Last Updated: October 21, 2025
Effective Date: October 21, 2025
IMPORTANT NOTICE: This Privacy Policy describes how we collect, use, disclose, and protect information in connection with the Ping&Wink mobile application. By accessing or using the Service, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, you must immediately discontinue use of the Service.
This Privacy Policy ("Policy") governs the collection, use, storage, and disclosure of information by the operator of Ping&Wink ("we," "us," "our," "Service," "Application") in connection with your use of the mobile application and related services.
This Policy should be read in conjunction with our Terms of Service, available at https://pingandwink.com/terms.html, which is incorporated herein by reference.
Jurisdictional Note: This Service is operated from France and subject to French and European Union data protection laws, including the General Data Protection Regulation (GDPR). For users outside the European Economic Area, different data protection standards may apply in your jurisdiction.
App Store Privacy Requirements: This Privacy Policy has been prepared in compliance with Apple App Store Review Guidelines, including but not limited to:
This Service collects only data strictly necessary for core functionality: device identifiers for session management, approximate location for proximity-based features, and birth year for age verification. We do not engage in data sale, do not serve third-party advertisements, and implement automatic data deletion to minimize retention.
ADULT-ONLY SERVICE (18+ STRICT REQUIREMENT): This Service is exclusively for individuals who are at least 18 years of age or the age of majority in their jurisdiction, whichever is higher. Users under 18 are strictly prohibited under any circumstances. By accessing this Service, you represent, warrant, and covenant that you meet this age requirement.
Age Verification: During initial setup, the Service requires users to provide their birth year. While we implement this verification mechanism as a technical measure, we make no representations or warranties regarding:
Underage Use Discovery: If we discover or have reason to believe that a user is under 18 years of age, we reserve the right to immediately terminate access and delete associated data. However, we assume no liability for underage users who circumvent age verification or provide false information.
The Service is designed to minimize personal information collection. Information you provide includes:
| Data Type | Purpose | Retention Period |
|---|---|---|
| Birth Year | Age verification and compliance | Until account deletion |
| Emotional State Selection | Display on map, enable connections | 24 hours (automatic deletion) |
| Chat Messages | Enable communication during Spark sessions | 9 minutes maximum (automatic deletion) |
The Service automatically collects certain technical information necessary for functionality:
| Data Type | Purpose | Retention Period |
|---|---|---|
| Device Identifier (UUID) | Anonymous user identification, session management | Until account deletion |
| Location Data | Map display, proximity-based matching | 24 hours (overwritten with new data or deleted) |
| Usage Analytics | Service improvement, feature development | Anonymized aggregated data: indefinite |
| Push Notification Token | Delivery of connection notifications | Until notification opt-out or account deletion |
The following information is not collected or stored by the Service:
We process collected information for the following purposes, based on necessity for service provision and legitimate business interests:
Processing Limitation Disclaimer: While we describe intended uses above, we make no warranty that information will be used exclusively for these purposes or that unauthorized access, use, or disclosure will not occur. Data security is inherently subject to limitations described in Section 9.
The Service is designed with privacy-by-default through automatic data expiration:
| Data Category | Retention Period | Deletion Method |
|---|---|---|
| Emotional state posts ("vibes") | 24 hours | Automatic permanent deletion |
| Chat messages | 9 minutes maximum | Automatic permanent deletion |
| Connection requests ("pings") | 60 seconds | Automatic expiration if not accepted |
| Active location data | 24 hours | Overwritten by new data or deleted |
Users may request complete account deletion through:
Upon deletion request, the following data is permanently removed:
Deletion Exceptions: The following data may be retained after account deletion:
Deletion Disclaimer: While we make commercially reasonable efforts to delete data as described, we cannot guarantee complete or immediate deletion from all systems, backups, or third-party services. Deleted data may persist in backups for up to 90 days or longer if required by law.
The Service implements the following retention periods based on legitimate operational requirements and user experience necessities:
24-Hour Vibe Retention - Business Justification:
9-Minute Chat Retention - Rationale:
Storage Limitation Principle (GDPR Article 5(1)(e)): We affirm that personal data is retained only for the minimum period necessary to fulfill the stated purposes. The retention periods above represent the maximum necessary duration and are not extended beyond these limits.
By design, the following information is visible to other Service users:
Visibility Limitation: We implement technical measures to limit information visibility, but we make no warranty that determined users cannot infer additional information through patterns, timing, or other means.
We engage third-party service providers to support Service operations. These providers have limited access to user information as necessary for their functions:
| Service Provider | Purpose | Data Access |
|---|---|---|
| Supabase | Database and backend infrastructure | Device IDs, location data, messages, birth year |
| Mapbox | Map display and geolocation services | Location coordinates (anonymized usage) |
| OneSignal | Push notification delivery | Device tokens, notification preferences |
| Amplitude | Analytics and service improvement | Anonymized usage statistics |
These third-party providers maintain their own privacy policies. We encourage you to review their policies, though we make no representations regarding their data practices or compliance.
