Privacy policy

1. Who controls your data

The controller of your personal data is Rafał Wójciak, a private individual, with a correspondence address at ul. Kościelna 18, 24-173 Markuszów, Poland.

For anything about your data, write to hello@heypinned.com. No data protection officer has been appointed; every request goes to that address.

Data is processed under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

2. What we collect and why

• Account. Your email address, and either a hashed password or the name and identity Google gives us when you sign in that way. Used to create and run your account and to sign you in. Kept for as long as your account exists.
• Pins. The pictures and text you save, along with their Source (the page they came from). Used to let you keep and organize what you save. Kept for as long as the Pin exists. A deleted Pin sits in the Bin for 7 days, then it is removed for good.
• Terms acceptance and marketing consent. A record of what you agreed to and when, including whether you opted in to product emails. You can withdraw marketing consent at any time in settings.
• Security logs. IP address, browser information, and request details, used to keep the service secure, catch abuse, and diagnose failures. Kept for up to 30 days.
• Error reports. Technical details collected automatically when something breaks, so we can fix it.

Account and Pin data is processed to perform our contract with you. Security logs and error reports are processed under our legitimate interest in keeping pinned working and safe. Marketing emails are sent only with your consent.

3. Who receives your data

We use a small set of providers, each acting on our instructions:

• Supabase - database and sign-in. Data is stored in the EU, in Frankfurt.
• Vercel - hosting.
• Resend - sending email.
• Sentry - error monitoring.
• Google - only if you choose to sign in with a Google account.

We do not sell your data or share it with anyone for their own marketing.

4. Transfers outside the EEA

Your data is stored in the EU. Some of the providers above are based in the United States and may need access to keep the service running. Where that happens, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision. Write to hello@heypinned.com for a copy of the relevant safeguard.

5. Your rights

Under the GDPR, you can ask us to:

• give you access to your data and a copy of it,
• correct data that is wrong or incomplete,
• erase your data,
• restrict how we process it,
• move your data to another provider,
• stop processing based on our legitimate interest, and
• withdraw consent, wherever processing relies on it.

Send a request to hello@heypinned.com. We reply within a month; for a complex request we may need two more months, and we will tell you within the first month if that happens.

You can delete your account yourself in settings. This cannot be undone. To get a copy of your data, write to the address above.

If you think we are handling your data unlawfully, you can complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland.

6. Cookies

pinned sets one cookie: the session cookie that keeps you signed in. We do not run analytics or advertising, so there is no cookie banner. Deleting the session cookie signs you out.

7. Changes to this policy

We may update this policy if pinned changes, if our providers change, or if the law requires it. The current version is always the one published on this page.