PingsterzPrivacy Policy
Pingsterz is a live map of where people are right now. This policy explains what Pingsterz collects, why, who can see it and how long it is kept. Pingsterz is published by Mister Business Enterprises ("we"). You can reach us at mister-business-enterprises@agentmail.to.
The short version
- A ping is public. For up to 60 minutes (two hours if you have Pingsterz+), everyone using Pingsterz can see your username at the place you pinged from, with your photo and caption if you added them.
- Your exact position is sent to us and stored only when you ping. Pingsterz does not follow you in the background.
- While the map is open, the app tells our servers which area of the map is on screen, so that they can send the pings there. While a list of pings is open, it tells them where those pings are, to keep the list up to date. That shows us roughly where the map is looking, and which place's pings you have open. We answer these requests and do not save them.
- A photo you add is checked by TypeSafe, an AI service, before anyone else sees it. The app asks for your permission before your first photo.
- Friends nearby is off until you turn it on. While it is on, the app sends your rough area, to about 1 km, each time you open it. We keep it 12 hours and use it only to alert you when someone you follow pings within about 5 km (15 km with Pingsterz+). Nobody else sees it.
- Sharing a ping makes a link to its page on our website. Anyone who has the link, also without the app, sees that ping while it is live: the username, caption, photo, its age and its area to about 1 km, never its exact place.
- A ping is shown for 60 minutes, or two hours with Pingsterz+, and then deleted: the ping within five minutes, its photo within about 20 minutes.
- If you buy Pingsterz+, Apple handles the payment. We receive Apple's signed record of the subscription, never your payment details.
- Three things are kept longer, where other people cannot see them: when and where you pinged (two to three hours, so that the limits on pinging hold); a report that someone files about you or your ping, with your username and the ping's caption (up to 12 months, also after you delete your account); and a photo that someone reported (14 days from when we put it aside, which is within about 20 minutes of the ping's end).
- Pingsterz shows ads from local businesses, marked "Sponsored". They are chosen only by the area of the map on screen and the time, never by anything about you. We count how often each ad is shown and tapped, without noting who.
- We do not sell your data or track you across other apps and websites.
- You can remove a ping at any time and delete your account in the app. Neither removes a report about you, or a reported photo, before its time is up. If you signed in with Apple, deleting your account also asks Apple to end that connection.
What we collect
| What | When | Why |
|---|---|---|
| Email address. With Sign in with Apple: the identifier Apple gives us for you, and the email address you choose to share with us (your own, or the relay address Apple makes when you hide yours) | When you sign in | To give you an account and let you back in |
| With Sign in with Apple only: a one-time code that Apple gives your phone when you sign in, and the token that Apple gives our servers in exchange for it. We keep the token together with Apple's identifier for you and the time we received it, and a count of the codes your account sent us in the past hour | Each time you sign in with Apple | So that we can ask Apple to end Sign in with Apple for Pingsterz when you delete your account. The token is used for nothing else, and the code is passed on to Apple and not kept. The count limits how often our servers ask Apple |
| Username | When you join | Shown on every ping you drop, and to people who search for you |
| Precise location: the latitude and longitude of your phone. The accuracy your phone reports is sent with them, checked and not kept | Only at the moment you ping | To place your ping on the map, and to refuse pings that are too many or from a place you could not have reached |
| The area of the map on your screen, and how far it is zoomed in | While the map is open | To send you the pings in that area. We do not save it |
| The area that the pings in an open list are in | Every half minute while a list of pings is open | To take pings that are gone off the list. We do not save it |
| Photo and caption | Only if you add them to a ping | Shown with your ping, after an automatic check |
| Rough area: your phone's position rounded to two decimals of a degree, about 1 km | Only with Friends nearby on: each time you open the app | To alert you when someone you follow pings within about 5 km (15 km with Pingsterz+). Nobody else sees it, and it is used for nothing else |
| Push token: the address Apple gives your phone for alerts, and whether the app came from the App Store or a test build | Only with Friends nearby on: when you turn it on and each time you open the app | To deliver those alerts |
| When you were last alerted about each person you follow | When an alert is sent | So that you get at most one alert an hour about the same person |
| The people you follow and the people you block | When you follow or block | To show you your friends' pings and to hide people you blocked |
| Pingsterz+: Apple's signed record of your subscription. We keep which option you chose (monthly or yearly), Apple's number for the subscription, whether it was bought in the App Store or in a test build (TestFlight), when the period you paid for ends and, if Apple refunded or revoked it, when. Apple sends us the same record when the subscription renews, ends or is refunded. We never receive your name, Apple Account, card or other payment details | When you buy or restore Pingsterz+, when the app opens while you have it, and when Apple tells us about a renewal, an expiry or a refund | To give you Pingsterz+ and to end it when the subscription ends |
| The ping colour you picked with Pingsterz+ | When you pick one | Shown on your pings while you have Pingsterz+ |
| Reports you file | When you report a ping or a person | To review content and people that may break the rules |
| Reports that other people file about you: your username at that moment, the reason and, for a reported ping, its caption and its photo | When someone reports you or your ping | To review the report, and to act on repeat offenders |
| Sign-in records: when you last signed in, and the IP address and the app and system version your phone last connected with | When you sign in, and whenever the app renews your sign-in | To keep you signed in and to notice misuse |
| Technical logs: IP address, time, the request made | Whenever the app talks to our servers | Security, abuse prevention and fixing faults |
The list of people you follow and block is what the App Store's privacy label calls "Contacts". Pingsterz does not read the contacts in your phone's address book.
