Privacy Policy

Who we are

Pinok is provided by [Company legal name], [Registered address] (“we”). For anything in this policy, write to us through the contact form and choose Privacy.

Our representative in the European Union: [EU representative (GDPR Art. 27), if required]. In the United Kingdom: [UK representative (UK GDPR Art. 27), if required]. [to confirm: whether a data protection officer is required]

Controller or processor

When you use Pinok on your own or in a Free workspace, we decide how your data is used: we are the controller. When a company pays for a workspace, the company is the controller of the workspace’s content and we process it on its behalf, as its processor, under our Data Processing Addendum. Either way, we stay the controller of the data we need to run the service itself: accounts, sign-in and security data, and (when it is turned on) analytics.

What we collect, why, and on what basis

What	Why	Legal basis
Your email address	To sign you in with a one-time code (there are no passwords), to let teammates find and invite you, and to write to you about your account.	Contract
Your name and, if you add one, your photo	So teammates know who did what.	Contract
Workspace content: tasks, subtasks, notes, comments, reactions, dates, reminders, repeats, priority, projects, stages, hand-offs, approvals, followers and their history	This is the service. It is stored so you and the people you share it with can see it on every device.	Contract
Photos and files you attach (up to 25 MB each), with their name, type and size	Stored privately and shown only to people who can open the task.	Contract
Settings: away dates, time zone, notification choices, the morning summary hour	So reminders, the morning summary and “stuck” follow your days and your clock.	Contract
The email addresses of people you invite	To send the invitation and let them join when they sign in.	Legitimate interest of the inviter and the workspace
Push notification tokens, one per device	To deliver notifications to your phones.	Contract, and your phone’s permission
Read markers (when you last saw a task)	To show what is new to you. Only you and your devices see them.	Contract
Your calendar feed’s link (stored only as a one-way hash), when you turn it on	To serve your tasks to the calendar you subscribe with.	Contract, at your request
Security data: the network address that asked for a sign-in code, and counters of attempts	To stop code guessing and abuse of sign-in, invitations and the contact form.	Legitimate interest (keeping the service safe)
Messages you send through the contact form, with your email and network address	To answer you, and to stop the form being abused.	Legitimate interest; steps before a contract
Usage analytics and error reports (not turned on yet)	To learn which features help and to fix crashes. See below.	[to confirm: legitimate interest or consent]

Contacts. On a phone you can pick a teammate’s email from your address book. The app asks for access only when you tap “From contacts”, and the list stays on your phone: nothing from your address book is stored or sent.

What we don’t do

• We don’t sell or “share” personal data, and we don’t show ads.
• We don’t use your content to train AI models. Pinok has no AI features.
• We don’t record sessions, and we don’t track you across other sites or apps.
• This website runs no scripts, sets no cookies and uses no analytics.

Who can see what inside Pinok

• Tasks in a project are visible to that project’s members.
• A personal task (outside any project) is visible only to its creator, its owner, its approver and its followers. Nobody else, not even the workspace owner, sees or counts it.
• These rules are enforced by the database itself (row-level security), not only by the app.
• Your teammates see your name, email address, photo, away dates and time zone. Your notification settings are yours alone.
• Profile photos and workspace logos are served at long, unguessable addresses that need no sign-in, so they can show in notifications and on every device.
• Anyone holding your calendar feed’s link can read the tasks in it, until you replace it or turn it off.

Notifications

Push notifications on iPhone and Android are sent through Expo’s push service and delivered by Apple (APNs) or Google (FCM). They carry what you need to act: the name of the person who acted, the task’s title and, for a mention or a note, their own comment. They show on your lock screen as your phone is set up to show them. You choose which kinds reach you in Profile → Notifications. Reminders you set on a task are scheduled on your phone itself.

