Pinfolk is an iPhone app for walking to real public places. You collect a stamp for each place you reach, and you can leave short stories (“pins”) for other walkers. This policy explains what Pinfolk collects, why, who can see it, how long we keep it, and how you can delete it.
“Pinfolk”, “we” and “us” mean Olivia Beauty LLC. Pinfolk is offered in the United States, to people 13 and older.
The short version
- We collect what the app needs to work: your Sign in with Apple identifier and display name, your walks, the places you collect, what you write, and your settings.
- Pinfolk uses your location only when you allow it: to show pins near you, and during a walk you start, including while your screen is locked, until you tap End.
- Other walkers never see your route, your start point or where you are now. Pinfolk has no live map of walkers. Each pin’s public point value does show roughly how far you walked before you left it (section 1).
- There are no ads. We don’t track you across other companies’ apps or websites. Pinfolk has no third-party analytics, advertising or crash-reporting tools, and we don’t sell your personal information.
- You can delete your account in the app at any time. Section 6 says exactly what is deleted, what is kept and for how long.
1. What we collect
Your account
- Sign in with Apple. Apple gives us an identifier that is unique to your Apple ID and Pinfolk. We never ask Apple for your email address. Your account also gets an internal ID.
- Your name. If you share your name on Apple’s sign-in sheet, it becomes your public display name. If you don’t, your name is “Walker”. You can change it at any time. You also get a handle (for example “w1a2b3c4d5e6”) that other walkers can see.
- Profile and settings: your bio, the avatar you pick, whether you allow messages, and whether you show your finds in the community.
- Terms acceptance: which version of the Terms you accepted, and when.
- Sign-in sessions: each one lasts up to 30 days.
Your location
Pinfolk asks for location “While Using the App” only. It never asks for “Always”.
- Finding pins near you. When location is on, the app sends your position, rounded to three decimal places (roughly 100 meters), to find pins near you. The community feed sends a position rounded to about 1 kilometer. Our server uses these only to answer that request. It does not save them or write them to its logs.
- During a walk. From when you tap Start until you tap End or pause the walk, the app records your precise location, including while your phone is locked. iOS shows a location indicator while this happens. Each reading has a latitude, a longitude, an accuracy and a time. Readings are sent to our server and stored encrypted. We use them to check how far you walked, how long you were moving, and whether you arrived at a place. A reading that can’t be sent right away waits on your phone, in an encrypted file, until it can.
- Where you leave a pin. When you drop a pin, we store the exact spot, encrypted, so a moderator can match it to a reviewed public place. A published pin shows that public place, never your exact spot.
- The places you collect. When you arrive at a place, we record which place, when, on which walk, and on which local day. Together these are a history of the public places you have visited.
Your walks
For each walk we keep whether you chose Walking or Assisted movement (see below), when it started and ended, the distance we verified, and your active time. We also record the days you walked enough to count toward a crew challenge. Your points, Exploration XP and level come from the stories you collect on your walks.
Walking or Assisted movement
When you start a walk, you choose Walking or Assisted movement. Anyone can choose either one, and Pinfolk never asks why. The choice changes the rules we use to check the walk, such as the shortest distance and the highest speed we count. We keep the choice with each walk until you delete your account. Because it could say something about how you get around, we treat it as sensitive: we use it only to check your walks and count your walking days, and we never show it to other walkers.
What you create
- Pins: a title, a short preview and a story.
- A pin’s point value. Every pin has a point value that anyone who sees the pin can see, signed in or not: 5 points for each full quarter mile of verified walking before you left it, up to 60 points (3 miles). The distance is counted from the start of the walk, or from your previous pin on the same walk. So the point value of a walk’s first pin gives a rough idea of how far from that place you started. If you choose, the pin also shows that distance rounded to the nearest quarter mile (for example “Left after a ~1.5 mi walk”), with no 3-mile cap. That choice adds only this line; the point value is shown either way.
