Privacy Policy

1. Information you provide

• Account & sign-in. You can sign in with Apple, Google, or an email and password. We receive an account identifier and, depending on the method, your email address and name. Apple Sign In may relay a private email address.
• Profile. Your username, display name, bio, and a profile photo you choose to upload, plus team and deck names.
• Age confirmation. You must confirm that you are at least 13 before creating an account or signing in. Older accounts may retain an age band supplied under an earlier version of the Service.
• Content you post. Community posts, replies, suggestions, and messages in team and league chat.
• Support & requests. Messages you send us, including feedback, creator change requests, privacy requests, and creator takedown requests.

2. Information collected automatically

• Gameplay data. Your collection, decks, matches, leagues, teams, missions, purchases of virtual items, and other in-game activity tied to your account.
• Device & technical data. Device type and name, operating system, app version, language and time zone, a per-install identifier, and IP address.
• Push tokens. If you enable notifications, a push token (via Expo, Apple Push Notification service, and/or Firebase Cloud Messaging) so we can send you notifications.
• Analytics & diagnostics. We use Firebase Analytics and Crashlytics to understand usage and diagnose crashes and errors. This includes app events, purchase events and crash reports associated with your account identifier, app-instance identifiers, device information and approximate location derived from IP addresses. Google advertising use of Analytics data is controlled separately, as described below. Crashlytics remains a diagnostic service.
• Optional advertising measurement. In app versions with these integrations, advertising measurement starts off and we do not show an automatic measurement prompt during sign-in, onboarding or gameplay. If you want to enable it, open Profile → Settings → Ad measurement to review the disclosure and confirm that you are 18 or older and choose to allow it. On iPhone, Apple’s tracking permission must also be allowed before we enable this optional measurement. You can keep it off and still use all game features. The choice applies to your signed-in account on that installation.
• TikTok (iOS and Android). After the required permission, the TikTok App Events SDK sends installation and app-opening events, SDK-generated identifiers, IP address, device and app details, language settings, and SDK technical data. On iOS, this includes IDFA and IDFV identifiers and SDK session, performance and diagnostic data. On Android, advertising-ID collection, automatic purchase logging, enhanced interface-data capture and SDK metrics are disabled; install-referral information may be used to measure installations. TikTok can combine this information with information from its services to attribute and improve our advertising. We do not send TikTok your StreamPicks account ID, name, email, messages, gameplay content or purchases. Automatic screen capture, interface-content capture and deep-link URL capture are disabled.
• Meta (Facebook and Instagram). After the required permission, Meta’s App Events SDK measures installations and app openings. It receives app-instance/device identifiers, IP address, device and app information, install-referral information where available, and event/session and SDK technical data. On iOS this may include the advertising identifier after Apple’s permission; we disable Android advertising-ID collection. Meta may combine this information with data from its services for advertising measurement and improvement. We do not provide Meta with your StreamPicks account ID, name, email, phone number, messages, gameplay content or purchases. Automatic event and purchase logging, interface metadata and content capture, and codeless tracking are disabled.
• Google Ads. If you allow optional measurement, we enable advertising measurement use of our existing Google Analytics for Firebase data, including app installations and interactions, account and app-instance identifiers, device information, approximate location and purchase events. Google may use this information with advertising-interaction data to measure conversions. We also include Google’s on-device conversion measurement component on iOS. We do not supply email addresses or phone numbers for enhanced conversions. Google ad personalization remains disabled in the app. Firebase’s advertising-ID collection is disabled.
• Apple install measurement. We may also use Apple's SKAdNetwork to receive delayed, aggregate advertising results. Apple's postbacks do not identify you to us, and this measurement does not require allowing cross-app tracking.
• Website use. When you sign in at streampicks.app/account, we record each visit: when it starts, how long the page is open and in view, how you signed in, your device type (phone, tablet, or computer), and what you do there, such as saving decks or claiming rewards. These records are linked to your account. We don't use cookies or third-party trackers for them, and we don't store your IP address or browser details in them.
• Website sign-in. The website keeps you signed in using your browser's session storage for that tab only, and clears it when you close the tab. A Cloudflare Turnstile check runs when you sign in to block bots.

3. Creator information & card content

StreamPicks features real, publicly known creators. To do this we collect and store publicly available creator information — such as channel name, handle, public subscriber and view counts, thumbnails, and descriptions — from public sources and third-party platform APIs (including the YouTube Data API), and we use it to power gameplay.

We also create original, stylized card artwork for creators and host and serve that artwork from our own infrastructure (a cloud storage bucket we control), which the app downloads. In some places we may also display public profile images retrieved from third-party platforms. Creator names, marks, and likenesses remain the property of their respective owners. Creators and their representatives can request removal — see Section 10 and streampicks.app/takedown.

