Data controller: PickM8. Contact: privacy@pickm8.com
PickM8 is a golf sweepstake app. This page explains what personal data PickM8 collects, why, and what your rights are.
What we collect
If you enter a tournament: your name, email address, and your 8 golfer picks. If you leave a payment note or WhatsApp/phone number, we store what you type there too.
If you sign in with Google: your email address, name, and profile photo. We only ever ask Google for these three things (openid, email, profile) and never request access to your Gmail, Drive, Calendar, or anything else in your Google account.
If you sign in with Microsoft: your account email and name. Google and Microsoft create separate PickM8 accounts.
If you sign in with a passkey, we store a public key and authenticator details needed to verify sign-ins, plus your required account recovery email. Your device or password manager keeps the private key and may sync it under its own privacy terms. Passkeys are a separate PickM8 account. Your recovery email is contact information only and never links to, opens or claims a Google, Microsoft or older entry, membership or organiser grant. The recovery email is unverified at sign-up and is verified only when you complete recovery.
If you lose your passkey, you can request a recovery link to your recovery email. We don't send recovery email automatically. An administrator creates a single-use link, valid for 24 hours, and sends it manually to the address on file. We store a hash of the link, not the link itself. Open recovery requests remain until handled; handled requests and used or expired link hashes are deleted after 7 days.
If you sign in, we set one cookie that keeps you signed in for up to 30 days. It stores your provider identity and is required for sign-in to work, so it's not something you can opt out of individually.
If you star another entrant as one of "your M8s," we record that against your sign-in identity.
What we don't collect
PickM8 never handles money. Any pot is arranged between entrants themselves. If a payment note or a "paid" flag is stored, it is just a record kept by the organiser, not a transaction, and no card or bank details ever pass through the app.
Analytics
PickM8 uses GoatCounter for basic analytics: page views and a handful of specific interactions (like starting or finishing an entry). GoatCounter is cookie-free and does not track you individually across sites. It's hosted by GoatCounter B.V. in the Netherlands.
Who we share data with
Google or Microsoft, depending on your chosen sign-in provider. GoatCounter, for analytics. Amazon Web Services (AWS), who host the app in London (eu-west-2).
Passkey sign-ins are verified within PickM8's own application using py_webauthn, an open-source library running on our app servers. It is not an external sign-in provider, and we do not send your passkey account data to a separate sign-in provider. Your chosen device or password manager may separately process or sync the private key under its own privacy terms.
We don't sell data, and we don't share it with anyone else. Google Sign-In may involve your data being processed outside the UK/EU as part of Google's own infrastructure; Google covers this under its standard contractual safeguards.
Special category data
PickM8 doesn't ask for or knowingly collect any special category data (health, religion, ethnicity, and so on).
How long we keep data
We keep tournament and entry data for 3 years after a tournament finishes, then it's deleted automatically. You can also ask us to delete your data earlier. If you do, we remove your name and email and replace them with "Deleted entrant," and keep only the anonymised score, since that score is part of other entrants' historic results.
Your rights
Under UK GDPR you have the right to:
- access the data we hold on you
- correct it if it's wrong
- ask us to delete it
- ask us to restrict how we use it
- ask for a copy in a portable format
- object to how we use it
To exercise any of these, email privacy@pickm8.com.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data.
Age
PickM8 is intended for people aged 18 and over.
Changes to this policy
We'll update this page if what we collect or how we use it changes.
Contact
privacy@pickm8.com
Last updated 29 September 2026