- Collections you name, crews you create (name and description), crew challenges (title and dates) and crew goals.
- Messages you send, up to 1,000 characters each.
- Thanks (“Worth the walk”), follows, blocks and crew memberships.
- Share links. When you share a pin, we create a link and record which pin it is for and that you created it.
- Your collection: the stamps you earn, each place stamp’s stage and design, set charms, points and Exploration XP.
- Photos. Pinfolk 1.0 has no photo upload. Share cards are made on your phone and leave it only through the share sheet you choose. If you tap Save Image, iOS asks for add-only access to your photo library. Pinfolk never reads your library.
Reports
When you report a pin, a walker or a message, we keep what you reported, the reason you give, and when.
What we don’t collect
- We don’t ask for your email address, phone number, your phone’s contacts or address book, photos, camera, microphone, advertising identifier or device identifier. Pinfolk doesn’t read Apple Health or your phone’s motion and step data. Pinfolk doesn’t send push notifications.
- The walkers you follow and the walkers who follow you are what Apple’s App Store privacy label calls “Contacts”, so our label lists Contacts. Pinfolk never reads your phone’s contacts.
- Pinfolk 1.0 is free and sells nothing, so we collect no payment information.
- The “Search places” box only filters the list already on your phone. What you type is never sent.
- Pinfolk has no crash-reporting, analytics or advertising tools, from us or anyone else.
- Our server’s logs record the kind of request, its result and how long it took. They don’t contain your IP address, account ID, name, location or anything you write. When the word filter refuses some text, the log notes which field, with a coded reference in place of your account ID. When an account deletion needs attention or a retry, the log notes that deletion request’s reference number.
- To limit abuse, our server counts your requests over the last minute using a scrambled (salted hash) form of your IP address, held only in memory. It is never written to disk. It is dropped from memory when the server next tidies its counters after a minute without requests from you, or when the server restarts.
- Our hosting provider, DigitalOcean, may keep its own technical logs of requests to our service.
2. How we use your information
We use your information only to run Pinfolk:
- to sign you in and keep your account working;
- to verify walks and arrivals, award stamps and points, and stop cheating;
- to show pins, profiles, crews, messages and the community feed as described in section 3;
- to review pins before they are published, handle reports and keep the community safe;
- to answer support requests;
- to keep the service secure and running.
We don’t use your information for advertising, and we don’t build profiles of you for anyone else.
3. Who can see what
| Who | What they can see |
|---|---|
| Anyone, without signing in | Published pins: title, preview, point value, the author’s display name, handle and avatar, the public place, anonymous counts such as how many walkers collected or thanked the pin, and the “~X mi” walked-distance line if the author chose to show it. A shared-pin web page shows the pin’s title and preview, the author’s display name, and the place’s name and town. It has no story, route, start point or time, and it uses no cookies or scripts. |
| Signed-in walkers | Your profile: display name, handle, bio, avatar, level, published pins, and how many crews you share with them. The full story of a pin, once they have collected it at its place. |
| Signed-in walkers, if you turn on “Show my finds in the community” | Your name next to places and stories you collected, and the set charms you earn. These appear 24 to 48 hours later, with a rough time such as “this week”, and only for finds after you turned the setting on. It is off until you turn it on in Settings. |
| Members of a crew you join | Your name, avatar and walking days in the crew’s challenges. Your finds show in the crew only if “Show my finds in the community” is on. |
| Anyone who has a link you shared, signed in or not | Your display name, as the walker who shared it. The Pinfolk app shows it when the link is opened there. |
| Other walkers who message you | Messages work only between walkers who follow each other and have both turned on “Allow mutual followers to message me”. |
| Pinfolk moderators | Walkers’ display names, handles and bios. Pins in every state (waiting for review, published, hidden or rejected), with the full story, the time the pin was left (to the minute) and whether its walk is still open. For a pin waiting for review, how many meters each nearby reviewed public place is from the exact spot where the pin was left. Reported content (including a reported message), and the reporter’s handle and account ID. The moderation tools don’t show routes, start points, walk location readings or the coordinates of a pin’s exact spot. |
Even when “Show my finds in the community” is off, your finds count toward anonymous totals that never name you, and toward the level on your profile, which other walkers can see. A weekly total (how many walkers found a pin that week) appears only when at least 5 walkers found that pin in the same week.
