Data Deletion

This page explains exactly how to delete your Pickade account and what happens to your data afterwards. If anything is unclear, write to marek@pickade.cc and we will help.

1. Delete your account from inside Pickade

1. Sign in to pickade.cc.
2. Go to Settings → Account.
3. Click Delete account and confirm.

Your account is then placed in a 30-day grace state. During those 30 days you can sign in again to cancel the deletion. After 30 days everything described in section 4 is permanently erased.

2. If you signed in with Google, Facebook or Strava

The in-app deletion above already takes care of removing your Pickade account regardless of which sign-in method you used. You can additionally revoke Pickade's access at the provider:

• Google: visit myaccount.google.com/permissions, find Pickade and click Remove access.
• Facebook: visit Facebook → Settings → Apps and Websites, find Pickade and click Remove. This also signals our system to start deletion.
• Strava: visit strava.com/settings/apps, find Pickade and click Revoke Access.

Revoking at the provider stops Pickade from being able to read any further data from that provider, but does not by itself delete your Pickade account — use the in-app flow (section 1) or the email request (section 3) for that.

3. Request deletion by email

If you cannot use the in-app flow, send an email to marek@pickade.cc from the address tied to your account, with the subject "Account deletion". We process the request within 30 days and confirm by reply when it is done.

4. What gets deleted

After the 30-day grace period the following data is permanently erased from our active database:

• your email address and bcrypt password hash,
• all OAuth identifiers — Google sub, Facebook user ID, Strava ID,
• all OAuth access and refresh tokens we held for you,
• profile data — username, first name, last name, country, city, nationality, "show real name" flag,
• avatar image URLs (and any cached avatar images we keep),
• email-verification records and password-reset tokens,
• any session and refresh tokens issued to you.

Your historical picks (which rider you chose on which stage) are anonymised — they remain in rankings as "Anonymous player" with no link back to you, your email, your name or any external identifier.

5. What is kept and for how long

• Server logs (IP address, user agent, request path) are stored separately from accounts for up to 90 days, on the basis of our legitimate interest in security and abuse prevention. They rotate independently of account deletion.
• Encrypted operational backups may still contain your data for up to 30 days after the deletion completes. They are write-once, encrypted at rest, accessed only for disaster recovery, and rotate automatically.
• If we are required by law (e.g. tax records, court order, abuse investigation) to retain specific data longer, we will keep only the minimum necessary and only for the period required.

6. Timeline summary

• Day 0: you request deletion. Account is locked and hidden from rankings under your name.
• Days 1–30: grace period. You can sign in to cancel.
• Day 30: all personally identifiable data listed in section 4 is hard-deleted. Picks become anonymous.
• By day 60: backups containing your data have rotated out.
• By day 90: any remaining server-log line that mentions your account has rotated out.

7. Questions

If you want a written confirmation of deletion, or you want to know what data we hold about you before deleting, write to marek@pickade.cc. See also our Privacy Policy.