend off attacks (Art. 6(1)(f) GDPR, our interest in a secure service). Resend (USA) sends sign-in emails.

All providers process data only on our instructions under data processing agreements (Art. 28 GDPR). Where data reaches the USA, the transfer relies on the EU-US Data Privacy Framework if the provider is certified, otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

Storage on your device

The app stores your sign-in token and a few settings on your device (browser storage or the phone's secure storage). This is strictly necessary for the service you asked for (§ 25(2) No. 2 TDDDG) and needs no consent. We set no tracking cookies and use no analytics, advertising or crash-reporting tools. Fonts and player photos ship with the app, so no third party learns that you opened it.

Email to us

If you write to us, we use your message and address to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when the matter is settled, unless the law requires us to keep them.

Deleting your account

In the app or on blindpick.net: Profile → Delete account. This deletes your sign-in details, ranked profile, friend-league memberships, ledger and play-time record at once. Your club leaves the game; in other players' past fixtures it stays as "Deleted club" without its name. Fan MVP votes stay in the totals but no longer lead to you. Purchase records are kept for the periods tax law requires (up to 10 years).

Without the app, write to [email protected] from the address you signed in with, or give us your club name; we delete the account within 30 days.

How long we keep data

Your account data stays as long as your account exists, until you delete it. Purchase records are kept for the periods required by tax law (up to 10 years). Server logs are kept briefly by our providers for security.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Write to [email protected]. You can also complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

Age

BlindPick is meant for people aged 16 or older. Younger players need a parent's permission, in particular for a purchase.

Changes

We update this policy when the app changes. The date at the top shows the current version.