Privacy Policy

Last updated: August 2026

1. Who we are

PickPin ("we", "us", "our") is a community-powered mobile app for product discovery: users pin products at stores with their prices, and others confirm or correct that information. This policy explains what personal data we process, why, and what your rights are.

Data controller: Pierre Breny, an individual based in Belgium, operator of PickPin. For any privacy question: hello@pickpin.io.

2. Information we process

We process the data you provide and the data generated by your use of the app:

• Account — email address and password (authentication is handled by our provider Supabase), username, country, language, and profile photo/avatar.
• Community content you create — products, prices, store information and locations, descriptions, photos you add, confirmations/corrections, and trips. This content is shared publicly with the community; your username, level and avatar may be visible (e.g. leaderboard, public profile).
• Location — approximate or precise position, foreground only (while the app is open) and with your permission, to show nearby stores, compute distances and routes, and record the starting point of a trip (to detect abuse). No background location tracking, and no arrival detection.
• Camera and photos — product and receipt photos you take, and barcode scanning. See section 4 (AI processing).
• Usage and gamification — XP points, levels, badges, and actions taken in the app; some of this is public (leaderboard, public profile).
• Device and notifications — if you allow them, we show local notifications, generated on your phone (e.g. asking, after your shopping, whether you found your product). Minimal technical data is processed to deliver app updates.

3. Purposes and legal bases

• To provide the service and display community content — performance of a contract.
• Location, camera and notifications — your consent (system permissions you can withdraw at any time).
• Generating shopping routes and collecting your feedback after a trip — performance of a contract.
• Service emails (confirmation, password reset) — performance of a contract. No marketing without consent.
• Detecting and preventing fraud, abuse and spam — legitimate interest.

4. Artificial-intelligence processing

To save you time, some features send an image to an AI provider to read text and pre-fill information:

• Receipt scan — the receipt photo is sent to extract products, prices, store and date.
• Add by photo / packaging scan — the product photo is sent to read the name, brand, size and description.
• Quality check and translations — images and short texts may be processed to check a photo's quality or translate a product entry.

This processing is performed by Anthropic (Claude models). The results are suggestions: you review and edit them before publishing — there is no solely automated decision producing legal effects concerning you.

5. Sharing and processors

We do not sell your personal data and we do not show advertising. We rely on processors that handle data on our behalf:

• Supabase — hosting, database, authentication and storage (EU servers).
• Mapbox / OpenStreetMap — map rendering and geocoding (a map request transmits your area/position).
• Anthropic — AI processing of images/text described in section 4.
• Brevo — sending transactional and authentication emails.
• Open Food Facts — public product database queried by barcode (the barcode you scan is sent to it).
• Expo (EAS) — app distribution and update delivery.
• Google Play — app distribution and, in the future, subscription payments.
• Competent authorities, only where required by law.

6. International transfers

Some processors (in particular Anthropic and Mapbox) are located outside the European Economic Area, mainly in the United States. Where this is the case, such transfers are covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

7. Data retention

We keep your account data for as long as your account is active. You can delete it at any time from the app (Settings → Delete Account) or by emailing hello@pickpin.io — see Delete your account. Deleted accounts are purged within 30 days. Community content (products, prices) may be retained in a form dissociated from your identity to preserve the integrity of the shared database.

8. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time. To exercise them, contact hello@pickpin.io. You also have the right to lodge a complaint with a supervisory authority — in Belgium, the Data Protection Authority (APD/GBA).

9. Children

PickPin is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us with personal data, contact us so we can delete it.

10. Cookies

The PickPin website uses only essential cookies (session management and language preference). No third-party advertising cookies are used.

11. Changes to this policy

We may update this policy from time to time. When we do, we'll update the date above and notify users of material changes in the app or by email.