Security & data handling

Built to be easy to say yes to.

Pickup is operated by Call Game LLC. This page answers the questions a workplace or public-agency reviewer asks before a pilot. We keep it current and we're candid about what we do and don't have today.

Last updated: October 2026

At a glance

Where data lives

United States (Supabase, US East / N. Virginia). Data is not stored outside the US.

Encryption

In transit via TLS; at rest on managed, encrypted storage.

Authentication

Access control

Row-level security on every table — a user can read only the games, crews and organizations they belong to.

Age

18+. The Service is not directed to children.

Cost

Free to run a workplace or agency pilot. No per-seat fees.

What we collect

Account basics (name, the email or Apple relay you sign in with, optional photo), the sports and city you choose, the games and crews you take part in, and limited first-party product-usage events (which you can turn off in Settings). Location is coarse by default and used to show nearby games; precise location is session-only and not kept as a historical log. Full detail is in our privacy policy.

What an employer or champion can see: within a workplace league, a champion and coworkers see department games, who showed up, and the standings — the same information every member sees. Champions see participation totals, not individual tracking. Pickup never discloses an employee's location, personal games, or activity outside the organization's league to their employer.

Subprocessors

We use a small set of trusted providers. Each receives only the data needed for its function.

Provider	Purpose	Region
Supabase	Database, authentication, file storage	US East
Expo (EAS)	Push-notification delivery	US
Resend	Transactional email (sign-up confirmation)	US
Twilio	Optional SMS reminders to invited guests	US
Agora	Live audio/video when broadcasting a game	Global edge
Vercel	Hosting for this website	US / global CDN

Retention & deletion

You can delete your account and personal data at any time in the app (Settings → Delete account), or by emailing us.
On deletion we purge personal data from live systems within 30 days; residual copies in encrypted backups rotate out within 90 days.
Organization owners can request export or deletion of their organization's league data by contacting us.
Precise, per-session location is not retained as a historical log.

Candid about what we have today

We're a small, focused company and we'd rather be straight with your reviewer than overstate.

Compliance: we do not yet hold a SOC 2 report or third-party penetration-test attestation. We build on SOC 2 / ISO 27001-certified infrastructure (Supabase, Vercel) and will support reasonable security questionnaires and a data-processing agreement for pilots.
SSO / SCIM / MDM: not available today; sign-in is Apple or email. Enterprise SSO is on our roadmap and we're happy to discuss requirements for a deployment.
Public records: league chat and content live in the app; agencies subject to public-records law should treat in-app messages as they would other messaging tools and can request an export.
Accessibility: the app follows platform accessibility conventions; a formal VPAT is not yet published.

Reporting a vulnerability

Found a security issue? We want to hear from you. Email info@callgame.co with details and steps to reproduce. We'll acknowledge within three business days and keep you updated. Please don't publicly disclose until we've had a chance to fix it. We don't pursue good-faith researchers who follow this process.

Questions from procurement?

We'll complete a security questionnaire, sign a DPA, and provide a W-9 and certificate of insurance for a pilot. Start at pickupcg.com/pilot or email info@callgame.co.