Privacy Policy

Last updated: September 2026

Who controls your data

PinUs is self-hosted: everything below is stored on the server this specific site runs on, controlled by whoever operates it — not sent to any third party or to the developers of the PinUs software itself. This policy covers both the website and the Android app; where their data practices differ (background location is the main case), that's called out specifically below.

What's stored

• Account info — your name, email address, and a securely hashed password (never the password itself).
• Location — kept as history and shown to your circle's other members. On the web dashboard, this is only while the tab is open — closing it or turning off location access stops sharing immediately. The Android app is different: once you turn sharing on, it continues to report your location in the background — including when the app is closed or your phone is locked — for as long as sharing stays on, not just while the app is in front of you. See "Background location (Android app)" below for what this specifically involves.
• Circles — which circles you're in, and your role in each.
• Places & alerts — any saved places you or your circle create, and a log of arrivals/departures at them (kept for 7 days, then deleted automatically). A place can be marked "for circle" (visible to everyone in it) or "for me only" — a personal place's pin, name, and alerts are visible only to the member who created it, never to the rest of the circle.
• Chat messages — text sent in a circle's chat (kept for 7 days, then deleted automatically).
• Profile photo — if you upload one, a resized copy is stored on the server.
• Preferences — your pin color, status message, and whether you've chosen to appear invisible on the map.
• Basic visit analytics — which page was viewed and an approximate country, used only in aggregate for the site operator to see where visits are coming from. Your IP address itself is never stored — only a one-way hash of it, kept solely so a repeat visit from the same address doesn't trigger a repeat lookup. Resolving the country involves sending the IP address to a third-party lookup service (ipapi.co); see "Third-party services" below.
• Location share links — if you create one (Account settings → Security → "Share my location"), anyone with that link can see your live location for as long as it's active, with no PinUs account or circle membership required. The link itself is a long, unguessable code, not tied to anything else about your account — whoever has it sees your name, pin color, and location, nothing more. You can stop a share at any time, and it also expires automatically.

Who can see it

Only members of the same circle can see each other's location, chat, and activity. Location and other circle data are never shared across circles or shown to anyone outside them. Whoever operates this server can technically access the underlying database, same as any self-hosted software.

Background location (Android app)

The Android app requests "Allow all the time" location access, not just "while using the app." This is what lets your circle see you're safe without you having to keep the app open — the whole point of PinUs is that it works in the background, the same way it would if someone just texted "I'm home" without having to think about it.

• What's collected: your device's GPS coordinates, reported periodically, the same data described in "Location" above — nothing additional is collected because it's happening in the background.
• When: continuously while location sharing is turned on, including when the app isn't open on screen or your phone is locked. It stops the moment you turn sharing off.
• Why: so arrival/departure alerts, live map positions, and SOS all work without requiring the app to be actively open at that moment — the scenarios where this matters most (a child arriving home from school, an emergency) are exactly the moments someone isn't necessarily staring at their phone.
• Who sees it: the same people as any other location data above — only members of your circle(s). Background collection doesn't change who has access, only when the data is captured.
• Turning it off: from the dashboard at any time (the same location-sharing toggle used on the web), or by revoking location permission for the app in your device's Settings. The app is shown an in-app explanation of this before Android's own permission prompt ever appears, so this isn't something requested silently.

Third-party services

PinUs is self-hosted and doesn't rely on third-party services for its core features, with a few exceptions: map tiles and transit-stop data come from OpenStreetMap-affiliated services, weather shown on a member's map popup comes from Open-Meteo (their coordinates are sent to look up current conditions), rain accuracy for Singapore locations is checked against Singapore's National Environment Agency (their coordinates are sent to find the nearest rain gauge reading), and the approximate-country analytics above briefly send a visitor's IP address to ipapi.co to resolve it to a country name. No other data — names, messages, account details — is ever sent to these or any other third party.

Cookies

A single session cookie keeps you logged in. It's not used for advertising or tracking across other sites.

Deleting your data

You can permanently delete your own account at any time — Account settings → Security → "Delete my account" (password confirmation required). This removes your location history, messages, and circle memberships. If a circle you're in relies on you being its only owner, ownership passes to another member automatically rather than deleting the circle out from under everyone else in it — the circle itself is only removed if you were its last remaining member. Merchant accounts can delete themselves and their listings the same way, from their own dashboard. If you'd rather have the site operator do this for you instead, see Contact Us.

Changes to this policy

The operator may update this policy as the software or their practices change.