Privacy Policy

Data Controller

PandaPicks is the data controller for personal data processed through this service. You can reach us at support@pandapicks.co.uk for any privacy-related questions, requests, or complaints.

Information We Collect

We collect account details you provide (such as email address and username), content you submit (deals, comments, votes), and usage data needed to operate and improve the platform. With your consent, we also collect analytics data: on the web this includes pages visited, clicks, masked session recordings, and device/browser information; in our mobile apps it includes screens viewed, taps, and device information (the apps do not record sessions). Inputs in web session recordings are automatically masked, so values you type into form fields (including passwords) are not captured.

Legal Bases for Processing

Under UK GDPR we rely on the following legal bases:

• Performance of a contract — to create and maintain your account, deliver core features, and send transactional emails (such as sign-in confirmations, password resets, and deal alerts you have requested).
• Legitimate interests — to keep the platform secure, prevent abuse and fraud, log errors, and improve the service. You can object to processing based on legitimate interests at any time.
• Consent — for analytics (on the web and in our mobile apps), web session recordings, and any non-essential cookies. You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation — where we must process data to comply with applicable law.

Age Requirement

PandaPicks is not intended for children under 13. By creating an account you confirm that you are at least 13 years old. If we become aware that we have collected personal data from a child under 13 without parental consent, we will delete it.

How We Use Information

We use your information to provide core product features, personalise your experience, keep the platform secure, and communicate important service updates. Analytics data is used solely to understand how the platform is used and to improve it.

Service Providers

We use trusted third-party processors to operate the platform. They process personal data on our behalf under contractual safeguards.

• Supabase — hosts our database, authentication, and stored content. See Supabase's Privacy Policy at supabase.com/privacy.
• Resend — sends transactional emails such as confirmations, password resets, and deal alerts. Emails may include tracked links so that we can understand which content is useful; tracking is limited to recording that a link was clicked and is served via a subdomain we control. See Resend's Privacy Policy at resend.com/legal/privacy-policy.
• Sentry — collects diagnostic information when an error or crash occurs (such as the screen or page involved, the app or browser version, your device and operating system, and a stack trace) so we can fix bugs. It does not capture the contents of your account. See Sentry's Privacy Policy at sentry.io/privacy.

Cookies and Analytics

With your consent, we use the following analytics services:

• PostHog — a product analytics platform. On the web it collects pageviews, clicks, form interactions, and masked session recordings, and may set cookies to identify returning visitors. In our mobile apps it collects screens viewed, taps, and device information only — no session recordings and no cookies. Data is processed on PostHog's EU cloud infrastructure. See PostHog's Privacy Policy at posthog.com/privacy.
• Google Analytics 4 — a web analytics service (used on our website only, not in the mobile apps) operated by Google LLC. It collects pageviews, session data, and device/browser information and may set cookies. Data may be processed by Google on servers in the US and other countries. See Google's Privacy Policy at policies.google.com/privacy.

Analytics is off until you opt in: on the web via our consent banner, and in our mobile apps via the first-run consent prompt. You can withdraw consent at any time — on the web using the "Manage cookies" link in the footer (which re-opens the banner), and in the mobile apps via Settings → Privacy → Analytics. Withdrawal is as easy as the original consent and does not affect the lawfulness of any processing carried out before withdrawal.

Data Sharing and International Transfers

We do not sell personal information. Some of our service providers (notably Google Analytics, Sentry, and Resend) may process data outside the UK and EEA. Where this happens, transfers are protected by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or another lawful transfer mechanism.

Data Retention

We retain personal data only as long as we have a lawful basis to do so:

• Account and content data — kept while your account is active and for up to 30 days after deletion to allow recovery and to meet operational requirements.
• Analytics — retained for up to 12 months by PostHog (including web session recordings), and according to Google Analytics' default 14-month retention (web only).
• Error and security logs — kept for up to 90 days.
• Email delivery logs — retained by Resend for up to 30 days for diagnostic purposes.

We may retain limited data for longer where required by law (for example, to respond to legal claims or comply with regulatory obligations).

Security

We apply reasonable technical and organisational safeguards to protect your data, including encryption in transit, role-based access controls, and database row-level security. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Your Rights and Choices

Under UK GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You can update account details, manage alerts, and request account removal through available settings or by emailing support@pandapicks.co.uk. You may decline or withdraw analytics consent at any time — on the web via the cookie banner or the "Manage cookies" link in the footer, and in our mobile apps via Settings → Privacy — this will not affect your ability to use PandaPicks.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.

Account Deletion

You can delete your account at any time from Settings → Delete account in the PandaPicks iOS app, Android app, or website, or by emailing support@pandapicks.co.uk from your registered address. You do not need the app installed to request deletion — a public deletion page is available at www.pandapicks.co.uk/account-deletion.

When you delete your account we anonymise it immediately rather than erasing every record, so community discussions and vote tallies stay coherent. Your private data is deleted or irreversibly scrambled: your email address and password are randomised and sign-in is permanently disabled, your username, avatar and badges are cleared, and your saved deals, keyword alerts, notifications and preferences are removed. Your marketing-email contact and uploaded avatar file are deleted from our email provider and storage, and the text of your comments is replaced with "[deleted]".

Public content you created — deals, votes and comment threads — remains visible but is detached from your identity and shown under an anonymised author, so it can no longer be linked back to you. Residual personal data in backups and diagnostic logs is purged on the schedules described under "Data Retention" above. If you would like your public content removed entirely as well, contact support@pandapicks.co.uk.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the platform or email. The "Last updated" date at the top of this page shows when it was last revised.