Other things Pingsterz does not collect: your photo library (you pick each photo yourself; the app cannot browse your library), your exact position while you are not pinging, advertising identifiers, or anything about your use of other apps.
Photos are re-encoded on your phone before upload. This removes the hidden data a camera stores in a picture, including where and with what device it was taken.
The map
While the map is open, the app asks our servers for the pings in the area on screen: whenever the map moves, and again whenever the app refreshes it, which it does about every half minute. The request names that area and how far the map is zoomed in. Before it is sent, the area is widened outward to a fixed grid, so the request does not carry the exact point the map is centred on.
It still tells us roughly where the map is looking: to within about a kilometre when the map shows a neighbourhood, and to within tens of metres when you zoom in as far as the map goes. While the map is centred on you, that is roughly where you are. We use the request to answer it. The area is not saved with your account or anywhere else in our database; like every request, the fact that it was made appears in the technical logs.
When you tap a place on the map, a friend, or the note about your own ping, the app lists the pings there. While that list is open, the app asks our servers every half minute whether those pings are still there, so that a ping that was removed or hidden leaves the list. This request names the area those pings are in, widened to the same grid at its finest: it says where the listed pings are to within about 40 to 80 metres, however far the map is zoomed out. That is the place of those pings, which we hold anyway, and not the position of your phone. What it tells us beyond that is that you have their list open. Like the map request, it is answered and not saved.
Your phone works out your position by itself to centre the map and to show where you are on it. The position itself reaches us only when you ping.
Friends nearby
If you turn on Friends nearby in Settings, you get an alert when someone you follow pings within about 5 km of you (15 km with Pingsterz+), at most once an hour for the same person. Phones decide nothing here; our servers do. For that, each time you open the app, it sends us your rough area: your position rounded to two decimals of a degree, which is about 1 km. We keep only your latest area, for 12 hours, and use it for these alerts and nothing else. Nobody else sees it, and your followers never learn where you are from it. A ping by someone you follow is compared with your area on our servers; the alert then names that person and shows their caption, and opens the map at their ping.
Alerts reach your phone through Apple's push service. Apple receives your phone's push token and the alert's text, under its own privacy policy. It is off until you turn it on, and on each phone separately. Turning it off, or signing out, stops the alerts on that phone and, when no phone of yours has it on any more, deletes your area at once.
Ads
Pingsterz sells its own ads to local businesses: a slim "Sponsored" banner under the top of the map, and "promoted pings", an advertiser's marker on the map with a card. Every ad is marked "Sponsored". There is no ad network in the app and no code from any advertiser.
Which ads you see depends on two things only: the area of the map on screen, which the app sends anyway to load the pings there (see The map), and the time. Nothing about you, your account, your pings or your device is used to choose an ad, and no advertiser learns anything about you.
When an ad is shown on your screen for the first time in a session, and when you tap it, the app tells our servers so. We add one to that ad's count for the day, and keep nothing else: not who, not where, not which phone. Advertisers can be told those daily counts.
Tapping an ad opens the advertiser's website inside the app, or Apple Maps for directions. What happens there is up to the advertiser or Apple and their own privacy policies.
