Privacy Policy
Last updated: 21 August 2026
PinkyPact (“the app”, “we”, “us”) is a two-person accountability app that lets you and one partner set shared tasks and remind each other to finish them. This policy explains what data we collect, why, who we share it with, and how you can delete it. It covers both the app and our website at pinkypact.app. We keep this deliberately short because we collect very little.
Who we are
PinkyPact is operated by Tóth Tamás, Iglic utca 2/1, 2142 Nagytarcsa, Hungary, who is the data controller for the personal data described in this policy. You can reach us at [email protected].
The app
The app does not collect your real name, email address, phone number, contacts, precise (GPS) location, photos, or payment information. There are no ads and no cross-app or cross-site tracking. The app does not show an “Ask App Not to Track” prompt because it does not track you.
If you buy PinkyPact Plus, the purchase is made through Apple. Apple handles the payment, and we never see your card details or your Apple Account.
What we collect
| Data | What it is | Why |
|---|---|---|
| Display name | A name you choose (can be a nickname) | Shown to your paired partner |
| Tasks & history | The chore/task text and its status you and your partner create | The core function of the app |
| Comments | The free-text notes you write when you decline, reject, or complete a task | Shown to your partner, so they know why |
| Device push token | An anonymous push token (via Expo) from your OS, plus an identifier for the device it belongs to | To send task reminders and partner notifications to the right device |
| Notification status | Whether you have push notifications switched on | Shown to your partner, so they know whether you will see a reminder |
| Pairing codes | Short codes used to link two devices | To connect you with your partner |
| Device timezone | Your device’s timezone (e.g. Europe/Budapest) | To show reminder times in your local time |
| Approximate location | Your country/region, worked out by PostHog from the IP address your analytics events arrive from. The app requests no location permission and reads no location from your device. | To understand roughly where the app is used |
| Subscription status | Whether a PinkyPact Plus subscription is active, which product it is, and when it expires, keyed to your anonymous user ID | To unlock the higher promise limit for you and your partner |
| Pseudonymous analytics | Product-usage events (screens viewed, features used) keyed to a random app-generated user ID, along with technical detail such as your app version, your platform, the IP address the events were sent from, and the random identifiers of the task and pair involved. These events carry no text you have written. | To understand which features are used and fix problems |
We do not ask for or store any account identifier that reveals who you are. Your “account” is an anonymous identifier generated on your device; it is not tied to your Apple ID, email, or any personal login.
Reporting a promise
If you report one of your partner’s promises as abusive, we store a copy of that promise’s text together with the report and the random identifiers of the task, the pair, and you as the reporter. We keep that copy even if the promise is later edited or deleted, and even if the account it came from is deleted — otherwise a report could be erased by the person it is about. We keep it only for as long as we need it to act on the report and to recognise repeat abuse.
The website (pinkypact.app)
Our website collects nothing. It sets no cookies, runs no analytics or tracking scripts, and has no forms, sign-ups or accounts. There is nothing on it to fill in, so you can read every page without giving us anything at all.
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address and request data for as long as it takes to serve you the page. We do not receive, store, or have access to that.
If you email us at [email protected] we will of course have your email address, because you sent it to us. We use it to answer you and nothing else.
Who we share it with (third parties)
- Google Firebase (Authentication, Cloud Firestore, Cloud Functions, App Check) — stores your display name, tasks, pairing data, and push token so the app works across your and your partner’s devices. See Google’s privacy policy at firebase.google.com/support/privacy
- Expo (push notifications) — we send push notifications through Expo’s push service, which relays them to Apple. Expo processes your device push token and the notification text (which can include your partner’s display name and the promise text) solely to deliver the notification. See expo.dev/privacy
- PostHog (EU region) — receives pseudonymous product-analytics events from the app, keyed to a random user ID. Data is processed on PostHog’s European servers. The app records no video or screen recordings of your session. Because these events are keyed to a random identifier and contain no name or email, they are pseudonymous. PostHog also derives an approximate location (your country/region) from the IP address of these requests, so we can see roughly where the app is used. This is not precise location and is not shared with anyone else. The IP address itself is stored by PostHog alongside these events. See posthog.com/privacy
- RevenueCat — used only if you buy PinkyPact Plus. It receives your anonymous user ID and the purchase details Apple reports (which product, whether it is active, when it renews or expires) so we can unlock the paid limit. It does not receive your name, email, tasks, or card details. See revenuecat.com/privacy
- Apple — processes the payment itself, as the seller of in-app purchases. We never receive your payment details. See Apple’s privacy policy at apple.com/legal/privacy
- Cloudflare, Inc. — hosts pinkypact.app, and processes your IP address and request data in order to serve you the page. See cloudflare.com/privacypolicy
We do not sell your data or share it with advertisers.
Legal basis and your rights (GDPR / EEA users)
Because analytics are processed in the EU, EU/EEA data-protection rules apply. Our legal bases for processing are:
- Performance of a contract — running the app for you: your display name, tasks, pairing data, push token, and, if you buy PinkyPact Plus, your subscription status.
- Legitimate interests — operating and improving the app (pseudonymous analytics), acting on reports of abusive content, answering you when you write to us, and protecting the app from spam and abuse.
You have the right to access your data, correct it, delete it, receive a copy of it in a portable format, object to processing based on our legitimate interests, and withdraw any consent you have given. If you are in the EEA or the UK and you believe we have mishandled your data, you can also complain to your local data protection authority.
How to delete your app data: open the app, go to Settings → Delete account. This permanently removes your account and all associated data — your display name, tasks, history, pairing, and push token. If you are paired, your partner’s copy of the shared tasks and history is removed too. This cannot be undone. The one exception is a copy of any promise that has been reported to us as abusive — see “Reporting a promise” above.
Anything else: email [email protected] and we will answer within 30 days.
Data retention
- Your display name, tasks, pairing data, and push token are kept until you delete your account (or end pairing, which removes the shared pair data).
- Pseudonymous analytics events, including the IP address they were sent from, are retained for up to 12 months. They are keyed to a random identifier rather than to your name or email.
- Content reports, and the copy of the reported promise they contain, are kept for as long as we need them to act on the report and to recognise repeat abuse.
- Emails you send us are kept while we need them to answer you, and deleted when we no longer do.
- Subscription status is kept while your account exists and is deleted with it. Deleting your PinkyPact account does not cancel your Apple subscription; cancel that in iPhone Settings → your name → Subscriptions.
Children
PinkyPact is not directed at children under 13 and we do not knowingly collect data from them.
Changes to this policy
If we change what we collect, we will update this page and the “Last updated” date above.
Contact
Questions about privacy or a data request: [email protected]