Privacy Policy

1. Who We Are and What This Policy Covers

PickleSwaps LLC ("PickleSwaps," "we," "us") operates pickleswaps.com, an AI-powered pickleball paddle recommendation site, and Kitch IQ, a paid video analysis service. This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights and choices you have.

It applies to the website, the paddle selector, Kitch IQ (including Rallywise, the pickleball decision game included with Kitch IQ, on the website and in the Rallywise mobile app), our emails, and feedback channels. It does not apply to third-party retailers we link to.

We are based in the United States and our Service is operated from and hosted in the United States.

2. Information We Collect

2.1 Information You Provide

• Email address — when you subscribe to our emails (managed via the Kit email platform) or make a Kitch IQ purchase.
• Paddle selector inputs — the free-text and structured answers you type into the AI paddle selector.
• Kitch IQ uploads — the match video you upload (or a public file URL you provide), descriptive fields you submit about the match, and your account settings.
• Rallywise play — when you play Rallywise, the answers you choose, the rounds you play, your skill progress and badges, and your level and game settings. You can play the free parts of Rallywise without an account. Rallywise does not ask for your age or date of birth, and it has no profiles or fields for anyone else’s details. Section 4.2 explains what is stored, where, and for how long.
• Rallywise app sign-in — your email address, if you choose to sign in to the Rallywise mobile app. We use it only to email you a one-time sign-in link and to connect the app to your account. Section 4.3 covers the app.
• Payment information — collected and processed by Stripe. We receive transaction metadata (amount, product, last four digits, billing country) but never your full card number.
• Feedback and support messages — anything you send us via feedback forms, GitHub, or email.

2.2 Information Collected Automatically

• Analytics — on the website we use Google Analytics 4, which sets cookies and collects device, browser, approximate location, and usage data. See Sections 11 and 12 for your choices, including Global Privacy Control. The Rallywise mobile app sends no analytics (Section 4.3).
• Server logs — IP address, request data, and error logs retained for approximately 30 days for security and reliability.

2.3 Information Derived From Your Video

To produce a Kitch IQ analysis, our pipeline detects players, the court, the ball, and paddles in your footage and computes body-position (pose) data — skeletal keypoints describing how players move. This data is used to analyze gameplay (for example, shot type and positioning).

We do not use facial recognition, and we do not use video, frames, or pose data to identify who a person is, to match anyone against an identity database, or to track a person across different customers’ uploads. Section 10 sets out our commitments for this data in detail.

3. How We Collect It

Directly from you (forms, uploads, purchases, emails); automatically (cookies and similar technologies for analytics and session functionality); and from our payment processor (transaction confirmations). We honor the Global Privacy Control signal as described in Section 12.

4. How Long We Keep Your Kitch IQ Data

We delete your original video within 8 days of your analysis finishing — usually as soon as it's done. Your report stays available for 90 days, then it's deleted too.

If you take no extra action at checkout, your uploaded video is deleted within 8 days of your analysis finishing (usually as soon as it is done). If an upload is never completed, its video is deleted within 15 days of upload.

Your analysis text, the annotated screenshots, and the metadata we keep alongside them are retained for 90 days, and then a scheduled deletion job removes them — except that while you have an active Pro or Annual subscription, your reports stay in your archive, and for 90 days after the subscription ends. The deletion is permanent — we do not keep a backup, a copy, or an archived version that survives the applicable window above. After deletion, the analysis link in your delivery email will no longer work.

Optional extended retention for model improvement: up to 2 years.

At checkout (or, for subscribers, from your account dashboard), you may also choose — separately and optionally — to help us improve Kitch IQ by allowing us to retain a copy of your uploaded video and the derived analysis for up to two years from the time you upload, for the sole purpose of training and evaluating improved Kitch IQ analysis models.

This is opt-in; the default is no extended retention. Section 9 explains the training program in full, including how to withdraw.

If you want your data deleted sooner than the applicable window, you can delete your Kitch IQ account — including your Rallywise progress — yourself at pickleswaps.com/account/delete (or from your account page), or email privacy@pickleswaps.com from the email address you used at checkout and we will erase it. See Section 12 for all of your rights.

4.1 Other Retention Periods

Swipe the table sideways to see every column →

This table also serves as our published retention and destruction schedule for the body-position data described in Section 10: such data is destroyed with the video and analysis it belongs to, at the end of the applicable window above, or earlier upon a verified deletion request or consent withdrawal — whichever comes first.