Ads pass the same automatic check as photos (TypeSafe, see below) before they are shown.
Photo checks by TypeSafe
A ping with a photo is checked before anyone else can see it. The check is automatic and is done by TypeSafe, an AI service. Our servers send it the photo and the caption of that ping, and it answers, for each kind of content our community rules forbid (nudity, violence, weapons, hate, drugs, self-harm, harassment), how likely the photo or caption shows it. TypeSafe does not receive your name or username, your email address or your location. A ping without a photo is not sent to TypeSafe; its caption is checked against a list of words on our own servers.
Nothing is sent to TypeSafe without your permission. Before you can add your first photo, the app tells you what is sent and asks. If you say no, you can still ping without a photo. A yes is remembered on that phone only, for your account; another phone asks again.
You can take the permission back at any time: in Settings, turn off Allow photo checks, on each phone where you allowed it. The app then asks again before you next add a photo. The note of what you allowed stays on the phone, also after you delete your account, until you delete the app. Pinging without a photo sends nothing to TypeSafe either way. Taking the permission back does not undo the checks that were already made, and a photo you have already posted is still checked.
Who can see what
- Everyone signed in to Pingsterz can see a live ping: its place, your username, its photo and caption, and how old it is. A ping with a photo appears for others only after the photo has passed the check; until then only you see that ping.
- Anyone with a ping's link can see that ping on our website while it is live, without the app or an account: your username, the caption, the photo, how old it is, and its area rounded to about 1 km, not its exact place. Anyone can share any live ping they see, yours included, and a link can be passed on. When the ping ends, is removed or is reported away, the page only says that it has ended; a page that is already open notices within about two minutes. In the app, the link opens the ping at its place, for people who could see it on the map anyway.
- Anyone signed in can follow you. You are not asked. People who follow you see your live pings marked as a friend's, wherever on the map they are. To stop someone seeing your pings, block them.
- Only you can see who you follow and who you blocked. Nobody can see who follows them, and the people you follow or block are not told.
- People you blocked cannot see your pings, your photos or your profile, and you no longer see their pings. They stay in your list of blocked people, so that you can unblock them. The same holds the other way round when someone blocks you.
- Your username can be found by everyone signed in who searches for the letters it starts with. Everyone signed in can also read it from our servers, together with the date you joined; the app does not show that date.
- Reports are seen only by us. A person you report is not told who reported them. A ping you reported is hidden from you, and a ping that several people reported is hidden from everyone; its author is shown that it was not approved.
- Nobody else sees your email address.
- We can see what is stored, to operate the service and to review reports. A reported photo that we keep lies in storage that no account can read, yours included.
How long we keep it
| What | How long |
|---|---|
| A ping: its place and caption | Shown for 60 minutes, or two hours with Pingsterz+, then invisible to everyone and deleted within five minutes. You can remove it sooner |
| When and where you pinged, in a log that only we can read | Two to three hours: once an hour, entries older than two hours are deleted. Removing the ping does not remove its entry; deleting your account does. The limit of 10 pings an hour reads the last hour of this log, and the check against impossible journeys compares a new ping with your last one of the past two hours |
| A ping's photo | Others can open it only while the ping is live. The file is deleted at once when you remove the ping yourself, and within about 20 minutes when the ping runs out, or when your phone loses its connection while it removes the ping |
| A photo that someone reported | You cannot delete it. Within about 20 minutes of the ping's end it is moved to storage that only we can read, and it is deleted 14 days after that. We keep at most 20 such photos of one person; a further one is deleted like any other photo. For 14 days after the report, no new photo can be stored under the file name of the reported one |
| Your account: email address, Apple's identifier if you signed in with Apple, username, the people you follow and block | Until you delete your account |
| Your Pingsterz+ record and ping colour | Until you delete your account. Deleting it does not cancel the subscription at Apple, which keeps its own record of the purchase under Apple's privacy policy |
| The token from Apple, if you signed in with Apple | While you have an account; each sign-in with Apple replaces it. When you delete your account we use it to ask Apple to end the connection, and delete it as soon as Apple confirms. If Apple does not confirm, we try again for seven days and then delete it. The count of codes goes with your account |
| Reports: who was reported, with their username at that moment, who reported, why, and for a reported ping its caption and the name of its photo file | Up to 12 months, to act on repeat offenders. A report stays when the person it is about deletes their account. When the person who filed it deletes theirs, it stays without their name |
| Your rough area, for Friends nearby | 12 hours from when the app last sent it, then deleted within the hour. It goes at once when you turn Friends nearby off on your last phone, sign out there, or delete your account |
| A phone's push token | Until you turn Friends nearby off on that phone, sign out there or delete your account, or 60 days after the app was last opened there |
| When you were last alerted about someone | One hour, then deleted within the hour |
| Sign-in records | Until you sign out on that phone or delete your account |
| Technical logs | Up to 30 days |
Anyone who can see a photo can save it, and a download link that someone made for themselves while the ping was live can go on working until shortly after the file is deleted. Deleting the file ends such a link. It cannot take back a copy that somebody saved.
