Privacy Policy
Pinglet · Last updated 28 July 2026
Pinglet sends a contentless notification — a “ping” — to someone you’ve saved. There is no message to read, so there is very little to collect. This policy describes exactly what is stored, where, and what we cannot see.
Who we are
Pinglet is operated by Starl3xx Labs LLC. For anything in this policy — including a question about your data, or a request to delete it — write to help@getpinglet.app.
What we collect
| Data | Why | Kept |
|---|---|---|
| Phone number | It is your account. Verified by SMS code so nobody can sign up as you. | Until you delete your account |
| Display name | Shown to people you ping, so they know who it’s from. | Until you delete your account |
| Notification token | Required to deliver a ping to your device. | Replaced on reinstall; cleared on sign-out |
| Time zone and quiet hours | So a ping arrives silently during hours you chose, in your own time zone. | Only if you set quiet hours |
| Notification sound choice | To play the sound you picked. | Until changed |
| Your Pinglet contacts | Each contact’s name and phone number, so pings can be addressed and the list can be shown. | Until you remove them |
| Ping records | Sender, recipient and time. Needed to deliver the ping and to show your history. A ping you schedule for later is stored the same way until its moment arrives. | Until you delete your account |
| People you’ve blocked or silenced | Held on your own profile so the server can stop their pings reaching you, or deliver them without a sound. The other person is never told. | Until you unblock them |
| Subscription status | To unlock Pinglet Pro. Paired with a random identifier we generate — never your Apple ID. | While subscribed |
Diagnostic logs
Delivering a ping writes a line to our server logs recording what happened to it — delivered, refused by the rate limit, or not sent because you had blocked the sender — along with the ping’s identifier and the sender’s. Since July 2026 that line also records which surface the ping was sent from: the app, a widget, the Lock Screen, Control Center, Siri, or a scheduled send.
That last detail exists so a button that silently fails can be diagnosed at all, and it is deliberately never stored on the ping itself — it is written into the log and deleted from the record in the same operation, so the person receiving a ping never learns how you sent it. Logs are retained for a limited period by our hosting provider and are used for operating the service, not for analytics or profiling.
A ping has no content
A ping carries no text, image, or audio. The record of a ping is therefore its metadata — who sent it, to whom, and when — because that is the message. We want to be plain about this rather than imply more secrecy than exists: our servers necessarily see that you pinged someone, and when, in order to deliver it.
What we cannot see
- What a ping means. The note you write against a contact (“Ping = I’m home”) is encrypted on your device with a key held in your iCloud Keychain. It reaches your own devices and nothing else. We store only ciphertext and cannot read it.
- Your contact photos. Photos and emoji you set for a contact are stored on your device only. They are never uploaded.
- Your address book. Pinglet never requests access to your contacts. When you choose someone from your phone’s contacts, iOS shows its own picker and hands back only the single person you selected. The rest of your address book is never seen by the app.
How people find you
So a friend can tell whether you’ve joined, your phone number is listed in a lookup index as a SHA-256 hash rather than as the number itself. This means a copy of that index is not a readable directory of phone numbers.
We would rather state the limit than overstate the protection: phone numbers occupy a small enough range that a determined party could compute hashes for many of them. This measure raises the cost of a bulk disclosure; it does not make the index private.
If you added someone before they joined, we tell you when they do, so you know you can reach them. This looks only at contacts you added yourself — the check runs against the numbers already saved in your Pinglet contacts, never against your phone’s address book. The people told are the ones who already had your number and could already ping you the moment you joined. You can turn these off in Settings under Notifications.
Who we share with
We do not sell personal data, and we do not share it for advertising. Data is processed by:
- Google Firebase — authentication, database, notification delivery and server functions. Data is stored in the United States.
- Apple — the Apple Push Notification service delivers pings, and the App Store handles subscriptions. We never receive your payment details.
Pinglet contains no analytics, advertising, attribution or tracking software.
Your choices and rights
- Delete your account. In the app, go to Settings → Advanced → Delete Account. This erases your profile, contacts, groups, ping history and directory entry immediately and permanently — including pings you sent, which are removed from other people’s history too. Nothing is retained, so we cannot restore it afterwards. You can also write to help@getpinglet.app.
- Notifications. Pings need notification permission. You can withdraw it at any time in iOS Settings; Pinglet then cannot reach you.
- Quiet hours. You can silence pings during hours you choose, without the sender knowing.
- Access and correction. Your name, quiet hours and contacts are editable in the app. For anything else, write to us.
If you are in the EEA or UK, our lawful basis is performance of the contract for the parts required to run the service, and legitimate interests for keeping it secure. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA.
Children
Pinglet is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
Security
Traffic is encrypted in transit. Access to your profile and contacts is restricted by server-side rules so that only your signed-in account can read them. Notes are additionally encrypted on your device as described above. No system is perfectly secure, and we do not claim otherwise.
Changes
If this policy changes materially we will update the date above and, where the change affects how your data is used, tell you in the app before it takes effect.