4.2 Rallywise Game Data

What we store when you are signed in. When you play Rallywise from a Kitch IQ report or while signed in to your Kitch IQ account, we store your game progress on our servers (Vercel): the rounds we built for you, the answers you chose, your skill progress, your level and game settings, and, for subscribers, the comparison between a skill in the game and your next report.

It is stored with your account email address (or, before you first sign in, with the report it came from) so you can pick up where you left off and so new rounds can follow your latest report.

Your badges. In the same place and on the same terms, we store your badges, so they follow you to a new device. We keep only what badges need: the badges you have earned (which badge, its tier, and when and how it was earned) and the play record they are worked out from.

For each answer, that record holds the game situation, its skill and level, the option you chose and the best option, whether you were right, how long you took, when you answered, and which round, challenge, or other part of the game it was in.

It also holds short summaries of your rounds, rallies, and daily-challenge results. Nothing else is stored with your badges: not the display name you can add to a share card, and no free text. When you first play from a report link or sign in on a device, the badges already on that device are added to your account.

Your answers are recorded because the game needs them to build your next round; they are part of the game, not analytics, so they are stored whether or not you allow analytics. If you play offline, your answers wait on your device until they can be sent.

How long we keep it. A scheduled deletion job permanently deletes your Rallywise game progress and badges once they have gone 90 days without any game activity. While you have an active Pro or Annual subscription, we keep it for as long as the subscription is active; after it ends, the same 90-day rule applies.

A refund does not change this rule. A deletion request under Section 12 removes your progress and badges straight away, and a request for a copy of your data includes both.

What stays on your device. Some Rallywise data is kept only in your browser’s local storage, or in the Rallywise app’s own storage on your phone, on the device you play on, and is never sent to us. If you play without an account (and not from a report link), that includes your progress and your badges; they stay on that device only, until you sign in or play from a report link there.

Whether or not you have an account, your daily-challenge count and chosen level, your sound, tip and onboarding settings, and the optional display name you can add to a share card always stay on the device. You can remove this data at any time by clearing your browser’s site data for pickleswaps.com, or, in the app, by deleting the app.

Section 11.2 covers Rallywise analytics, share cards, share links, and friend challenges.

4.3 The Rallywise Mobile App

Signing in. You can play Pickle’s Challenge in the app without signing in. If you sign in, we email a one-time link to the address you enter. So that the link only works on the phone that asked for it, the app creates a one-time random key on your phone and sends us only a scrambled form of it with the request; when you open the link, the app proves it holds that key.

The link expires after 15 minutes and works once. After you sign in, our server gives the app two sign-in tokens: one that lasts about an hour and one that lasts up to 30 days and is used to renew it. The app keeps them in your phone’s secure storage (the Android Keystore, or the iPhone Keychain). We don’t use passwords.

What the app sends us. When you are signed in, the app sends and receives the same Rallywise game data described in Section 4.2 (your rounds, answers, skill progress, level and game settings, and badges) and checks what your account includes, on the same servers and under the same retention rules. When you are not signed in, your progress and badges stay on your phone.

What the app does not do. The app contains no advertising, analytics, or crash-reporting software, and it does not sell anything inside the app. Where a “Subscribe” button appears, it opens pickleswaps.com in your browser, where the rest of this policy and our Terms apply.

The app asks only for internet access, for network status (so it can tell when you are offline), and for vibration (for in-game feedback). It does not access your location, contacts, camera, microphone, or photos.

Signing out and deleting your account. Signing out removes the sign-in tokens from your phone. “Delete account” in the app opens pickleswaps.com/account/delete, where you can delete your account and its data, including your Rallywise progress and badges, as described in Section 12. Deleting the app from your phone removes the data stored on the phone; it does not delete your account.

App stores. If you download the app from Google Play (or the App Store), the store processes your download and device information under its own privacy policy. We don’t receive your store account details.

5. How We Use Information

• To deliver what you asked for: generate paddle recommendations, process Kitch IQ uploads, deliver analyses, manage subscriptions, and respond to support requests.
• To run Rallywise: build rounds at your level, shape them around your latest Kitch IQ report, save your progress, and show it back to you.
• To send emails you signed up for, with a working unsubscribe link in every message (see Section 16).
• To operate, secure, and improve the website and our features, using aggregate analytics.
• To train improved Kitch IQ models — only for customers who explicitly opt in (Section 9).
• To comply with law, enforce our Terms, and prevent fraud or abuse.

6. What We Do Not Do With Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing. By default, we do not use your Kitch IQ uploads, descriptive fields, or analysis text to train AI models. Customers may optionally consent to extended retention for model improvement — see Section 9.

