Privacy Policy
Last updated: 27 July 2026
PinkyPact (“the app”, “we”, “us”) is a two-person accountability app that lets you and one partner set shared tasks and remind each other to finish them. This policy explains what data we collect, why, who we share it with, and how you can delete it. It covers both the app and our website at pinkypact.app. We keep this deliberately short because we collect very little.
Who we are
PinkyPact is operated by Tóth Tamás, Iglic utca 2/1, 2142 Nagytarcsa, Hungary, who is the data controller for the personal data described in this policy. You can reach us at hello@pinkypact.app.
The app
The app does not collect your real name, email address, phone number, contacts, precise (GPS) location, photos, or payment information. There are no ads and no cross-app or cross-site tracking. The app does not show an “Ask App Not to Track” prompt because it does not track you.
What we collect
| Data | What it is | Why |
|---|---|---|
| Display name | A name you choose (can be a nickname) | Shown to your paired partner |
| Tasks & history | The chore/task text and its status you and your partner create | The core function of the app |
| Comments | The free-text notes you write when you decline, reject, or complete a task | Shown to your partner, so they know why |
| Device push token | An anonymous push token (via Expo) from your OS, plus an identifier for the device it belongs to | To send task reminders and partner notifications to the right device |
| Notification status | Whether you have push notifications switched on | Shown to your partner, so they know whether you will see a reminder |
| Pairing codes | Short codes used to link two devices | To connect you with your partner |
| Device timezone | Your device’s timezone (e.g. Europe/Budapest) | To show reminder times in your local time |
| Approximate location | Your country/region, derived from your IP address by our analytics provider | To understand roughly where the app is used |
| PinkyPact Plus interest | A note that you registered interest in PinkyPact Plus, keyed to your anonymous ID | To gauge demand before we build it |
| Pseudonymous analytics | Product-usage events (screens viewed, features used) keyed to a random app-generated user ID, along with technical detail such as your app version, your platform, the IP address the events were sent from, and the random identifiers of the task and pair involved. These events carry no text you have written. | To understand which features are used and fix problems |
We do not ask for or store any account identifier that reveals who you are. Your “account” is an anonymous identifier generated on your device; it is not tied to your Apple ID, email, or any personal login.
Reporting a promise
If you report one of your partner’s promises as abusive, we store a copy of that promise’s text together with the report and the random identifiers of the task, the pair, and you as the reporter. We keep that copy even if the promise is later edited or deleted, and even if the account it came from is deleted — otherwise a report could be erased by the person it is about. We keep it only for as long as we need it to act on the report and to recognise repeat abuse.
The website (pinkypact.app)
Our website collects nothing. It sets no cookies, runs no analytics or tracking scripts, and has no forms, sign-ups or accounts. There is nothing on it to fill in, so you can read every page without giving us anything at all.
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address and request data for as long as it takes to serve you the page. We do not receive, store, or have access to that.
If you email us at hello@pinkypact.app we will of course have your email address, because you sent it to us. We use it to answer you and nothing else.
Who we share it with (third parties)
- Google Firebase (Authentication, Cloud Firestore, Cloud Functions, App Check) — stores your display name, tasks, pairing data, and push token so the app works across your and your partner’s devices. See Google’s privacy policy at firebase.google.com/support/privacy
- Expo (push notifications) — we send push notifications through Expo’s push service, which relays them to Apple. Expo processes your device push token and the notification text (which can include your partner’s display name and the promise text) solely to deliver the notification. See expo.dev/privacy
- PostHog (EU region) — receives pseudonymous product-analytics events from the app, keyed to a random user ID. Data is processed on PostHog’s European servers. The app records no video or screen recordings of your session. Because these events are keyed to a random identifier and contain no name or email, they are pseudonymous. PostHog also derives an approximate location (your country/region) from the IP address of these requests, so we can see roughly where the app is used. This is not precise location and is not shared with anyone else. The IP address itself is stored by PostHog alongside these events. See posthog.com/privacy
- Cloudflare, Inc. — hosts pinkypact.app, and processes your IP address and request data in order to serve you the page. See cloudflare.com/privacypolicy
We do not sell your data or share it with advertisers.
Legal basis and your rights (GDPR / EEA users)
Because analytics are processed in the EU, EU/EEA data-protection rules apply. Our legal bases for processing are:
- Performance of a contract — running the app for you: your display name, tasks, pairing data, and push token.
- Legitimate interests — operating and improving the app (pseudonymous analytics), acting on reports of abusive content, answering you when you write to us, and protecting the app from spam and abuse.
You have the right to access your data, correct it, delete it, receive a copy of it in a portable format, object to processing based on our legitimate interests, and withdraw any consent you have given. If you are in the EEA or the UK and you believe we have mishandled your data, you can also complain to your local data protection authority.
How to delete your app data: open the app, go to Settings → Delete account. This permanently removes your account and all associated data — your display name, tasks, history, pairing, and push token. If you are paired, your partner’s copy of the shared tasks and history is removed too. This cannot be undone. The one exception is a copy of any promise that has been reported to us as abusive — see “Reporting a promise” above.
Anything else: email hello@pinkypact.app and we will answer within 30 days.
Data retention
- Your display name, tasks, pairing data, and push token are kept until you delete your account (or end pairing, which removes the shared pair data).
- Pseudonymous analytics events, including the IP address they were sent from, are retained for up to 12 months. They are keyed to a random identifier rather than to your name or email.
- Content reports, and the copy of the reported promise they contain, are kept for as long as we need them to act on the report and to recognise repeat abuse.
- Emails you send us are kept while we need them to answer you, and deleted when we no longer do.
Children
PinkyPact is not directed at children under 13 and we do not knowingly collect data from them.
Changes to this policy
If we change what we collect, we will update this page and the “Last updated” date above.
Contact
Questions about privacy or a data request: hello@pinkypact.app