Privacy Policy

1. Overview

Picnic is built to be a private space for your family and friends — not an advertising platform. We don't sell your data, we don't run ads, and we don't share your photos or videos with anyone outside the circles you choose. This policy explains what we collect, why, and how it's protected.

The data controller responsible for your information is Twenty Mountains Ltd, a company registered in England and Wales under company number 13022758, with its registered office at 20-22 Wenlock Road, London, England, N1 7GU ("Picnic", "we", "us", or "our").

2. Information We Collect

We collect the following categories of information:

• Account information — your name and email address, provided when you sign up.
• Content you share — photos, videos, captions, and updates you upload to your circles.
• Circle & invite data — who you've invited, who's in your circles, and the relationships between accounts needed to show you the right content.
• Payment information — if you subscribe, our payment processors (Stripe, Apple, or Google) handle your card or payment details directly. We only receive confirmation of payment and a subscription status, never your full card number.
• Device & usage data — basic technical information (like app version and device type) needed to keep the Service running reliably and to diagnose problems.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service — showing you your circles' content, sending invites, processing payments;
• Communicate with you — invite notifications, account and billing emails, and support responses;
• Keep Picnic secure — detecting abuse, fraud, and unauthorised access; and
• Improve the Service — understanding what's working and fixing what isn't, using aggregated, non-identifying insights wherever possible.

4. Legal Basis for Processing

If you're in the UK or EEA, we rely on the following legal bases: your content and account data are processed to perform our contract with you (providing the Service you signed up for); billing and fraud prevention rely on our legitimate interests, balanced against your rights; and where we ask for your consent — for example, for optional communications — you can withdraw it at any time.

5. How We Share Your Information

We don't sell your data or share it for advertising. We do work with a small number of trusted service providers ("sub-processors") who process data strictly on our behalf, to run the Service:

• Clerk — authentication and account sign-in.
• Stripe / Apple / Google — subscription billing and payment processing.
• Resend — transactional email delivery (invites, account notifications).
• Cloudflare — application hosting and, for uploaded media, storage.
• Neon — our database provider, storing account and circle data.

We may also disclose information if required by law, or to protect the rights, safety, and security of Picnic, our users, or the public. If Picnic is ever involved in a merger or acquisition, your information may transfer as part of that transaction, subject to the protections of this policy.

6. Data Retention

We keep your account and content for as long as your account is active. If your subscription lapses, circles you administer become read-only and, if unresolved after 90 days, are archived — content is hidden but not deleted, so you can pick up where you left off if you resubscribe. If you close your account entirely, we delete or anonymise your personal data within a reasonable period, except where we're required to retain it for legal or accounting reasons.

7. Data Security

We use industry-standard measures to protect your information, including encryption in transit, access controls, and hosting with reputable infrastructure providers. No system is completely secure, but we work continuously to keep your memories safe.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To exercise any of these rights, contact us at privacy@viapicnic.com.

If you're in the UK or EEA and you're not satisfied with our response, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

9. Children's Privacy

Picnic isn't directed at children, and we don't knowingly collect personal information directly from anyone under 16. Photos or information about a child may appear on Picnic only when added by a parent, guardian, or other adult with the right to do so, through their own account.

10. International Data Transfers

Our service providers may process data in countries outside your own, including the United States. Where this happens, we rely on appropriate safeguards — such as standard contractual clauses — to make sure your information stays protected wherever it's processed.

11. Cookies & Tracking

Our website uses only the minimal cookies necessary to keep you signed in and to remember your preferences. We don't use third-party advertising or tracking cookies.

12. Changes to This Policy

We may update this policy from time to time. If we make material changes, we'll let you know — for example, by email or an in-app notice — before they take effect.

13. Contact Us

Questions about how we handle your data? Reach us at privacy@viapicnic.com.