Whether or not you opt in, we never sell or share your uploads with third parties beyond the sub-processors listed in Section 7. See Section 8 on AI-generated content for the specifics of the Gemini API tier we use during analysis.

Our website displays affiliate links to retailers. Clicking an affiliate link takes you to the retailer and may set that retailer’s or network’s cookies on their site; we disclose this and our analytics practices in Sections 11 and 12, and we honor opt-out preference signals as described there.

7. Sub-Processors and Third-Party Services

These vendors process personal information on our behalf, under their terms of service and data-processing commitments:

Swipe the table sideways to see every column →

If we add or replace a sub-processor that handles Kitch IQ customer data, we will update this table before the change takes effect and notify customers with open retention windows as described in Section 18.

Processing locations. We primarily store uploaded videos and generated analysis artifacts in Google Cloud infrastructure located in the United States. To provide the service reliably, we and our cloud infrastructure providers may temporarily process videos, frames, model outputs, and related technical data in other regions, including outside the United States, when needed for capacity, performance, security, or reliability.

This temporary processing is used only to operate Kitch IQ, generate the requested analysis, troubleshoot errors, and maintain the service. We do not use uploaded videos for model training unless you separately opt in, and we retain uploaded videos according to the retention period described in this Policy.

8. AI-Generated Content (Kitch IQ and Paddle Selector)

Kitch IQ analyses and paddle recommendations are AI-generated and may contain errors; they are informational only (see the Terms of Service). Two specific commitments matter here:

(1) Default behavior — no training on your data. Unless you have explicitly opted in (see Section 9), we do not use your Kitch IQ uploads or analysis content to train AI models — neither our own nor any third party’s. Your data is used only to generate your analysis and is deleted at the 90-day mark.

(2) Third-party (Google Gemini) commitment. Google’s API-tier policy, as published by Google, does not use Gemini API inputs to train Google’s general-purpose models. This applies whether or not you have opted into our training program — Gemini is used only to generate your analysis content, not to train Gemini itself.

We rely on Google’s published policy for this and link to it in the sub-processor table above. If Google changes that policy, we will update this section and notify Kitch IQ customers via email before the change takes effect for new analyses.

Paddle selector inputs are processed to generate your recommendation and are not used to train models.

9. Optional Kitch IQ Training Program (Opt-In Only)

At checkout, or from the account dashboard for subscribers, customers may optionally consent to participate in the Kitch IQ training program. Participation is never required to purchase or receive a Kitch IQ analysis, and declining does not change the product, the price, or the quality of your analysis in any way. The default is no participation.

9.1 What Participation Means

If you opt in:

• We retain a copy of your uploaded video and the derived analysis content for up to two years from the date of your upload, in our Google Cloud Storage account (us-east4 region).
• We may use that retained data — including the body-position (pose) data described in Section 10 — to train, evaluate, and improve future versions of the Kitch IQ analysis models: computer-vision detection models (e.g., player detection, court detection, paddle and ball detection), pose-classification models (e.g., shot type and swing detection), and aggregate-metric models. We do not use it for any other purpose.
• Training is performed by PickleSwaps personnel or contracted ML engineers operating under written confidentiality agreements. Your data is not shared with third parties for their own model training.
• Aggregate, de-identified insights derived from opted-in data may be published in product or marketing materials. Your individual footage is never published or made publicly identifiable.

9.2 What Does NOT Change If You Opt In

• Your analysis is delivered identically — there is no functional difference versus non-opted-in customers.
• The price you pay is identical.
• Your video is still encrypted at rest and in transit.
• PickleSwaps does not sell your video, share it with third-party advertisers, profit from the body-position data in it, or use it for marketing of unrelated products.

9.3 Your Consent

Your opt-in is recorded when you check the separate, clearly labeled, unchecked-by-default training-program box at checkout or switch on the training toggle in your dashboard. That recorded action constitutes your informed, written, electronically signed consent to the retention and uses described in this Section 9 and in Section 10, including the capture and use of body-position data derived from your footage, for the purpose and duration stated here.

Eligibility note: do not opt in footage in which an identifiable minor is a primary subject; such footage is not eligible for the training program (see Section 13 and the Terms of Service, Section 7.4).

9.4 Withdrawing Consent

You can withdraw consent at any time by emailing privacy@pickleswaps.com from the email address associated with your purchase, or (for subscribers) by switching the dashboard toggle off. On withdrawal:

• We acknowledge within 14 days.
• We purge your retained video and analysis from training storage within 30 days.
• We do not "unlearn" data already used to train deployed models — that is technically infeasible — but no further training will use your data after withdrawal.