Other walkers never see your route, your start point, your current location, your Walking or Assisted movement choice, or your Places board with its visit history. With “Show my finds in the community” on, they see only the delayed finds described above. A published pin does show that its author was at that public place, at least a day before the pin appeared, and its point value shows roughly how far they walked before leaving it.
Blocking works both ways: a block hides each person’s pins, profile and messages from the other.
4. Who we share it with
- Other walkers, as described in section 3.
- Our hosting provider, DigitalOcean, which runs our server and database for us.
- Apple, to check your Sign in with Apple sign-in and, when you delete your account, to remove Pinfolk’s access to your Apple ID. Maps in Pinfolk are Apple Maps, and “Directions” opens the Apple Maps app. Apple handles that data under its own privacy policy.
- When the law requires it, or to protect someone’s safety.
We don’t sell your personal information, and we don’t share it for advertising.
5. How long we keep it
| Information | How long we keep it |
|---|---|
| Location readings from a walk | Deleted 7 days after they are recorded. |
| A walk’s start point and last point (encrypted) | Cleared 7 days after you end the walk. A walk you never end keeps them with no time limit, until you end it or delete your account. |
| Walk summaries (Walking or Assisted movement, start and end times, distance, active time) and walking days | Until you delete your account. |
| Places you collected, stamp stages, and the date, walk and local day of each visit | Until you delete your account. |
| Story stamps, points and Exploration XP | Until you delete your account. |
| The exact spot where you dropped a pin (encrypted) | Cleared when the pin is published, 30 days after it is rejected, or when you delete your account. It is kept with no time limit while the pin waits for review, while an approved pin waits because its place already has its public pins or because its author’s account is suspended, after a moderator hides a pin that was never published, and in every other case until one of the events above. |
| Pins you wrote, including ones that were not approved, and their point values | Until you delete your account. You can’t delete a single pin yourself in this version; to ask us to hide one, email support@pinfolk.app. Section 6 says what happens to them when you delete your account. |
| Collections you named, crews you created, crew challenges and crew goals you set | Until you delete your account. Your collections are deleted then. Crews you created keep their name, description, challenges and goals after that (section 6). |
| Profile, settings, follows, blocks, thanks, crew memberships, share links and Terms acceptances | Until you change them or delete your account. |
| Messages | Until the sender or the recipient deletes their account. You can’t delete a single message in this version. |
| Reports and moderation records | While the accounts involved exist. After an account is deleted, see section 6. |
| Sign-in sessions | Up to 30 days. They are deleted when they expire or when you delete your account. |
| Backups and hosting logs | Kept by our hosting provider, DigitalOcean, for the retention periods of its backup and logging services. |
Cleanup runs automatically every hour, so “7 days” means within about an hour after 7 days.
6. Deleting your account
You can delete your account in the app: the You tab, then Settings (the gear), then Delete account…. You confirm it’s you with Sign in with Apple, then confirm once more. Nothing is deleted before that last step. If you’re on a walk, the walk ends and any location readings not yet sent are discarded.
When you confirm, Pinfolk signs you out everywhere and right away deletes most of your personal data. Some records are kept, some of them with no time limit, as listed below. If a step fails, our server keeps retrying automatically until it finishes. If you later sign in with the same Apple ID, you get a new, empty account.
Deleted: your profile (name, bio, avatar and handle), settings, sessions, Terms acceptances, follows, blocks, messages (for both people), thanks, share links, crew memberships, walks and their location data, story stamps, place stamps and visit history, set charms, points, and the collections you named.
