PikkPoll — Privacy Policy

Last updated: November 5, 2026

This Privacy Policy explains how PikkPoll collects, uses, stores, and protects personal data when you use pikkpoll.com.

1. Data Controller

PikkPoll is operated by:

Jani Kivinen
Finland
Privacy contact: privacy@pikkpoll.com

2. Personal Data We Process

Depending on how you use PikkPoll, we process the following information:

Account information

• Email address
• Username
• Authentication credentials managed through Supabase Auth, including email and password sign-in and Google Sign-In through Supabase OAuth
• Self-declared country of residence
• Account identifiers and relevant account timestamps
• Delivery status for the one founder welcome message, stored with the account identifier

Profile information

• Profile picture, if uploaded
• Biography or other optional profile details
• Profile-related settings and timestamps

Content and activity

• Polls you create, including questions, options, descriptions, visibility settings, and uploaded images
• Your votes and selected poll options
• Comments and likes
• Following relationships
• Reports, including reasons, optional details, and relevant moderation records
• Notifications generated by interactions on the platform

Technical information

• Authentication session information stored in your browser
• Temporary browser storage used for the public feed and password recovery
• Technical and security information that may be processed by our infrastructure providers, including IP addresses and server logs, subject to their configurations

We do not collect dates of birth, telephone numbers, or payment details as part of the current registration process.

We do not currently use third-party advertising trackers or dedicated website analytics tools.

3. Why We Process Personal Data

We process personal data for the following purposes:

The applicable legal basis may depend on the specific processing activity and circumstances.

Where we rely on legitimate interests, those interests generally concern the security, integrity, reliability, and lawful operation of PikkPoll. They also include sending one founder welcome message to a new account, so the founder can receive a reply about the service.

4. Country of Residence

We collect your self-declared country of residence during registration.

We intend to use this information in the future to support country-specific polls, recommend relevant content, and produce aggregated audience statistics.

These localization and audience-statistics features are not currently implemented. Your country is currently stored as part of your account information.

Your country of residence is not displayed publicly as part of your profile by default.

We do not require precise GPS location for these purposes.

5. Public and Non-Public Information

Your username, profile picture, biography, published polls, and comments may be visible to other users.

Your votes are stored in association with your account. Poll result totals may be publicly displayed, but PikkPoll does not currently provide a public list identifying which option each user selected.

Your email address and authentication credentials are not intended to be publicly visible.

Other users may be able to infer information about you from content you voluntarily publish.

6. Hosting and Service Providers

PikkPoll uses Supabase for authentication, database services, file storage, and authentication-related email functionality.

PikkPoll uses Resend to send one plain-text welcome message from the founder to a new account's verified email address. The message is sent from jani@pikkpoll.com and replies go to contact@pikkpoll.com. It is sent at most once for each account, about two hours after the account is created, and only when that address was verified within 24 hours of creation. Accounts created before this message is turned on do not receive it. The message contains no images, promotional links, or tracking pixels. Resend processes the recipient address, the message, and its delivery records for that send. Resend is not used for advertising.

The Supabase project database is hosted in West EU (Ireland), eu-west-1.

Other technical processing, including authentication emails, support infrastructure, logs, and backups, may involve additional service providers or locations depending on their configurations.

We do not sell personal data to advertisers.

We may disclose information when required by law or when necessary to protect the service and the rights of users or third parties, subject to applicable legal requirements.

7. Browser Storage

PikkPoll currently uses:

• localStorage: to maintain your authentication session.
• sessionStorage: to temporarily cache the public poll feed and support password recovery.

The application does not currently set its own cookies.

Hosting and infrastructure services may use additional technical mechanisms. These must be verified before publication.

We do not currently use advertising or analytics cookies.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, subject to applicable legal obligations and justified security or legal needs.

Account and content data may remain stored while an account is active.

When a user successfully deletes their account, PikkPoll removes the account and associated active-service data as described in Section 9.

