Get the apps

Pinpal

Privacy policy

Last updated 4 October 2026

This policy explains what the Pinpal apps collect, why, and what you can do about it. It covers Pinpal Notes, Pinpal Projects and Pinpal Todo, their services, and this website. It is written plainly and describes what the apps actually do. It is not legal advice.

Who we are

The Pinpal apps and this website are provided by Portfoliobox Stockholm AB ("we"), org. no. 556894-4382, Rånövägen 30, 168 39 Bromma, Sweden. We are the data controller for the personal data described here. Contact: [hello@mypinpal.com](mailto:hello@mypinpal.com).

What we collect

  • Your account. When you sign in with Apple or Google, we receive a stable account identifier and, where you allow it, your email address and name. We never receive your Apple or Google password.
  • What you write. In Notes: your folders, notes and checklists, and the files you attach. In Projects: your projects, tickets, labels, statuses and every comment in a ticket's thread, whether you or a connected AI wrote it. In Todo: your todos and the notes under them. Stored so they sync across your devices and so the AI you connect can work with them.
  • Your connections. For each AI or app you connect we store a hashed token, its name, and what it may reach (in Projects, one project or all of them).
  • Your subscription. Apple tells us whether you have an active subscription, and when it renews or ends. Apple handles the payment; we never see your card.
  • Minimal technical data. Ordinary server logs needed to run and secure the service. The apps contain no advertising or tracking SDKs.
  • Website visits. This website counts page views with Plausible Analytics: which page, the referring site, and the country and device type. It sets no cookies and stores no IP address, so no visitor can be identified. The apps send nothing to Plausible.

What we do not do

We do not sell your data. We do not share what you write with anyone except the AI you choose to connect, and each connection reaches only what you gave it. We do not use your data to train AI models. We show no ads.

Where your data lives

Your account and everything you write are stored in a PostgreSQL database hosted by Fly.io in Amsterdam, in the European Union. Files you attach are kept in Fly.io's object storage. Traffic is encrypted in transit (HTTPS) and storage is encrypted at rest by the host. Access tokens and sign-in session tokens are stored only as hashes, so a copy of the database alone does not reveal them.

Connecting an AI

When you connect an AI assistant such as Claude or ChatGPT, you sign in and allow it, and it receives a token that lets it read and write in that app on your behalf. You can see and revoke every connection in the app (in Projects, in the project's settings under Connect). Revoking cuts that assistant off at once. When you connect a third-party assistant, its provider processes what you let it reach under its own terms. That is your choice, and you control it.

Your rights

Under the GDPR you can access, correct, export or delete your data. You can edit or delete anything you wrote in the app at any time, and delete your account and everything in it under Account, Danger zone. To export everything, or for any other request, email [hello@mypinpal.com](mailto:hello@mypinpal.com).

Retention

We keep your data for as long as your account exists. Something you delete waits in Recently deleted for 30 days where the app has one, so you can restore it, and is then removed. Delete your account and we remove everything: what you wrote, your connections and the account itself.

GDPR

What we process and why. Your account identity, to sign you in and sync your data; what you write, to provide the app and, where you connect one, to let your AI work with it; your subscription status from Apple, to know whether you may write; all three under the performance of our contract with you. Security logs, to keep the service safe, under our legitimate interest in a secure service.

Where it is processed. Your account and everything you write are stored and processed in the EU, on Fly.io infrastructure in Amsterdam. Attached files are kept in Fly.io's object storage (Tigris), which may serve copies from other regions.

Your rights. Access and portability, rectification, erasure, restriction and objection. Email [hello@mypinpal.com](mailto:hello@mypinpal.com) to use any of them. You may also complain to your local data protection authority; in Sweden, IMY.

Sub-processors.

  • Fly.io: hosting, database and file storage.
  • Apple: sign-in, subscription billing and app distribution.
  • Google: sign-in, when you choose it.
  • Plausible Analytics: cookieless page statistics for this website (EU).

Children

The apps are for a general audience and not directed at children. We do not knowingly collect data from children under the age of digital consent without a parent's involvement.

Changes

If this policy changes we update this page and its date.