We may disclose user information without notice or consent when we believe in good faith that disclosure is:
Law Enforcement Cooperation: We cooperate with law enforcement authorities when presented with valid legal process. We may disclose user information, including location data, chat logs (if not yet expired), and device identifiers in response to lawful requests. We provide no advance notice to users when legally prohibited from doing so.
In the event of a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction or proceeding involving the Service, user information may be transferred or sold as part of business assets. You acknowledge and consent to such transfers.
We do not engage in the following practices:
Location data is essential for core Service functionality. The Service collects location information:
Users may control location access through:
Location Privacy Disclaimer: While we implement technical measures to protect location privacy, no system is perfect. Determined users or sophisticated attackers may be able to infer location information through patterns, timing analysis, or other means. Location randomization is a privacy enhancement, not a security guarantee. You assume all risks associated with location disclosure.
The Service is operated from France. User information may be transferred to, stored in, and processed in France, other European Union member states, or other countries where our service providers maintain facilities.
Cross-Border Transfer Implications:
For European Economic Area users, we ensure that third-party service providers located outside the EEA maintain adequate data protection safeguards through standard contractual clauses or other approved mechanisms.
SECURITY DISCLAIMER: While we implement commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information.
We employ the following technical and organizational security measures:
You acknowledge and accept the following security limitations:
You are responsible for:
In the event of a data breach affecting personal information, we will:
However, we make no guarantee regarding the timing or content of breach notifications, which are subject to legal requirements and operational constraints.
Regardless of location, you have the following rights:
If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation:
California residents have the following rights under the California Consumer Privacy Act:
To exercise any privacy rights, contact us at:
We will respond to verified requests within:
Rights Exercise Disclaimer: While we will make commercially reasonable efforts to honor privacy rights requests, we make no warranty regarding response times or outcomes. Requests may be denied if legally permissible, technically infeasible, or if they would compromise others' privacy or security.
If you enable push notifications:
We reserve the right to modify this Privacy Policy at any time, at our sole discretion. Changes become effective upon:
Your Responsibility: It is your responsibility to review this Policy periodically. Continued use of the Service following changes constitutes acceptance of the modified Policy.
For material changes that significantly affect your rights, we will make reasonable efforts to provide advance notice through in-app notifications or other available means.
For users in the European Economic Area, we process personal data based on the following legal grounds:
| Processing Activity | Legal Basis |
|---|---|
| Core service functionality (map, chat, connections) | Performance of contract / Consent |
| Age verification and eligibility enforcement | Legal obligation / Legitimate interests |
| Safety features and content moderation | Legitimate interests (user safety) |
| Service improvement and analytics | Legitimate interests (service optimization) |
| Legal compliance and law enforcement requests | Legal obligation |
| Push notifications | Consent (can be withdrawn anytime) |
Data Controller: Ping&Wink, operated as an independent service under French law
Primary Contact: hello@pingandwink.com
Alternative Contact: pingandwink@gmail.com
Website: https://pingandwink.com
Privacy Inquiries: privacy@pingandwink.com (monitored periodically)
Response Times: We aim to respond to privacy inquiries within 48-72 business hours. However, response times are not guaranteed and may be longer during periods of high volume, technical issues, or operational constraints. For urgent matters, clearly mark your communication as "URGENT" in the subject line.
EU Representative: As we are established in the EU (France), no separate EU representative is required under GDPR Article 27.
Establishment in EU: As this Service is operated from France, we are established within the European Economic Area and directly subject to GDPR without need for Article 27 representation.
Data Protection Contact: For GDPR-specific inquiries, data subject rights requests, or data protection concerns, contact:
Supervisory Authority: French data protection authority (CNIL - Commission Nationale de l'Informatique et des Libertés). Users may lodge complaints at: www.cnil.fr
Privacy-related disputes are subject to the dispute resolution provisions in our Terms of Service, including binding arbitration and class action waiver clauses. You agree that privacy disputes shall be resolved through individual arbitration rather than court proceedings or class actions.
EEA Users: This arbitration clause does not affect your right to lodge a complaint with a data protection authority in your jurisdiction.
BY USING THIS SERVICE, YOU ACKNOWLEDGE AND AGREE THAT:
Honesty Disclaimer: This Service is operated by a single individual, not a large corporation with dedicated privacy teams. While we make reasonable efforts to protect privacy and comply with applicable laws, our resources are limited. We provide this Service "as is" with respect to privacy and security. Users who require enterprise-grade data protection should not use this Service.