1. Introduction

Welcome to Pick5 ("we," "our," or "us"). This Privacy Policy explains what information we collect, how we use it, who else sees it, and what happens to it when you delete your account. It covers the Pick5 mobile app, the website at www.pick5.io (including prize claim pages), and our Jamalytics setlist pages.

2. Information We Collect

Information you give us

• Account: your mobile phone number and/or email address, and your username. If you choose to, a password and passkeys for signing in. Passwords are stored hashed by our authentication provider; we never see them.
• Profile: a profile picture you upload, and the banner, badges, title and band you choose to display.
• Game activity: your picks for each show (including the history of edits you make before a show locks), Wild Card bets, scores, streaks, badges, tournament entries, season standings and the in-game items in your account.
• Social activity: friends and friend requests, clubs you join, show chat and club chat messages, direct and group messages, reactions, pick nudges you send, and the people you block or report.
• Show Locker: shows you mark as went, going or maybe. Only you can see these.
• Suggestions and support: what you send us through the in-app suggestion box (with your username and app version) or by email.
• Prize claims: if you win a physical prize, the shipping details you enter. See section 5.
• Purchases: if you buy an extra username change, Apple handles the payment. We receive a record of the purchase, not your payment details.
• Linked accounts: if you choose to connect a Synth account, we store Synth's ID for that account.

Information collected automatically

• Usage events: a short list of actions, such as screens viewed, picks submitted, notifications opened, shares tapped and searches on venue lot maps, with the platform (iOS, Android or web) and time. Website page views from signed-out visitors are recorded without an account. We delete these events after 180 days.
• Last active: roughly when you last used Pick5 (updated at most once an hour).
• How you found us: when you sign up, we record the website that sent you (the site name only, not the full address), any campaign tags or ad click IDs in the link you arrived on, the page you landed on, and the referral code you used. This is held on your device for up to 90 days before sign-up and stored once, with your account, when you choose a username.
• Push notification token: if you allow notifications, the token your device gives us so we can reach it.
• Failed sign-in attempts: the username, email or phone number typed and the time, so we can limit password guessing.
• Website visit counts: through Vercel Web Analytics, which is cookieless and gives us page-level totals rather than a profile of you.
• IP addresses: our hosting providers see your IP address when they serve a request and may keep it in their logs. We do not store IP addresses or device identifiers in our own database.

Device permissions

The app asks for the camera only to scan Pick5 codes, for your photo library only when you choose a profile picture, and for permission to send notifications. It does not use your location, your contacts or your microphone.

3. How We Use Your Information

We use your information to:

• Provide, operate and maintain Pick5
• Sign you in with a one-time code by text or email, a password or a passkey
• Score your picks and run leaderboards, tournaments, seasons, clubs and chat
• Send you notifications about shows, results, friends and messages, as your notification settings allow
• Award prizes and ship physical ones
• Credit referrals and measure which links and campaigns bring new players
• Enforce our rules: filter blocked words in chat, handle reports, and keep banned players from coming back under a new account
• Respond to suggestions and support requests
• Understand how Pick5 is used and improve it, including the models behind our setlist predictions

4. Sharing Your Information

• Other players: your username, profile picture, badges, scores and place on leaderboards are visible to other players. Once a show is final, your picks for it and your score can be seen with your username. What you post in show chat and club chat is visible to the people in that chat, and messages are visible to the people you send them to.
• Our social accounts: show recaps we post on Pick5's own social media accounts (such as X and Instagram) can include a show's top players' usernames, profile pictures and scores.
• Prize partners: if a partner ships a prize you won, they get your name and shipping details for that purpose. See section 5.
• Synth: only if you connect your account. Synth receives a random link ID that we create for the connection, not your Pick5 account ID, phone number or email. When you disconnect or delete your account, we tell Synth the link is gone.
• Service providers: the companies listed in section 10, each for the service it provides to us.
• Legal requirements: if required by law or to protect the rights and safety of Pick5 and its players.

We do not sell your personal information, and we do not share your mobile phone number with any third party for marketing or promotional purposes. Your phone number is used to sign you in, to keep banned accounts from returning, and, if you win a prize, to tell our team who won.

5. Prizes

Some shows and seasons have prizes. When you win one, the Pick5 account sends you a direct message.

• In-game prizes (a banner, a trophy and the like) are added to your account. We collect nothing extra for them.
• Physical prizes: the message links to a private claim page on www.pick5.io where you enter your name and mailing address, and optionally a phone number and a note for the shipper. Anyone with that link can see the prize, your username and what you entered, so keep the link to yourself.
• Who sees it: we use these details only to send your prize. Our team gets the list of winners and their shipping details by email, and may keep it in a spreadsheet to ship from. If a partner ships the prize (for example, TrainSongz sends the zine), they get your name and address for that.
• How long we keep it: the details stay with your prize record. Ask support@pick5.io to delete them at any time. Deleting your account deletes them too.

