PinPin Social — Privacy Policy

Effective Date: April 10, 2026  |  Version: 2.0

This policy complies with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).

1. Data Controller GDPR

• Application: PinPin Social
• Contact: pinpinsocial@gmail.com

2. Personal Data We Collect

2.1 Identity & Account Data

Data Type	Purpose	Legal Basis
Email address	Account creation, login, verification	Contract performance
Username / nickname	Profile display, social interaction	Contract performance
Profile photo	Profile personalization	Consent
Bio text	Profile personalization	Consent
Google account info	Google Sign-In (optional)	Consent

2.2 Location Data

Data Type	Purpose	Legal Basis
GPS coordinates	Show nearby pins, calculate distances	Consent
Pin location	Display event location on map	Contract performance

Important: Location permission is entirely optional. You can use the app without granting location access. Location is only accessed while the app is in use.

Pin visibility is controlled by the user:

• Public: Visible to all users
• Friends Only: Visible to your friends
• Only Me: Visible only to you

2.3 Messaging & Chat Data

• Message content (text)
• Sender/recipient identifiers
• Timestamps

2.4 Purchase Data

• Transaction verification tokens (via Google Play / App Store)
• Product ID and coin amount purchased
• Platform information (Android/iOS)

Note: Credit card or banking information is never stored by PinPin. Payments are processed entirely through Google Play or Apple App Store.

2.5 Notification Data

• Firebase Cloud Messaging (FCM) device token
• Notification preferences

2.6 Social Interaction Data

• Friend list and friend requests
• User ratings and reviews (1-5 stars)
• Reports and complaints
• Category suggestions
• Event participation status

2.7 Technical & Usage Data

• Device type and operating system
• Language preference
• Anonymized IP address
• Crash and error reports

3. How We Use Your Data

• Account creation, authentication, and login
• Providing location-based event and pin features
• In-app messaging and social interaction
• Sending notifications (friend requests, messages, updates)
• Verifying in-app purchases
• Security, abuse detection, and fraud prevention
• Improving service quality and fixing bugs
• Email verification notifications

4. Legal Basis for Processing GDPR Art. 6

Purpose	Legal Basis
Account & service management	Performance of contract (Art. 6/1-b)
Location usage	Consent (Art. 6/1-a)
Sending notifications	Legitimate interest (Art. 6/1-f)
Security & fraud prevention	Legitimate interest (Art. 6/1-f)
Purchase verification	Performance of contract (Art. 6/1-b)
Legal obligations	Legal obligation (Art. 6/1-c)

5. Third-Party Service Providers & Data Sharing

Provider	Purpose	Location
Google Firebase	Database, authentication, storage, notifications	US / EU
SendGrid (Twilio)	Email verification	US
MapTiler	Map rendering and geocoding	EU
Google Play / Apple App Store	Purchase verification	US
Google Sign-In	OAuth login (optional)	US

Your data is never sold to third parties.

6. International Data Transfers GDPR

Some service providers are located outside the EU/EEA (US). Transfers are conducted under the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC).

7. Data Retention

Data Type	Retention Period
Account data	While account is active + 30 days after deletion request
Chat messages	Auto-archived when event expires
Pin data	Auto-archived when pin expires (7-30 days)
Purchase records	Legal retention period (6 years)
Error reports	90 days

8. Data Security

• Encrypted storage on Firebase secure cloud infrastructure
• Firebase Authentication for identity verification
• Firestore security rules to prevent unauthorized access
• Sensitive operations handled server-side via Cloud Functions
• HTTPS/TLS encryption for data transmission

9. Cookies & Local Storage

The web version stores session info and language preferences in local storage. No advertising cookies are used.

10. Children's Privacy

PinPin Social is not intended for children under 13. If we discover data belonging to a child under 13, it will be deleted promptly. Report: pinpinsocial@gmail.com

11. Your Rights GDPR Art. 15-22

Right	Description
Right of access	Learn what data is being processed
Right to rectification	Request correction of inaccurate data
Right to erasure ("Right to be forgotten")	Request deletion of your personal data
Right to restrict processing	Limit how your data is processed
Right to data portability	Receive your data in a structured format
Right to object	Object to processing based on legitimate interest
Right to withdraw consent	Withdraw your consent at any time
Right to lodge a complaint	Contact relevant Data Protection Authority

Account Freeze & Deletion

• Account Freeze: Your account is disabled but data is preserved
• Account Deletion: Your account and associated data are permanently deleted

12. Policy Changes

Significant changes will be announced via in-app notification and may require renewed consent.

13. Contact

Email: pinpinsocial@gmail.com

GDPR requests: Email with subject "GDPR Data Request"