Some information may remain temporarily or in limited circumstances:

• Reports: A report concerning another user's content may remain after the reporting account is deleted. The deleted reporter's account identifier is removed, but the report's reason and written details may remain. Free-text details may themselves contain personal information.
• Backups and technical logs: Copies of information may remain in infrastructure backups, authentication logs, email logs, or other technical records until they expire or are removed under the relevant provider's retention practices.
• Browser and network caches: Previously accessed public images or content may remain temporarily in browser or other technical caches.
• Incomplete file cleanup: If uploaded-file cleanup cannot be completed immediately, a restricted internal cleanup record may remain so an administrator can retry removal. This record contains the former account identifier and a cleanup status.
• Welcome-message records: PikkPoll keeps an internal record of whether the one welcome message was sent. That record stores the account identifier and delivery status. It does not store a separate copy of the email address. The record is removed when the account is deleted. Resend may keep its own delivery logs until they expire under Resend's retention practices.

Some information may also need to be retained where legally required or justified, including for the establishment, exercise, or defence of legal claims.

We do not currently operate a comprehensive automated retention schedule for all categories of information.

9. Account Deletion and Privacy Requests

You can delete your account directly through Settings → Delete Account.

To confirm deletion, you must type the required deletion confirmation text. Password-based accounts, including an account that also has Google linked, must also enter the current password. A Google-only account confirms deletion through a fresh Google sign-in.

Account deletion is intended to permanently remove your account from the active PikkPoll service, including:

• Your authentication account and profile
• Polls you created and their options
• Votes, comments, and likes associated with your account
• Following relationships involving your account
• Notifications associated with your account
• Uploaded profile pictures and poll images

Deleting a poll also removes the votes, comments, and likes that other users submitted to that poll.

Certain reports about content that remains on PikkPoll may be retained without the deleted reporter's account identifier, as described in Section 8.

Uploaded-file cleanup may occasionally require an additional administrative retry. Backups, logs, and caches may also retain limited information temporarily.

Account deletion is not currently available through the self-service process for accounts designated as official or administrative. Requests concerning such accounts may be submitted through the privacy contact address and will be assessed under applicable law.

You may also contact privacy@pikkpoll.com to exercise your data protection rights or request assistance.

We may need to verify that a request comes from the relevant account holder before taking action.

10. Your Rights

Depending on applicable law and the circumstances, you may have the right to:

• Access your personal data.
• Request correction of inaccurate information.
• Request deletion of your personal data.
• Request restriction of certain processing.
• Object to processing based on legitimate interests.
• Receive certain personal data in a portable format.
• Withdraw consent where processing is based on consent.

These rights may be subject to applicable legal conditions and exceptions.

You can object to the founder welcome message, or to other processing based on legitimate interests, by contacting privacy@pikkpoll.com. You can also reply to the welcome message.

You may also lodge a complaint with a data protection supervisory authority. In Finland, the relevant authority is the Office of the Data Protection Ombudsman.

You can contact us at privacy@pikkpoll.com to exercise your rights.

11. Security

We use Supabase authentication, database access controls, and other technical safeguards to help protect personal data.

Authentication passwords are managed by Supabase Auth and are not stored in PikkPoll's public profile database.

When a password-based account is deleted, the current password is temporarily submitted to the application server for verification through Supabase Auth. The application does not intentionally retain that password after verification. A Google-only account confirms deletion through a fresh Google sign-in through Supabase Auth instead of a password.

No online service can guarantee absolute security. We aim to maintain appropriate technical and organizational safeguards and address identified vulnerabilities.

12. Children's Privacy

PikkPoll is intended for users aged 16 and older.

People under 16 are not permitted to create accounts or use the service.

Registration is intended to include an age eligibility confirmation. We do not currently collect dates of birth or independently verify users' ages.

If we become aware that an account belongs to someone under the minimum age, we may take appropriate steps to restrict or remove it.

13. Changes to This Policy

We may update this Privacy Policy when our practices, technology, or legal obligations change.

We will update the date shown above and provide additional notice when required by law.

14. Contact

PikkPoll
Data controller: Jani Kivinen, Finland
Website: pikkpoll.com
Email: privacy@pikkpoll.com