Privacy Policy

Last updated: October 2026

1. What we collect

• Organizers: the name and email address you provide when creating an event, and, if you create an account, your name, email, and password (stored hashed, never in plain text).
• Invitees and participants: the name and email address you provide when responding to an event, and your response itself (e.g. your vote, RSVP, or registration).
• Secret Santa draws: if you use our Secret Santa tool, the names you enter, the draw's title, and the optional budget, date and message, plus who drew whom and whether each participant's link has been opened. No account or email address is needed, and the exclusions you set are used for the draw and then discarded.
• Everyone: basic technical data needed to operate the service, such as your IP address (used only to rate-limit abuse) and your browser's language preference.

We also measure how the site is used, and whether our ads work. See section 3 for exactly what that involves, and how to stop it.

2. How we use it

We use this information only to:

• run the event you created or responded to (showing the invite card, recording responses, computing tallies);
• send transactional emails related to an event (invitations, confirmations, reminders, and result notifications) via our email provider, Resend;
• look up a location you type into an event's address field, via Mapbox's autocomplete API, if you use that field;
• keep the service secure and prevent abuse;
• understand which pages people use, and whether an ad we paid for led to someone creating an event.

We don't sell your data, and we don't share it with anyone except the providers named in this policy, strictly to run and measure the service. The one exception is an AI assistant you connect yourself: it receives what it asks for on your behalf (see section 5).

3. Analytics and advertising

Analytics. We use Plausible Analytics, self-hosted on our own server rather than a third party's. It sets no cookies and builds no profile of you. It records the page you visited, the site that sent you, and your country, browser and device type. Your IP address is processed to work out the country and to count you once per day, and is never stored.

Advertising measurement. We advertise Pickadate.net on Google Search. To learn whether those ads lead anywhere, the links in our ads add a few labels to the address of the page they open (utm_source, utm_medium, utm_content and utm_term), saying which ad and which search the click came from. Plausible, the analytics described above, records those labels with the visit, so we can count how many visits from an ad went on to create an event. It sets no cookies to do it.

No Google code runs on Pickadate.net: we load no Google advertising tag, set no Google cookies, and report nothing back to Google about what you do here. Google, which shows the ad, knows you clicked it, as with any search ad, but that happens on Google's side, not ours.

To be clear about what this is not: we show no ads on Pickadate.net, to you or to anyone you invite, and we do not use any of this to profile you or to target you elsewhere.

If you would rather not be counted, any browser setting or extension that blocks analytics stops it, and the site works exactly the same without it.

4. Cookies

We set these:

• language -- remembers which language you are reading in. One year.
• session_token -- keeps you signed in, and is only set if you create an organizer account and sign in.
• __Host-csrftoken -- a security token that protects the site's forms against forged submissions from other sites. Strictly necessary. One year.
• pickadate_ref -- set only if you arrive from a link on someone else's event, so we can tell how people find us. 48 hours.

All four are ours, are readable only by our server, and are never used for advertising. We set no advertising or third-party cookies.

5. AI assistants you connect

If you connect an AI assistant, such as Claude or ChatGPT, to your organizer account, it acts on your behalf through our MCP server -- and only after you choose Allow on our consent page. It can see and change only your own events, their responses and your contacts.

• What we store: the app's name and the address it returns you to, when you allowed it and when it was last used, and a log of each action it takes (which action, when, whether it worked, and any error). Its access tokens are stored hashed, never in plain text.
• What the assistant receives: whatever it asks for on your behalf, such as your events, the names, email addresses and answers of the people in them, and your contacts. From then on that information is handled by the assistant's provider, under its own terms and privacy policy, not ours.
• Emails it sends: invitations and other event emails go out exactly as when you use the website, and the number of invitations an assistant can send each day is limited.
• Removing access: open Connected apps on your account page and choose Remove access; the assistant loses access straight away. Deleting your account also deletes all of these records.

6. Retention

• Events without an account: kept for 30 days after the event's last date, then automatically and permanently deleted.
• Events with an account: not automatically deleted. You can delete any of your events yourself, at any time, from "My events" in your account.
• Secret Santa draws: kept until 90 days after the gift exchange date (or 180 days after the draw if no date was given), then automatically and permanently deleted. The organizer can delete a draw, with every link in it, at any time from the draw's organizer page.
• Account deletion: you can delete your account, and all data associated with it, at any time from the Account page.

If you need an event removed sooner, or need help with something these tools don't cover, contact us at the address below.

7. Your rights

You can ask us to access, correct, or delete your personal data at any time by contacting us at the address below.

8. Contact

Questions about this policy? Reach out at support@pickadate.net.