Privacy Policy

Last updated: October 7, 2026

Pinnit (“Pinnit,” “we,” “us,” or “our”) provides a personal map app and related website where you can save places, share links from Notes, TikTok, or Instagram, and explore pins with friends. This Privacy Policy describes how we collect, use, share, and delete personal information through the Pinnit website, waitlist, and mobile application (together, the “Service”).

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

Information we collect

Information you provide

• Account data — email address, password (stored in hashed form by our auth provider), display name, and any phone number you use for one-time passcodes.
• Places and content — places you pin (names, addresses, coordinates, categories, notes), Notes text you import, and links you share (for example TikTok or Instagram URLs) so we can extract locations.
• Friends and sharing — friend connections, invites, shared map lists, and session membership when you use those features.
• Communications — messages you send us (including waitlist signup and support email).

Information from your device (with permission)

• Precise location — when you allow location access, we use it to center the map, point at nearby places, and support live sessions. You can revoke access in iOS Settings.
• Trusted-device signals — if you choose to trust a device, we store a device identifier and related metadata so we can recognize that phone on later sign-ins.
• Biometrics — Face ID / Touch ID never leave your device. We only store a local Keychain credential so the app can unlock on that phone.

Information collected automatically

• Technical and security data — authentication tokens and coarse request metadata needed to operate the Service and prevent abuse (for example rate limiting).
• Website usage — standard server or hosting logs when you visit our marketing site (such as IP address and pages requested), as provided by our hosting provider.

Information from third parties

• Map and place providers — place names, addresses, and coordinates returned when we look up a venue (for example Google Places or OpenStreetMap-based services).
• Official embed APIs — when you share a TikTok or Instagram link, we may request public caption/metadata from TikTok’s or Meta’s oEmbed endpoints using the URL you provide.
• Sign-in providers — if you use Apple or other supported sign-in options, we receive the account identifiers those providers share with us.

How we use information

• Provide, operate, and improve the Service (maps, pins, friends, sessions).
• Extract and geocode places from content you submit (Notes, captions, links).
• Authenticate you, send one-time codes, and secure accounts.
• Communicate about the Service, waitlist, and support requests.
• Detect, prevent, and investigate fraud, abuse, or security incidents.
• Comply with law and enforce our terms.

We do not sell your personal information. We do not use your content to train public AI models that we operate.

How we share information

• Service providers — vendors that host our backend (Convex), send email codes, provide AI text analysis (OpenAI), and resolve place lookups. They may process data only to provide services to us.
• People you choose — friends, session members, and recipients of shared lists see the information you include.
• Platforms you open — if you tap through to Apple Maps, Instagram, TikTok, or similar apps/sites, those products’ policies apply.
• Legal and safety — when required by law, to protect Pinnit or others, or in connection with a merger, financing, or sale, with appropriate safeguards.
• Apple — App Store purchases (if offered) are processed by Apple under Apple’s policies. Apple is not responsible for Pinnit’s handling of your account data.

AI and automated processing

We use automated systems, including third-party AI providers, to read text you submit (such as a Notes list or a social caption returned by an embed API), suggest place categories, and help match venues. Those providers process the content you submit for that purpose under our agreements with them. Results can be wrong; always use your own judgment.

Retention

We keep account and place data while your account is active. Waitlist and support emails are kept as needed to communicate with you. Technical logs are retained for a limited period for security and operations. After a verified deletion request, we delete or de-identify personal information as described below, unless we must retain it for legal, security, or dispute-resolution reasons.

Data deletion instructions

To request deletion of your Pinnit account and associated personal data:

1. Email hello@pinnitmap.com from the email address on your Pinnit account.
2. Use the subject line Data Deletion Request and include the account email (and display name, if helpful).
3. We will verify that the request comes from the account owner, then delete or de-identify personal information associated with the account, including saved places, friend connections, session/presence data, trusted-device records, and related account content we control.
4. We aim to complete verified requests within 30 days. We may retain limited records when required by law, to resolve disputes, or to prevent abuse (for example, fraud-prevention logs).
5. You will receive email confirmation when the deletion is complete (or if we need more information to verify your request).

You can also remove individual places in the app at any time. Signing out does not delete your account; use the email process above for full deletion.

Your choices and rights

• Update your display name in the app settings.
• Control location, Face ID, and related permissions in iOS Settings.
• Remove places or shared content you control in the app.
• Request access, correction, or deletion by emailing hello@pinnitmap.com.

Depending on where you live (for example under California’s CCPA/CPRA or similar U.S. state laws), you may have rights to know, delete, correct, or opt out of certain sharing of personal information. We do not sell personal information. To exercise rights, email hello@pinnitmap.com. We will not discriminate against you for exercising privacy rights.

Security

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children

Pinnit is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account, contact us and we will delete it.

Changes

We may update this Privacy Policy. The “Last updated” date will change when we do. Continued use of the Service after an update means you accept the revised policy. If you do not agree, stop using the Service and request deletion of your account.

Contact

Privacy questions and data requests: hello@pinnitmap.com

Adapted for Pinnit from attorney-drafted templates released byGeneral Legal under CC0 1.0. This page is informational and not legal advice.