Privacy policy
What pitchd collects, why, who sees it, and how to remove it.
Last updated: 30 October 2026.
-
Who is responsible for your data
pitchd is operated by Softlify doo, a limited liability company registered in the Republic of Serbia under company registration number 22088149 and tax ID 114901548, with its registered office at Jaračkih žrtava 21/48, 15000 Šabac, Serbia. Softlify doo is the data controller for the personal data described below. We process it under the Serbian Law on Personal Data Protection and, for people in the European Union or the European Economic Area, under the GDPR. For any question about this policy, or to exercise the rights described under “Your rights”, write to hello@pitchd.team or to the postal address above, or call +381 63 395 590.
-
Data we collect
When you create an account, pitchd stores your first name, last name, email address, and how you signed in (Google, Apple, or email + password). Your profile can also hold a profile picture, filled in automatically if you sign in with Google. It can hold a phone number too, but the app never asks for one — that field exists only for accounts created in the earlier web version, and nothing in pitchd uses it. For events you participate in, the service stores your responses to invitations (accepted, declined, no-show, etc.), your attendance, the Loyalty Score calculated from them, the events you organised or joined, and any cost-split records. If you grant push permission, your device push token is stored so pitchd can send notifications — the token only, not your device model or location. An organiser can also add a guest to a single session by name, for someone who has no pitchd account; that name is visible to the members of that event and is stored with the session it was added to.
-
How we use it, and on what legal basis
To run the service you signed up for: deliver invitations, queue replacements, compute Loyalty Scores, split costs, send the emails the service depends on (verification, password reset), and let you sign in across devices. This is necessary to provide the service under our terms (GDPR Art. 6(1)(b)). Push notifications are sent only if you allow them on your device, and you can withdraw that permission at any time in your device settings or turn off individual notification types in the app (Art. 6(1)(a)). To keep the service secure and working, we report server errors, limit repeated sign-in attempts and keep backups; this is in our legitimate interest in a reliable, secure service, and it uses no more data than that requires (Art. 6(1)(f)). We do not use your data for advertising and do not sell it.
-
The Loyalty Score
pitchd ranks the members of each event by a Loyalty Score built from their attendance, number of appearances, how quickly they reply to invitations and their no-shows. The score decides the order in which members are invited when spots are limited, and who is offered a spot when someone drops out. It is calculated automatically, separately for each event, and the event’s organiser chooses how much each factor counts. It affects only who is invited to that group’s games first. You can see your own score and what it is made of in the app; if you think it is wrong, tell the organiser or write to us.
-
Sharing
Other members of an event see your first and last name, your profile picture, your responses and attendance for that event, and your Loyalty Score in that event’s invitation queue. Your email address and phone number are never visible to other users — you only see your own. If you organise an event, what you write about it — its title, venue, notes, and the “How to pay” note — is visible to every member of that event, so put payment details there only if you want the group to have them. pitchd itself does not take, process, or store payments.
-
Who processes your data
pitchd runs on Railway (application and database hosting, EU region). Encrypted database backups are stored with Cloudflare R2, and Cloudflare also hosts this website. Transactional email is sent through Resend. Push notifications are delivered through Google Firebase Cloud Messaging and, on iPhones, through Apple’s push notification service; Sign in with Apple and Google sign-in are provided by Apple and Google. Errors in the pitchd server are reported to Sentry (Functional Software, Inc.), which stores them in its EU data region; a report describes what failed and where, and is stripped of email addresses, sign-in credentials and invite links before it is sent. Each provider receives only what its function needs — an address to mail, a token to push to, a stack trace to diagnose — and processes it on our behalf under its own data-protection terms. There are no advertising or analytics providers.
-
Transfers outside Serbia and the EU
Several of these providers are based in the United States, so sending an email or a push notification, or storing a backup, can involve a transfer of personal data there. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that certification; otherwise the transfer is covered by the European Commission’s Standard Contractual Clauses in the provider’s data-processing terms. You can ask us for details of the safeguard used for a given provider.
-
Retention
Your account data is retained while your account is active. If you delete your account, personally identifiable fields are anonymised and your refresh tokens and registered devices are removed. Attendance records that other members of your groups depend on are retained in an anonymised form so their history remains intact. A device push token that has not been used for 30 days is deleted automatically. Encrypted database backups are kept for 30 days (daily copies) and 12 months (one copy a month), then deleted, so data from a deleted account can remain in a backup until that backup expires. Server error reports are deleted by Sentry after its retention period, at most 90 days.
-
Your rights
You can view and edit your profile, and delete your account, from inside the app — Profile, then Delete account. You also have the right to ask for a copy of your data (including in a portable format), to have it corrected or erased, to restrict or object to its processing, and to withdraw consent you have given (such as push permission) at any time, without affecting what was done before. To exercise any of these, email hello@pitchd.team; we answer within one month. You have the right to complain to a supervisory authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs); in the EU/EEA, the data-protection authority of the country where you live or work. Depending on where you live, you may have similar rights under other laws, such as UK GDPR or the CCPA (California).
-
Cookies and tracking
This site sets no cookies and runs no analytics. Fonts and images are served from pitchd.team itself rather than from third parties; like any web host, Cloudflare processes each request, including your IP address, to deliver the page. The mobile app contains no analytics or advertising SDKs. The invite and open-spot links ask the pitchd API for that event’s details, which is the whole point of the link.
-
Children
You must be 16 or older to create a pitchd account (see the Terms of service), and pitchd is not directed at anyone younger. If you believe someone under 16 has created an account, contact hello@pitchd.team and the account will be removed.
-
Changes
Material changes to this policy will be announced on this page and, where appropriate, by email to active accounts.
-
Contact
Questions about privacy, or a request to access, correct, export or erase your data: email hello@pitchd.team, or write to Softlify doo, Jaračkih žrtava 21/48, 15000 Šabac, Serbia.