Privacy Policy

Who we are

exyPick is an independent service developed and operated by a private individual based in Romania. Contact: exysoftware@gmail.com.

What data we process

• List content entered by organizers: title, description, options, settings.
• Participant data: the name entered when making a choice, the time of the choice, a random browser identifier and a choice token (used so you can give up your choice).
• Management passwords, stored only as cryptographic hashes (scrypt) — we never store the actual password.
• Technical data processed to operate and secure the service: IP addresses (used for rate limiting) and standard request and error logs generated by the server and its hosting provider. They are used only for security and troubleshooting.
• Messages sent through the contact form: your message and, if you provide it, your email address — used solely to answer you. They are delivered to us as a notification via Pushover (pushover.net), a US-based notification service.
• Aggregated visit statistics via Vercel Web Analytics: page views, country, device and browser type. This measurement is cookieless and does not build individual visitor profiles.

Purposes and legal basis

We process this data solely to provide the service you request: creating lists, recording and displaying choices, and managing lists (performance of the service / legitimate interest in operating and securing it). We do not use the data for advertising and we do not sell it.

Who can see the data

Anyone who has a list's link can see the list and its options. Participant names are hidden by default; the organizer can enable public name display, in which case names are visible to anyone with the link. List pages are marked so that search engines do not index them.

Roles

The organizer decides why a list is created and who is invited. For participants' names and choices, the organizer acts as data controller and exyPick processes the data on their behalf; exyPick is controller for technical and security data.

Retention

• Lists and all their data are deleted permanently when the organizer uses “Delete list permanently”.
• Lists with no activity for 12 months are deleted automatically by a daily job. “Activity” means new choices, given-up choices or changes made by the organizer — merely viewing a list does not extend its lifetime.
• Server logs and backups are kept only for the limited period needed for security, troubleshooting and disaster recovery, and are then deleted.

Data stored in your browser

exyPick stores the following in your browser's localStorage, only to provide functions you request: interface language and theme, the lists you created on this device, your management access tokens, the name you entered, a random visitor identifier, and the tokens needed to give up your choices. While you are filling in the create form, a temporary draft is kept in sessionStorage and disappears when the tab is closed. Nothing is used for tracking or advertising. You can remove all of it by clearing this site's data in your browser.

Your rights

You can give up your choice directly on the list page at any time, including after the list was closed — this deletes your name from that list. For access, correction, deletion or other GDPR requests, write to exysoftware@gmail.com. We may need to verify that the request concerns your data (for example, by asking for the choice token stored in your browser). If you are unhappy with how we handled your data, we encourage you to write to us first — we can usually resolve it quickly. You also have the right to lodge a complaint with your supervisory authority (in Romania: ANSPDCP, dataprotection.ro).

Children

Do not enter children's personal data without legal authority to do so. For school-related lists we recommend using first names, initials or aliases.

Security

Passwords are stored as hashes, management access uses signed expiring tokens, requests are rate-limited and the service is served over HTTPS in production. Report security issues to reportabuse.exysoftware@gmail.com.

Last updated: July 29, 2026