Privacy Policy
Last updated: 26 July 2026
Draft — review before launch. This is a starting point, not legal advice. Every highlighted note below marks something only you can answer. Apple reviews this page during App Store submission and your App Privacy answers must match what it says. Delete this box and all the highlighted notes once the text is final.
1. Who we are
PinkyPact (“PinkyPact”, “we”, “us”) provides the PinkyPact mobile app and the website at pinkypact.app. This policy explains what personal data we collect, why we collect it, and what you can do about it.
Add your legal entity name, registered address and — if you have users in the EU/UK — the data controller contact. A sole trader can use their own name and address.
2. What we collect
Information you give us
- Account details. Your email address, display name, and — if you sign in with Apple or Google — the identifier that provider returns to us.
- Your pact. The other person you pair with, and the promises you exchange: their text, deadlines, status, and who approved them.
- Messages to us. Anything you send through the waitlist, feedback or feature-request forms on this website, or by email.
Information collected automatically
- Device and diagnostic data. Device model, operating system version, app version, and crash reports, so we can fix what breaks.
- Push notification tokens, so we can send the reminders you have asked for.
- Basic request data when you visit this website: IP address, user agent and approximate country, handled by our hosting provider.
If you use an analytics SDK (Firebase Analytics, PostHog, Amplitude…), name it here and say what it records. If you do not use one, say so plainly — it is a selling point.
3. Why we use it
- To run the service: creating your account, pairing you with your partner, and delivering promises and reminders between you.
- To send transactional messages such as reminders, approvals and account notices.
- To answer you when you write to us.
- To keep the service secure and to diagnose faults.
- To tell you when the app launches, if you joined the waitlist. You can unsubscribe at any time using the link in any such email.
If you are subject to the GDPR, state your lawful basis for each purpose — typically contract for the first three, legitimate interests for security, and consent for the waitlist email.
4. What your partner can see
PinkyPact is built for two people. The person you pair with can see the promises between you, their deadlines and status, whether you marked something done, and your display name. Do not put anything in a promise that you would not want them to read.
5. Who we share it with
We do not sell your personal data, and we do not share it for advertising. We use a small number of service providers who process data on our behalf:
- Google Firebase (Google Ireland Limited / Google LLC) — authentication, database, push notifications and crash reporting.
- Cloudflare, Inc. — hosting and delivery of this website, and processing of the forms on it.
- Apple — app distribution and, if you use it, Sign in with Apple.
We may also disclose data where the law requires it, or to establish or defend legal claims.
List any other processor you add later — an email sender, a support desk, a payment provider for PinkyPact Plus. Note that Firebase and Cloudflare may process data outside your country; if you are in the EU/UK, mention the transfer safeguards you rely on (standard contractual clauses).
6. How long we keep it
We keep your account data for as long as your account exists. When you delete your account we remove your personal data within 30 days, except where we must keep records to comply with the law. Promises you exchanged may remain visible to your partner in their own copy of the pact.
Waitlist emails are kept until launch, or until you ask us to remove them.
Confirm these periods match what your Firestore rules and deletion job actually do — do not promise a 30-day deletion you have not built.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it. You can delete your account from inside the app, and you can turn off push notifications in your device settings at any time. Write to [email protected] and we will respond within 30 days.
If you are in the EEA or UK and you think we have handled your data badly, you can complain to your local data protection authority.
If you have California users, add the CCPA/CPRA notices: categories of personal information collected, the right to opt out of “sharing”, and a non-discrimination statement.
8. Children
PinkyPact is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
Check this against the age rating you chose in App Store Connect, and against the UK Age Appropriate Design Code if you have UK users.
9. Security
Data is encrypted in transit, and at rest by our hosting providers. Access to production data is limited to the people who need it to run the service. No system is perfectly secure, but we take this seriously and will tell you promptly if something goes wrong.
10. Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change matters to you, tell you in the app or by email.
11. Contact
Questions about any of this: [email protected].