Kept without your name:
- Pins you published stay on the map, credited to “A Pinfolk walker”. Their title, preview, story and point value stay, so the point value still shows roughly how far you walked before leaving each one. Your name, your exact spot, the walk they came from and the “~X mi” walked-distance line are removed. Anyone on the other side of one of your blocks still won’t see them.
- Your other pins that other walkers collected are emptied, with no text and no location (only their point value is kept), and are never shown, so those walkers keep their stamps. Your remaining pins are deleted.
- A crew you created passes to its longest-standing remaining member, with its name, description and challenges. A crew goal you set stays with the crew, without your name. If no one else is in the crew, it is deleted.
- A minimal record that the account existed: an internal ID, the name “Deleted walker”, and the dates the account was created and deleted, plus a record of the deletion request and its status.
Kept for 90 days, then deleted: reports you filed; reports about your account, about messages you sent, or about pins of yours that don’t stay public; and, if you were a moderator, records of the moderation actions you took. During those 90 days they are kept against the anonymous internal ID.
Kept with no time limit:
- reports about a pin of yours that stays public (they stay with the pin);
- records of moderation actions about you or your pins, such as a suspension or a review of your pin, with the moderator’s note;
Backups. Copies of deleted data can stay in our hosting provider’s backups until those backups expire.
Apple. Pinfolk also asks Apple to remove Pinfolk’s access to your Apple ID. If the app can’t confirm this, it says so, and you can remove Pinfolk yourself in iOS Settings > your name > Sign-In & Security > Sign in with Apple. So that it can retry, our server keeps an encrypted Apple sign-in token (or a one-time code from Apple) for your deleted account. It is deleted as soon as Apple confirms or the retries stop: within about a day under our default settings. Our server can be set to keep retrying for up to about 7 days.
On the phone you delete from, Pinfolk also clears that account’s saved walk data.
7. Your choices
- Location: change it any time in iOS Settings > Pinfolk > Location. Walks need location. If you turn off Precise Location, your walks may not count, because readings less accurate than about 35 meters don’t count toward distance, and an arrival needs readings accurate to about 25 meters.
- Stop recording: tap End, or pause the walk.
- “Show my finds in the community”: off until you turn it on in Settings.
- Messages: off until you turn on “Allow mutual followers to message me” in Settings.
- Block and report: see section 3 and the Terms of Use. Settings > Blocked walkers lists the walkers you blocked, and lets you unblock them.
- Your profile: change your display name, bio and avatar at any time.
- A copy of your data, or a correction: email support@pinfolk.app. The app has no export feature.
- Delete your account: section 6.
8. Security
All connections between the app and our server use HTTPS. Walk location readings and pin spots are stored encrypted on our server. Our server keeps only a fingerprint (hash) of your sign-in session, and your phone keeps the session in the iOS Keychain. Readings waiting to upload are kept encrypted on your phone. No system is perfectly secure.
9. Children
Pinfolk is not for children under 13. We don’t knowingly collect personal information from children under 13. If you believe a child under 13 is using Pinfolk, contact us at support@pinfolk.app. We will suspend the account, which hides its profile, pins and activity from everyone.
10. Where your information is stored
Pinfolk is offered in the United States. Our server and database are hosted by DigitalOcean. If you use Pinfolk from another country, your information is transferred to and stored in the country where they are hosted.
11. Your rights
Depending on the state where you live, you may have rights to access, correct or delete your personal information, or to object to how it is used. To make a request, email support@pinfolk.app. We won’t treat you differently for making a request.
12. Changes to this policy
When we change this policy, we post the new version on this page.
13. Contact us
Email: support@pinfolk.app
Pinfolk is provided by Olivia Beauty LLC.
Support page: pinfolk.app/support. In the app: the You tab, then Settings (the gear), then Support under About.