Privacy

What Pinhead keeps

• Your account: your email address (to sign you in), and the name, handle, short bio and photo you choose to add.
• What you put in: your maps and places, their statuses, notes, visits, missions, filters, and the photos you add. Photos are resized and have their location and camera details stripped before they leave your phone.
• Base camp: the spot you set as your base, if you set one.
• People: who you follow, who follows you, who you've blocked, and any reports you make.
• Feedback: what you send with Send feedback, with the screen you were on and your kind of device. Kept if you delete your account, without your name.
• How it's used: the days you open Pinhead, so Steven can see whether people come back.

Your location

When you tap the locate button, your phone shares where you are with the app so it can show the blue dot and distances. That stays on your device: it isn't sent to Pinhead or stored, unless you choose “Use where I am” to set your base camp.

What other people can see

New maps are private: only you can see them. You choose, per map, whether followers or everyone can see it, and whether your progress (ticks, dates, notes and photos) shows. If you publish a map as a list, anyone can see its places and take a copy; your name and handle go with it. Your profile shows your name, handle, photo and what you've made public; a private account limits it to people you approve.

Who else handles it

These companies run parts of Pinhead and only use your data to do that:

• Supabase stores the database, your photos, and runs sign-in (in London, UK).
• Vercel hosts the app and serves its pages.
• Resend sends the sign-in emails, and emails Steven the feedback you send.
• PostHog (in the EU) records how the app is used while it's being tested: the pages you open, key actions (like ticking a place), errors, and, when you're signed in, a replay of the screen so problems can be seen and fixed. Replays never show what you type, your notes or your photos. It's linked to your account, not your email, and stores nothing on your device.
• DataFast counts visits and where they came from (a search, a link someone shared).

When you use the map, your device fetches map pictures directly from OpenFreeMap, Esri and Amazon Web Services (terrain), and driving routes from the OSRM project; they see your device's IP address and the area you're looking at. Place search goes through Pinhead to Photon (by komoot), and place photos come from Wikimedia Commons. Tapping Directions opens your own maps app (Google Maps, Apple Maps or Waze), under its own privacy terms.

Cookies and tracking

Pinhead uses a cookie to keep you signed in, and remembers a few settings on your device (like light or dark). DataFast sets two cookies of its own on pinhead.app to tell a new visit from a returning one. There are no adverts, no tracking across other sites, and your data is never sold.

Why it's allowed to

Pinhead uses your data to provide the app you signed up for, to see how it's used so it can be fixed and improved, and, where needed, to keep it secure and stop misuse. Steven and anyone he makes an admin can look at accounts to help you or to deal with reports; every look is logged.

How long it's kept, and deleting it

Your data stays until you delete it. You can delete any place, map or photo yourself, and delete your whole account from You, at the bottom, under Delete account: that removes everything you made straight away (backups clear within 30 days). Copies other people took of your published lists stay theirs.

Your rights

You can ask for a copy of your data, have it corrected or deleted, or object to how it's used: email hello@pinhead.app. If you're unhappy with the answer, you can complain to the Information Commissioner's Office (ico.org.uk).

Children

Pinhead isn't meant for children under 13, and won't knowingly keep their data.

Changes

If this changes, this page changes, with a new date at the top. Anything big gets an email first.