4. How we use information

• operate and provide the Service, including accounts, gameplay, leagues, the economy, and purchases;
• personalize your experience and send notifications you've enabled;
• moderate content and keep the community safe;
• measure performance, fix bugs, and improve features;
• measure which ads lead to app installations, openings and other conversions, using Apple’s aggregate reporting and, when you allow optional measurement, TikTok, Meta and Google;
• prevent fraud, abuse, and cheating, and enforce our Terms;
• respond to your support and privacy requests, and comply with legal obligations.

We do not sell personal information for money. If you allow the optional advertising measurement described above, data is shared with the applicable advertising partners and may be combined across services. This can be considered “sharing” or a “sale” under some privacy laws. You can decline or withdraw this permission without losing access to StreamPicks. Where consent is required for this optional processing, we rely on your consent; withdrawing it does not affect processing that already occurred.

5. Service providers we share with

We share information with vendors that help us run StreamPicks, under their own privacy terms:

• Google Firebase — authentication, database (Firestore), cloud functions, file storage, cloud messaging, analytics, Crashlytics, and abuse prevention (App Check / Play Integrity / App Attest).
• RevenueCat and the Apple App Store / Google Play — to process and validate purchases and subscriptions (your account identifier is used to link entitlements).
• Apple and Google — sign-in.
• Cloudflare — hosting of creator card artwork, and a bot-protection check (Turnstile) on website forms and website sign-in.
• Expo — app updates and push delivery.
• TikTok — optional iOS and Android advertising measurement, with the permissions described in Section 2. See TikTok’s Privacy Policy.
• Meta (Facebook and Instagram) — optional app advertising measurement, with the permissions described in Section 2. See Meta’s Privacy Policy.
• Google Ads / Google Analytics — optional advertising measurement using the Analytics data described in Section 2. See Google’s Privacy Policy and how Google uses information from apps and sites that use its services.
• Public platform APIs (e.g., the YouTube Data API) — to retrieve public creator information, server-side.

We may also disclose information to comply with law, enforce our Terms, or protect rights, safety, and the integrity of the Service.

6. Data retention

We keep information for as long as your account is active and as needed to provide the Service, then retain limited data as needed to comply with legal obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. Some records (for example, security and moderation logs) may be retained in a limited, de-identified, or minimal form after account deletion.

Website visit records are deleted automatically after about 13 months. Daily totals that don't identify anyone may be kept longer.

Turning off measurement disables new optional install/open event logging to TikTok and Meta and withdraws Google advertising consent. Requests already started may finish. Advertising partners retain information already received according to their applicable policies and settings; turning off measurement does not itself erase that information. See our data deletion page for requests.

7. Your choices & rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. California residents and EU/UK users have these rights under the CCPA/CPRA and GDPR/UK GDPR.

• Delete your account & data: in the app, go to Settings → Account → Delete Account, or see our data deletion page. This also deletes your website records.
• Access / copy your data: use the in-app About → Privacy Requests option, or email us (see Section 12). This includes your website records. We verify requests before fulfilling them.
• Notifications: manage push notifications in the app and your device settings.
• Advertising measurement / do not sell or share: measurement stays off unless you deliberately enable it through Profile → Settings → Ad measurement. You can decline there or return and choose Turn off in versions with this control. On iPhone you can also choose “Ask App Not to Track” in Apple’s prompt, or turn off StreamPicks under iPhone Settings → Privacy & Security → Tracking. Denied or restricted Apple tracking permission keeps optional partner measurement off. These choices do not disable the game or Apple’s separate aggregate install reporting. They do not automatically delete data previously received by partners; see our deletion instructions or contact us for help.

Optional advertising sharing stays off unless you make the required choices. Our website-account visit records are separate from these mobile SDK integrations. You can also contact us at support@streampicks.app to exercise privacy rights, including opting out of sale or sharing where applicable.

8. Children's privacy

StreamPicks is intended for users aged 13 and over and is not directed to children under 13. You must be at least 13 years old to create an account, and you confirm your age when you sign up. We do not knowingly collect personal information from children under 13; if we learn that an account belongs to a child under 13, we will disable the account and delete any associated personal information. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

Optional advertising measurement requires a separate confirmation that you are at least 18. Players under 18 should keep it off; all game features remain available.

9. Security & international transfers

We take reasonable technical and organizational measures to protect information, but no method of transmission or storage is completely secure. Our providers operate globally, so your information may be processed in countries other than where you live, including the United States. You are responsible for keeping your account credentials confidential.

10. Creators & takedown requests

If you are a featured creator, or are authorized to act for one, and you want your name, likeness, or content removed from StreamPicks, submit a request at streampicks.app/takedown or email support@streampicks.app. See Section 4 of our Terms for how creator content is used and removed.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we’ll revise the “Last updated” date and provide additional notice where required. We will request consent where required for a new optional use of information; continuing to use the Service does not itself grant advertising-measurement consent.

12. Contact

Questions or privacy requests? Contact us at support@streampicks.app.