Withdrawal does not affect any other aspect of the Service, your subscription, or your pricing.

9.5 Retention End

At the end of the 2-year participation window, retained data is permanently deleted unless you affirmatively elect to extend. Aggregate statistics about participation rates, opt-in/opt-out ratios, and withdrawal volume may be published in periodic transparency notes; individual customers are never identifiable in those statistics.

10. Body-Position Data: Our Commitments

Pose keypoints and related body-position measurements derived from video can be sensitive, and some U.S. states regulate certain biometric data stringently. Whether or not those laws apply to the specific data we compute, we hold ourselves to the following commitments everywhere we operate:

• Notice and consent. We compute body-position data only from footage you upload after agreeing to the Terms of Service, which disclose this processing; extended retention and training use occur only with the separate, express, electronically signed opt-in described in Section 9.
• No identification. We do not use facial recognition; we do not use video, frames, or body-position data to establish or verify anyone’s identity; and we do not match people across different customers’ uploads.
• No sale, lease, or profit. We never sell, lease, trade, or otherwise profit from body-position data or the footage it is derived from.
• No disclosure except to the sub-processors in Section 7 as needed to deliver or (with consent) improve the Service, or as required by law.
• Security. Encrypted in transit and at rest; access limited to personnel and contractors under confidentiality obligations.
• Destruction schedule. Destroyed with the underlying upload per the schedule in Section 4.1 — 90 days by default, up to 2 years with training consent, or earlier upon verified deletion request or consent withdrawal, whichever comes first.

11. Cookies and Analytics

We use a session cookie for site functionality and Google Analytics 4 cookies for aggregate usage statistics. You can control cookies through your browser settings; blocking analytics cookies does not break the site. We respond to the Global Privacy Control signal as described in Section 12.

EEA/UK visitors are shown a cookie-consent banner before any analytics cookies (Google Analytics 4) are loaded. The banner offers Accept / Decline; declining suppresses GA4 entirely. Choice is stored in a first-party essential-cookies-exempt session preference.

We also use Vercel Web Analytics, which counts page views in aggregate without cookies and without storing your IP address or any identifier that follows you across sites.

11.1 Kitch IQ Referral Links

Opening a referral link. When the Kitch IQ referral program is running and you open a referral link, we record the click on our server (the link’s code and the time) for 31 days. If you have allowed analytics under this section, your browser also keeps the link’s code and a click ID in local storage for 30 days so the person who shared it can be credited if you buy later; if you have not, or your browser sends Global Privacy Control, it is kept only in memory for that visit.

No cookie is used. The code is removed from the address bar once read and is replaced with “redacted” in what our analytics tag sends, so Google Analytics never receives it.

Referral codes. Referral codes are created only for our own customers and account holders: each full-price Kitch IQ Single purchase and each signed-in customer who opens their account page gets one, and when the two-sided program is active, every signed-in account does.

A code is keyed by a one-way hash of a normalized form of your email address (when the two-sided program is active, variants such as Gmail dots or “+tags” share one code); we keep your email address in plain text only on your own code record, so we can email you about rewards you earn.

We do not create referral codes from contact lists or for people who have not signed up. We keep the card fingerprint and Stripe customer ID from your own purchases so a purchase through your own link is not counted. When someone buys through a link, we keep a hash of their email address (not the address itself) for the same check, and the order ID stays with the record of the person whose link was used.

When the two-sided program is active, we also keep a hash of your email address and your card fingerprint (for up to 400 days) once you have made a paid purchase or used a friend discount, so the discount is used once and the paid-purchase rule can be checked; and Rallywise share links you create while signed in (except on the beginner levels) carry your referral code.

Review signals (two-sided program). To spot self-referrals, when a referrer opens their account page and when someone clicks a referral link, we keep keyed one-way hashes (HMAC) of the network (IPv4 /24 or IPv6 /48) and of the browser’s user-agent string.

The raw address and the raw string are never stored. A referrer’s hashes are kept for 31 days (at most 20); a click’s hashes are kept with the click for 31 days. If they match, the reward is held for a manual check; it is never cancelled automatically.

Your first name (opt-in). If you turn on “Show my first name to friends”, we store the first name you enter on your code record and show it to people who open your link, including in the link preview. It is off by default, and turning it off deletes it. We never show your email address.

