1. Who we are
Goodpicks ("Goodpicks", "we", "us") is a recommendation-tracking service operated by its owner as a sole trader based in Victoria, Australia. This policy explains how we handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — where they apply to you — the EU/UK General Data Protection Regulation (GDPR) and comparable laws elsewhere.
Privacy questions, requests and complaints: support@rurudigital.com.
2. Information we collect
Account information
- Email and password. If you sign up with email, your password is stored only as a cryptographic hash — we never see or store it in plain text.
- Google sign-in. If you sign in with Google, we receive your email address, name and profile picture from Google. We never receive your Google password.
- Profile. A username you choose, an optional display name, and an optional avatar image. Your display name is private to you; only your username and avatar are ever visible to other users.
Content you create
- Recommendations you save — titles, notes, ratings, genres, status, who recommended them to you, and cover images.
- Social activity — friend connections, recommendations you share with friends, and short messages attached to shares.
Everything you save is private by default. Content becomes visible to another user only when you explicitly change a recommendation's visibility or share it directly with a friend.
Payment information
Paid subscriptions are processed by Lemon Squeezy acting as merchant of record. Your card details go directly to Lemon Squeezy — we never see or store your payment card numbers. We receive only what we need to run your account: your subscription status, plan, and order identifiers.
Technical information
- IP address — used for rate limiting (abuse prevention) and appearing in short-lived server logs.
- Aggregate analytics — we use Vercel Analytics and Speed Insights, which are cookieless and collect anonymised page and performance data. We do not use advertising trackers.
Cookies
We use only essential cookies: the session cookies required to keep you signed in. There are no advertising, profiling or cross-site tracking cookies, which is why you don't see a cookie consent banner.
3. How we use your information
- To provide the service — storing and displaying your content;
- To authenticate you and keep your account secure;
- To operate social features you initiate (friend requests, shared recommendations, profile visibility);
- To process subscriptions and billing;
- To send transactional email (sign-up confirmation, password resets) — we do not send marketing email without your consent;
- To prevent abuse, enforce our Terms, and comply with law;
- To understand aggregate usage and improve the product.
Where the GDPR applies, our legal bases are: performance of our contract with you (providing the service), our legitimate interests (security, abuse prevention, product improvement), and compliance with legal obligations. We do not use your content or personal information for advertising, and we do not sell or rent personal information to anyone.
Search lookups
When you use auto-fill, the title, author or URL you typed is sent from our servers to third-party catalogue services (such as OMDb, Open Library, and a streaming-availability provider) to fetch matching details. Only the search text is sent — never your name, email or account identity.
4. Who we share information with
We share personal information only with the service providers that run Goodpicks, and only to the extent needed for them to do their job:
- Supabase — database, authentication and file storage (where your account and content live);
- Vercel — application hosting and anonymised analytics;
- Upstash — rate limiting (processes IP addresses);
- Lemon Squeezy — payment processing, as merchant of record;
- Resend — transactional email delivery;
- Google — only if you choose Google sign-in.
Beyond these providers, we disclose personal information only if required by law (for example, a lawful request from an authority), to protect our legal rights, or with your consent. If Goodpicks is ever sold or merged, your information may transfer to the new operator under this same policy, and we will notify you first.
5. Overseas storage and transfers
Our service providers store and process data on infrastructure that may be located outside Australia, including in the United States and the European Union. By using Goodpicks you acknowledge this cross-border handling. Where the GDPR applies, transfers rely on the providers' standard contractual clauses and equivalent safeguards.
6. Retention and deletion
- We keep your information for as long as your account is active.
- You can delete individual recommendations, images and connections at any time from within the app.
- To delete your account and all associated content, email support@rurudigital.com from your account email address. We will action deletion within 30 days. Residual copies in encrypted backups are purged on the backup rotation cycle.
- Billing records are retained as long as tax and accounting law requires.
7. Security
All traffic is encrypted in transit (HTTPS). Data is stored with providers that encrypt at rest. Access to your content is enforced at the database layer with row-level security, so your private content is not readable by other users. Passwords are hashed, never stored. No internet service can guarantee absolute security, but if a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
8. Your rights
Wherever you live, you can:
- Access the personal information we hold about you;
- Correct it (most of it directly in Settings);
- Delete it (see section 6);
- Export a copy of your content in a portable format on request;
- Object or restrict certain processing, and withdraw consent where processing relies on it.
To exercise any of these, email support@rurudigital.com. We respond within 30 days and never charge for a reasonable request.
Australia: if you're unhappy with how we've handled your information, complain to us first and we'll respond within 30 days. You may also complain to the OAIC at oaic.gov.au. EU/UK: you may lodge a complaint with your local supervisory authority. California: we do not sell or share personal information as defined by the CCPA/CPRA, and we honour access and deletion requests as described above.
9. Children
Goodpicks is not directed at children and is only available to people aged 16 or over. We do not knowingly collect personal information from anyone under 16; if you believe we have, contact us and we will delete it.
10. Changes to this policy
We may update this policy as the service or the law changes. The "last updated" date above always reflects the current version, and material changes will be announced in the app or by email before they take effect. Continued use after a change takes effect means you accept the updated policy.
11. Contact
Goodpicks — operated from Victoria, Australia
support@rurudigital.com