6. Messages and Notifications

• Push notifications go through Expo and then Apple or Google to your device. A notification about a direct message or club chat shows the sender's name and the start of the message. You can turn notifications off in the app or in your device settings.
• Messages from Pick5: the official Pick5 account may send you direct messages, such as announcements, giveaways and prize claims.
• Email: we email you only for your account, such as sign-in codes. We do not send marketing email.

7. SMS / Text Messaging

Pick5 uses SMS text messaging solely to authenticate users. When you sign in with your phone, you provide your mobile phone number and we send a 6-digit one-time passcode (OTP) to that number via our SMS provider, Twilio, Inc. By providing your phone number and tapping "Send Code," you consent to receive an authentication text message from Pick5. Phone sign-in is available for US and Canadian numbers only.

• Message purpose: Account authentication only. We do not send marketing, promotional, or advertising messages.
• Message frequency: One message per sign-in attempt. Typical users receive a message only when logging in on a new device or after signing out.
• Message & data rates: Standard message and data rates from your mobile carrier may apply. Pick5 does not charge you for these messages, but your carrier may.
• Opt-out: You can stop receiving SMS from Pick5 at any time by replyingSTOP to any message from us, by asking us to remove your phone number, or by deleting your account. Once you opt out, you will no longer be able to sign in by text. You can still sign in with an email code, a password or a passkey if you have set one up; otherwise contact support to recover your account.
• Help: Reply HELP to any message from us, or email support@pick5.io for assistance.
• No sharing with third parties: We do not share mobile phone numbers or the contents of SMS messages with any third party for marketing purposes. Phone numbers are shared with our SMS delivery provider (Twilio) only as required to deliver authentication messages to your device. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

8. Keeping and Deleting Your Data

We keep your account data while your account exists. You can delete your account at any time in the app (Profile → Settings → Delete account), on the web, or by emailing us. Deletion removes your profile, picks, scores, friends, messages, chat posts, club memberships, Show Locker, sign-up attribution, push tokens and prize records, including any shipping address. The full list is on our Delete your account page.

Some records are kept after deletion:

• Moderation records: bans and strikes stay with the phone number or email address they were issued against, so a ban cannot be cleared by deleting the account and signing up again.
• Username history: a record of past username changes.
• Records no longer linked to you: usage events (deleted after 180 days anyway), a history of pick edits under an account ID that no longer points to anyone, reports other players filed about you, and recent failed sign-in attempts.
• Your profile picture file: it stops appearing in Pick5, but the file is not removed automatically. Ask us and we will delete it.
• Copies: our database backups and an internal copy of our database that we keep for analysis may hold your data until they are next refreshed or replaced.

Two things are deleted on their own: pick card images you share are removed 14 days after the show, and suggestions are removed from the app database once our team has received them.

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Withdraw consent at any time

To exercise these rights, contact us at support@pick5.io.

10. Third-Party Services

These companies process data on our behalf:

• Supabase (on Amazon Web Services): our database, sign-in and file storage
• Twilio: SMS delivery for one-time passcodes
• Vercel: website hosting and cookieless visit counts
• Expo: push notifications and app updates
• Apple and Google: app distribution and push delivery; Apple also processes in-app purchases
• Resend: email from our systems to our own team, including prize winner and shipping lists
• Google: a spreadsheet our team may use to ship prizes
• Esri: map images on tour maps. Your device loads them directly from Esri, so Esri sees your IP address.
• Anthropic: powers the setlist question box on our Jamalytics pages. The questions typed there are sent to Anthropic. No account, pick or message data is sent to it.

We get setlists and tour dates from setlist.fm, each band's fan-run setlist sites, and ticketing and event listings. No personal data is sent to them. Twilio receives only your phone number and the message content (the 6-digit code) for the purpose of delivery. See Twilio's privacy policy at twilio.com/legal/privacy.

11. Cookies and Local Storage

The website uses cookies to keep you signed in, and a cookie that remembers a referral link you opened for 7 days. Your browser or the app also stores the details of how you found us (section 2) for up to 90 days. We do not use advertising trackers, and our visit counts do not use cookies.

12. Where Your Data Is Stored

Our database is hosted in the United States (Amazon Web Services, US West). Our internal analysis copy is also kept in the United States. If you use Pick5 from outside the United States, your information is transferred there.

13. Data Security

We implement appropriate technical and organizational security measures to protect your personal information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

14. Children's Privacy

Pick5 is not intended for children under 13 years of age, and our Terms of Service require players to be at least 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has an account, contact us and we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

16. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: support@pick5.io