Privacy Policy

1. Who We Are

Pinfall (“we,” “us,” or “our”) is the operator of the Pinfall mobile application (the “App”) and the website located at pinfall.app (the “Site”). Together, the App and Site are referred to as the “Service.”

If you have questions about this Privacy Policy, please contact us at [email protected].

2. Data We Collect

We collect the absolute minimum data necessary to operate the Service:

3. Data We Do NOT Collect

4. Location Data & Fuzzing

1. You initiate: You tap the "+" button and choose to use your current location or pick a point on the map.
2. Your device shares coordinates: Your device's GPS sends a coordinate to our servers over an encrypted HTTPS connection.
3. We apply fuzzing (if current location is used): Our server applies a random offset of 50–150 meters to your GPS coordinate. The true coordinate is held in memory only for the duration of this operation.
4. Only the fuzzed coordinate is stored: We write the shifted coordinate to our database. The original coordinate is never written to disk, logs, or any storage medium.
5. Map pick mode: If you manually tap a location on the map, you are choosing a point deliberately and no fuzzing is applied.

We request the "While Using App" location permission on iOS and the "Precise Location" permission on Android. We do not request background location access.

5. Anonymous Device Identifier

To allow you to delete your own pins, the App generates a random UUID on first launch. This UUID is:

• Stored only on your device (in secure local storage).
• Transmitted to our servers only when you perform actions — as a salted, one-way SHA-256 hash. We cannot reverse it to identify you.
• Not linked to your device's IDFA, GAID, or any platform identifier.
• Not shared with any third party.

Reinstalling the App generates a new UUID. You will lose the ability to delete pins associated with the old UUID.

6. Content Moderation

• Layer 1 — Rule-based filter: Character limits, spam detection, URL/phone-number extraction, explicit keyword matching.
• Layer 2 — OpenAI Moderation API: Detects hate speech, harassment, violent content, sexual content, and self-harm signals.
• Layer 3 — Context-aware language model: A secondary AI model handles Turkish slang, indirect insults, and culturally sensitive expressions.

The text of your note is sent to OpenAI's API for moderation. OpenAI processes this content under its own Privacy Policy. Moderation requests are not used to train OpenAI's models.

Emergency content: If our system detects keywords associated with self-harm or harm to others, the note is suppressed and crisis resources are shown to you (Turkey: 182; international: Crisis Text Line — text HOME to 741741). No log of this interaction is created.

7. Analytics & Crash Reporting

• All analytics are aggregated; no event is tied to an individual user or device.
• Crash reports contain stack traces and device OS/version. They contain no user content or identifiers.
• We do not use Google Analytics, Facebook Pixel, or any advertising attribution SDK.

8. Data Sharing

We do not sell, rent, or trade your data. We share limited data only in the following circumstances:

All third-party providers are bound by data processing agreements (DPAs) consistent with GDPR requirements.

9. Data Retention

• Pins and content: Retained until you delete them. You can delete your own pins at any time via the App.
• Anonymous device ID hash: Retained as long as you have active pins. Deleted when all your pins are removed.
• Technical error logs: Automatically purged after 30 days.
• Aggregated analytics: Retained indefinitely in anonymized, aggregated form.

10. Children's Privacy

Pinfall is intended for users aged 17 and older. We do not knowingly collect any data from children under the age of 13 (or 16 in the European Union). If you believe a child has posted content on the Service, please contact us at [email protected] and we will remove it promptly.

11. Your Rights

Depending on your jurisdiction, you may have the following rights:

To exercise any right, email us at [email protected]. We will respond within 30 days.

12. Security

• All data in transit is encrypted using TLS 1.2+.
• Data at rest is encrypted using AES-256.
• Production databases are not accessible from the public internet.
• Internal access to production data requires multi-factor authentication.
• We conduct periodic security reviews of our infrastructure.

If you discover a security vulnerability, please disclose it responsibly to [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, for material changes, notify you via an in-app notice. Your continued use of the Service after the effective date constitutes your acceptance of the changes.

14. Contact Us