Privacy Policy - PinSpree

Pinspree LLC ("Company," "we," "us," or "our") operates the PinSpree mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

Please read this Privacy Policy carefully. It describes our data practices; it does not replace permission requests or consent required by law. Features and available controls can differ by platform and app version.

1. Information We Collect

1.1 Information You Provide

Account Information: Email signup requires a name, email address and password. We also process your account ID, username and authentication information. A profile photo and bio are optional. Passwords are hashed by our authentication service.
User-Generated Content: Photos, pin titles, descriptions, categories, tags, chosen locations, profile information, plans, circles, guides, availability and check-in information that you submit. Photos you upload leave your device and are stored by the service.
Contacts and relationships: Android contact matching is optional. If you allow contact access and choose contact matching, phone numbers are normalized and SHA-256 hashed on your device, and the hashes are transmitted to PinSpree to find people you know. Hashes are not encryption or anonymous data. The matching request sends phone-number hashes, not address-book names or raw phone numbers. Friend, follow and invite relationships are stored separately. You can decline or revoke Contacts permission in Android settings.
Safety and policy records: Where reporting, blocking or policy-acceptance features are available, we process the reported account or content identifier, reason and details, reporting account, block relationships and accepted policy version to handle safety concerns and enforce our rules. Do not attach illegal imagery to a report.
Communications: Information you provide when contacting us for support.

1.2 Information Collected Automatically

Location Data: With device permission, Android can send approximate or precise foreground location for nearby discovery and location-based features. Device-location access is optional and can be disabled in settings. Locations you choose for pins and plans, and locations you explicitly share in a plan, are also transmitted and may be stored. Denying device permission does not remove locations you have already posted. IP addresses may reveal approximate location.
Device and SDK Information: Google Maps SDK for Android automatically collects request and device metadata, IP addresses, stack traces, crash metrics and a Maps SDK-specific pseudonymous identifier. It can also collect map interactions such as panning and zooming. Google uses this information to maintain and improve its services. A Maps SDK identifier is not the Android Advertising ID.
App Interactions: Searches, saves, likes, follows, RSVPs, joins, invites, notification-read status and preferences sent to the service when you use those features.
Service Logs: Our hosting providers process network and request information such as IP addresses, request times, requested routes and errors. Logs can contain account identifiers associated with an operation. These records support delivery, troubleshooting and security.

1.3 Information from Third Parties

Social Login: Android offers Google sign-in through Google identity services. If you choose it, we receive and verify identity information including a provider account ID, email address and available profile details. Apple sign-in is available on supported Apple clients. Provider handling is also governed by the provider's privacy policy.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the App
Enable location-based features (pin discovery, map functionality)
Process and display your user-generated content
Send you technical notices, updates, and support messages
Respond to your comments, questions, and customer service requests
Monitor and analyze usage trends and preferences
Detect, investigate, and prevent fraudulent or unauthorized activity
Personalize your experience
Comply with legal obligations

3. Sharing of Information

We may share your information in the following circumstances:

3.1 With Other Users

Your public pins, public plans, profile information and associated photos can be visible to other users and through public links. Android pin creation defaults to public; review the audience before posting. Other content is shared with the people allowed by the feature, such as plan participants or circle members. Uploaded images can be served from publicly accessible URLs: do not assume a private pin or profile makes an image URL private. Copies another person saves or shares are outside PinSpree's direct control.

3.2 Service Providers

The following providers receive information when supplying the relevant service. Some process data on our behalf; others, including Google Maps, also process information for purposes described in their own privacy policies. This list is not a claim that every transfer qualifies for a Google Play service-provider sharing exception.

Microsoft Azure: Hosts the production API, PostgreSQL database, uploaded objects and application logs.
Vercel: Hosts this website and its public sharing pages, processing web requests and associated network information.
Google Maps and Google identity: Provide maps and optional Google sign-in on Android. Maps diagnostic and identifier collection is described above. See Google's Privacy Policy and Maps SDK data disclosures.
Apple services: Supported Apple clients use Apple map, identity or notification services as applicable. This is not a claim that Android has Apple-only features or background push delivery.
Website resources: This website loads fonts from Google and styling from a third-party CDN; those providers receive requests when your browser loads those resources.

3.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request.

3.4 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

3.5 With Your Consent

We may share information for other purposes with your explicit consent.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. We will retain and use your information as necessary to:

Comply with legal obligations
Resolve disputes
Enforce our agreements

You may request deletion of your PinSpree account and associated data at any time, without installing or signing into the app. The deletion page explains how to contact the owner, what is deleted and the limits on provider-copy cleanup (see also Section 6).

We do not promise a fixed deletion period for every data type. Active account records and submitted content remain until deleted or no longer needed for the service. Deletion must also address associated records and uploaded files; removing an account row alone does not establish that all copies have been erased. Information may be retained when necessary for security, fraud prevention, a documented dispute, or a legal preservation or reporting obligation, with access limited to that purpose.

Provider copies: As checked on September 28, 2026, our Azure PostgreSQL database has a seven-day rolling backup retention setting, and the Azure Container Apps log tables have a 30-day retention setting. These are provider configuration windows, not a promise that your complete deletion request finishes in seven or 30 days. An account deletion does not selectively erase an existing database backup. If a backup is restored, applicable completed deletions need to be reapplied before restored personal data is used. Object-storage cleanup, website logs and Google or Apple provider records follow their applicable controls and policies; no single fixed period for all such copies is asserted here.

When handling a verified deletion request, the responsible operator must explain any necessary retained categories and reasons, and communicate outstanding provider cleanup rather than describing an incomplete request as complete.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption of data in transit (TLS/SSL)
Hashed account passwords
Encrypted Android session-token storage
Access controls and authentication

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

6.1 All Users

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and personal data
Location Services: Enable or disable location access through device settings
Push Notifications: Opt out through device settings
Marketing Communications: Unsubscribe via links in emails

6.2 European Users (GDPR)

If you are in the European Economic Area, you have additional rights:

Legal Basis: We process your data based on consent (location), contract (providing services), and legitimate interests (improving services, security)
Data Portability: Request your data in a structured, machine-readable format
Restriction: Request restriction of processing
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent at any time without affecting prior processing
Lodge Complaint: File a complaint with your local data protection authority

6.3 California Residents (CCPA/CPRA)

California residents have additional rights:

Right to Know: Request disclosure of personal information collected, used, and disclosed
Right to Delete: Request deletion of personal information
Right to Correct: Request correction of inaccurate information
Right to Opt-Out: We do not sell personal information
Non-Discrimination: We will not discriminate against you for exercising your rights

Categories of Personal Information Collected:

Identifiers (email, username, device ID)
Geolocation data
Internet activity (usage data)
User-generated content

To exercise your rights, contact us at team@pinspree.com or through the App settings.

7. Children's Privacy (COPPA)

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at team@pinspree.com.

If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws.

Our initial Android launch is focused on the United States. Availability elsewhere does not remove applicable privacy rights. This policy does not represent that a particular international transfer agreement or certification has been independently verified.

9. Third-Party Links and Services

The App may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated policy in the App
Updating the "Last Updated" date
Sending you a notification (for significant changes)

The date and version above identify this policy. Where the App asks for policy acceptance, that action is separate from optional device permissions and does not waive your privacy rights.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Pinspree LLC

Email: team@pinspree.com

Support: team@pinspree.com

For GDPR inquiries: team@pinspree.com (Subject: "GDPR Request")
For CCPA inquiries: team@pinspree.com (Subject: "CCPA Request")

This Privacy Policy is effective as of September 28, 2026.