Server-side analytics (two-sided program). Our server may send Google Analytics three events about a referral purchase and any resulting reward only if the buyer’s browser had allowed analytics, and sent no Global Privacy Control signal, when the checkout started; that choice is stamped on the checkout.

The events carry only the product type, the program model and the code’s source category, never an email address, referral code, click ID or payment ID, and a fresh random identifier each time. Without that consent, or with Global Privacy Control, nothing is sent.

Emails and deletion. We email referrers about their own rewards (a purchase recorded, a reward ready, a referral that no longer counts, a reminder before a reward expires, a month of Pro added) and respect bounce and complaint suppression.

A deletion request under Section 12 removes your code, your email address, your first name, your review signals, your card and customer records, the rewards you earned and their links, and the hash of your email address on purchases you made through someone else’s link.

11.2 Rallywise Analytics, Share Cards, and Share Links

Game analytics. On the website, Rallywise sends gameplay events to Google Analytics 4 (for example, that a round started, which game situation was played and which option was chosen, or that a badge was earned) only if you have allowed analytics under this section.

If you decline, or your browser sends Global Privacy Control, no game events are sent and the game works the same. These events never include your name, email address, account or order identifiers, the display name on a share card, or anything you type.

We also keep anonymous daily totals of games played, with no cookies or personal data. The Rallywise mobile app does not send gameplay events to Google Analytics or to any other analytics service.

Share cards and QR codes. Share cards, including the QR code on them, are drawn on your device; nothing is uploaded to make them, and nothing is shared unless you choose to share it. A card never shows your answers, your accuracy, your email address, your location, your age, or a photo. It shows a display name only if you add one.

Share links. A Rallywise share link (including the one behind a card’s QR code) contains the badge and the game situation being shared, standard campaign tags, and a short random code made on your device for that one share, so that we can count in aggregate how often shared links are opened.

We do not store that random code with anything about you. If you are signed in and the two-sided referral program is active, your share link also carries your referral code (Section 11.1), so a friend who buys through it is credited to you; a link never contains your name, email address or any other personal information. Share links made in the Rallywise app point to pickleswaps.com, the same as links made on the website.

Friend challenges and free play. Anyone who opens a friend-challenge link can play that situation free in their browser, without an account. We store nothing about them. The same is true of the daily Pickle’s Challenge. As with any visitor to pickleswaps.com, analytics apply only if they allow it.

11.3 Coach Accounts and Coach Links

Coach profile. If a signed-in user creates a free coach account, we store the display name, the way they coach (club, private lessons, clinic, school, or other), the optional website or DUPR link they give us, and the time they accepted the coach terms, with their existing account — not their email address a second time; we already have that on the account itself.

We do not verify any of this. Your coach profile is kept while your account exists and is deleted when you ask us to delete your data; practice links and their counts are deleted about 60 days after a link is created.

Coach links. A coach link (pickleswaps.com/rallywise/p/<token>) is a random, unguessable id the server creates; it does not contain the situation being shared or anything about the coach. The page it opens asks our server for the one situation the coach chose, by that id — our server only tells it about the one situation the coach chose.

A coach link collects no personal data from the student who opens it: no account, no cookie, and nothing we can connect back to them. We count, per link, how many times it was opened, how many times the situation was completed, and how many times each next-step button (today’s free challenge, Kitch IQ) was clicked — each as a plain anonymous number, shown only to the coach on their own dashboard.

Once a link reaches 50 opens, or the coach reaches 300 across all their links in a calendar month, we stop counting new opens on the affected link(s); the link keeps working for students either way. Each count is taken at most once per network per link per day, using the same daily-salted, one-way IP hash the free daily challenge uses (Section 11.2): we never store the raw IP address, and the hash cannot be linked across days.

So several players on the same network on the same day count once. If the two-sided referral program is active and the coach has a referral code, their link also carries that code into the Kitch IQ next step, so a purchase can be credited to them under the referral terms (Section 11.1) — this never adds anything about the student to what we store. As for any visitor to pickleswaps.com, Google Analytics applies only if they allow it.

Old coach-shared links. A link made before coach accounts existed (pickleswaps.com/rallywise/s/<id>) keeps working, with a notice, until 30 November 2026, after which it redirects to the free daily challenge; neither the old nor the new kind of link has ever used cookies or collected anything about the student playing it.

12. Your Privacy Rights and Choices

12.1 Rights We Extend to Everyone

Regardless of where you live, you can ask us to: access the personal information we hold about you; correct it; delete it; give you a copy in a portable format; and stop using it for a particular purpose, including withdrawing any consent you gave (such as the training program, Section 9.4).