Deleting your account removes, at once, your sign-in, your username, your pings and their photos, the log of when and where you pinged, and the people you follow and block, together with other people's follows and blocks of you, and everything of Friends nearby: your area, your phones' push tokens and when you were alerted. A photo file can take up to about 20 minutes if your phone loses its connection halfway. Three things stay in our database: reports that other people filed about you, with your username and the caption of the reported ping, for the 12 months above; a photo of yours that was reported, for the 14 days above; and reports that you filed, which stay for their 12 months without your name. Outside it, the technical logs keep their entries for the time above.
If you signed in with Apple, deleting your account also asks Apple to end Sign in with Apple for Pingsterz. Our servers send Apple the token described above, at once. When Apple confirms, Pingsterz leaves the list under Sign in with Apple in your Apple Account and we delete the token. Until then the token is the one thing of your account that we still hold: we ask Apple again for up to seven days and then delete it in any case. Two things can keep this from working. We may hold no token for you, because the exchange with Apple at your last sign-in failed. Or Apple may no longer accept the token; Apple says that happens, for example, when you change your Apple Account password. The app tells you after deleting whether it could ask Apple. Either way you can end the connection yourself: on your iPhone open Settings, tap your name, then Sign in with Apple, and remove Pingsterz there.
Who handles data for us
- Supabase hosts the database, sign-in and photo storage, in the United States. One step can run on Supabase's servers in a region nearer to you: the one that passes Apple's one-time code on to Apple when you sign in with Apple. Nothing is stored there; the token it receives is kept in the database in the United States.
- Supabase also sends the sign-in codes to your email address, and receives the address for that.
- Apple provides Sign in with Apple and the map. Apple receives map requests from your device under its own privacy policy. If you sign in with Apple, our servers send Apple the one-time code from your phone, and when you delete your account they send Apple the token with the request to end the connection. From that request Apple learns that Pingsterz is no longer to be connected to your Apple Account. If you turn on Friends nearby, Apple's push service delivers the alerts, and receives your phone's push token and each alert's text for that.
- TypeSafe checks each photo, together with its caption, before others see it, as described above.
- Apple takes the payment for Pingsterz+ and sends us its signed record of the subscription, described above. Apple handles your payment details under its own privacy policy; we never see them.
Supabase and TypeSafe handle your data on our behalf and only for the purposes named here. We require them to protect it at least as well as this policy does.
We share data with authorities only when the law requires it.
Your choices and rights
- Remove a ping: open it and choose Remove my ping.
- Delete your account: Settings → Delete account. If you have not chosen a username yet, the same button is on the screen that asks for one.
- Take back the permission for photo checks: Settings → Allow photo checks.
- Turn off location for Pingsterz in your phone's Settings at any time. You can still browse the map; you cannot ping.
- Ask for a copy of your data, or a correction, by writing to mister-business-enterprises@agentmail.to. Depending on where you live you may have further rights, including to object and to complain to a data protection authority.
Age
Pingsterz is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone younger; if you believe someone under 18 is using Pingsterz, write to mister-business-enterprises@agentmail.to and we will remove the account.
Security
Data travels encrypted (HTTPS). Access to stored data is limited per account by database rules, and your session is kept in your phone's Keychain. No system is perfectly secure; a ping is public by design, so do not ping from a place you want to keep private.
Changes
The date at the top of this page says when this policy last changed. If it changes in a way that matters, we will publish the new version on this page before the change takes effect. The app links to this page from its first screen and from Settings.
Contact
Mister Business Enterprises, mister-business-enterprises@agentmail.to.