Analytics and error reports

Analytics and error reporting are not turned on. The apps contain the code for them (PostHog), but no key is configured, so nothing is sent. If we turn them on, we will update this policy first, and:

• events will carry a random account id, counts and flags, never task titles, comments, notes, file names, search words, names or email addresses;
• error reports will carry a stack trace with quoted text, emails and long numbers removed;
• there will be no session recording and no automatic capture of what you type or tap;
• the signed-out intro will send nothing;
• the data will be processed in [region to confirm: US or EU].

This website and the contact form

This website is plain pages: no cookies, no analytics, no third-party scripts, and no fonts or images loaded from elsewhere. Our hosting provider sees your network address in order to serve the pages [to confirm: how long hosting logs are kept].

If you write to us through the contact form, we keep the topic, your name (if you gave one), your email address, your message and the network address it came from for one year, then delete them automatically. We may forward your message to our own inbox to answer it.

Service providers

A few companies help us run Pinok and handle data only on our instructions: Railway (hosting and database), Tigris through Railway’s storage buckets (files), Resend (sign-in emails), Expo, Apple and Google (push notifications) and, once turned on, PostHog (analytics). The full list, with what each one handles and where, is on the Subprocessors page.

Where your data is, and transfers

Our API and its Postgres database run on Railway in the europe-west4 region, in the Netherlands. Photos and files are kept in a Railway storage bucket in Amsterdam, operated by Tigris. The phone apps and the web app also keep a working copy of your workspace on your device, so it opens instantly and works offline.

Railway, Tigris, Resend, Expo, PostHog, Apple and Google are companies based in the United States, so some data may be accessed from or transferred to the US. Where that happens, we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework (and the UK equivalents). [to confirm: each provider’s transfer mechanism, and any rules that apply in the company’s own country]

How long we keep it

Data	Kept
Your account and content	Until you delete them, or your account
Deleted workspaces, projects, tasks, comments and files	30 days, so they can be brought back if deleted by mistake; then gone for good. Deleting your account skips this: what goes with it is erased at once
Files	Removed 30 days after their task or comment is deleted; anything left behind is swept within about a day
Sign-in codes	Valid for 10 minutes, stored only as a keyed hash; deleted when used, or a day after they expire
Sessions	Until you sign out, or 60 days without use
Rate-limit counters	2 days
Records of reply-by reminders and nudges	30 days
Contact form messages	1 year
Server logs	[to confirm]
Backups	[to confirm: whether and how long; deleted data stays in a backup until it expires]
Analytics (once turned on)	[to confirm]

Your rights

Depending on where you live, you have the right to access your data, correct it, export it, delete it, object to or restrict some processing, and withdraw consent you gave. You can do most of this yourself: edit your name and photo in Profile, export a project or a workspace backup, and delete your account. For anything else, write to us through the contact form (choose Privacy); we will answer within one month. You also have the right to complain to a data protection authority, for example where you live or work.

If your workspace is run by a company that pays for it, the company is the controller of its content: we will pass your request about workspace content to it, and help it answer.

Deleting your account

In the app: Profile → Account → Delete account, then type DELETE or your email. It deletes your private tasks with their subtasks and files, your photo, your sign-in and your sessions, and signs out every device. What you wrote in shared tasks stays with your team, shown as “Deleted user”. The full details, and how to ask without the app, are on Delete your account and export your data.

US state privacy notice

If you live in California or another US state with a privacy law: the categories of personal information we collect are identifiers (name, email, network address), the content you create, and (once turned on) product usage. We collect them for the purposes above. We don’t sell or share personal information for cross-context advertising, and we don’t use sensitive personal information to infer anything about you. You can ask to know, correct or delete what we hold, through an authorised agent if you like, and we won’t treat you differently for asking.

Children

Pinok is a work tool and is not meant for children under [16]. If we learn that a child’s account exists, we will delete it.

Security

Access rules live in the database, sign-in uses one-time codes, sessions are short, and files are private. How we protect your data, and what we haven’t confirmed yet, is on the Security page.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect, and update the date at the top. What the website and the web app store on your device is on Cookies and local storage.

Contact us

Use the contact form and choose Privacy, or write to [Company legal name], [Registered address].