For Kitch IQ and Rallywise, you can delete your account and data yourself at pickleswaps.com/account/delete (or from your account page). For anything else, email privacy@pickleswaps.com from the email address associated with your data.

We verify requests by matching the requesting address to our records and may ask for additional confirmation; we respond within 30 days (45 days where local law allows and we notify you of the extension). We will never discriminate against you — in price, quality, or availability of the Service — for exercising privacy rights.

12.2 California Residents

California residents have rights under the California Consumer Privacy Act (CCPA, as amended by the CPRA), including the rights to know, delete, correct, and opt out of "sale" or "sharing" of personal information, and to limit use of sensitive personal information.

Whether or not PickleSwaps currently meets the CCPA’s coverage thresholds, we honor these rights for all California residents. We do not sell personal information for money. Our use of analytics and affiliate links may constitute "sharing" for cross-context behavioral advertising under the CCPA’s broad definitions; you can opt out of any such sharing by (a) enabling the Global Privacy Control (GPC) signal in your browser, which we treat as a valid opt-out for that browser, or (b) emailing privacy@pickleswaps.com with the subject "Do Not Sell or Share."

You may designate an authorized agent to submit requests on your behalf. We do not knowingly sell or share the personal information of consumers under 16.

12.3 EEA, UK, and Swiss Visitors

Our Service is operated from the United States and directed to a U.S. audience; we do not target the EU/UK market. If you use the Service from the EEA, UK, or Switzerland, your information will be processed in the United States, and the rights in Section 12.1 — which mirror the core GDPR rights of access, rectification, erasure, portability, restriction, objection, and withdrawal of consent — are available to you.

Where GDPR applies to our processing, our legal bases are: performance of a contract (delivering analyses and purchases), consent (email marketing; the training program in Section 9, which is specific, informed, freely given, and withdrawable at any time as easily as it was given), and legitimate interests (site security and aggregate analytics).

You also have the right to lodge a complaint with your local supervisory authority. Google Cloud, our storage provider, participates in the EU-U.S. Data Privacy Framework; our own transfers rely on your awareness that the Service is U.S.-based plus the safeguards described in this policy.

13. Children

The Service is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher bar for consent-based processing). Who may create an account or make a purchase is set out in our Terms of Service (Section 2).

Rallywise has no child accounts or profiles, never asks for a child’s details, and does not ask any player for their age or date of birth. Uploaded match footage may incidentally include minors playing pickleball; our Terms require the uploader to have parent/guardian consent for identifiable minors and prohibit opting such footage into the training program where a minor is a primary subject.

If you believe a child’s personal information was provided to us without consent, or you are a parent or guardian who wants footage of your child deleted, email privacy@pickleswaps.com and we will delete it promptly.

14. Security

We use HTTPS everywhere, encryption at rest for stored video (default GCP encryption), scoped credentials, and least-privilege access. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you and regulators as required by applicable law, including California’s breach-notification statute.

15. International Users

We operate from the United States. If you access the Service from outside the U.S., you understand that your information is processed and stored in the U.S., where privacy laws may differ from those of your jurisdiction. Section 12.3 describes rights for EEA/UK/Swiss visitors.

16. Email Marketing

We send marketing email only to addresses that signed up, every message identifies us and includes a working unsubscribe link, and we honor unsubscribes promptly (and in any event within 10 business days), consistent with the CAN-SPAM Act. Transactional emails (purchase receipts, analysis delivery, policy notices) are sent as part of the Service.

17. Do Not Track and Opt-Out Preference Signals

We treat the Global Privacy Control signal as a valid request to opt out of any "sale" or "sharing" of personal information for the browser sending it. Because there is no settled standard for legacy "Do Not Track" browser signals, we do not respond to DNT signals other than GPC. This disclosure is made in accordance with the California Online Privacy Protection Act (CalOPPA).

18. Changes to This Policy

We may update this policy. We will post the updated version with a new "Last updated" date. For material changes that affect Kitch IQ customers with open retention windows (including training-program participants), we will notify those customers by email before the change takes effect for their data.

Material changes are not retroactive: data collected under a prior version remains governed by the commitments in effect when it was collected, unless you consent otherwise or the change is required by law.

19. Contact

PickleSwaps LLC — privacy@pickleswaps.com — 12 Pointe View Pl, South San Francisco, CA 94080. We aim to acknowledge privacy inquiries within 14 days and resolve them within 30 days.