Privacy policy

Updated 19 October 2026

Pinstr keeps your photos and videos on a map, with where each was taken and which way the camera faced. This policy says what Pinstr keeps, why, where, for how long, who else handles it, and what you can do about it.

It covers the Pinstr apps for Android and iPhone, the website pinstr-tc.com, and the pages that Pinstr's links open.

Who we are

Pinstr is made by Eugene Mostoles Marzan, working as Thinkin Cup, in the Philippines ("we", "us"). For the Data Privacy Act of 2012 (Republic Act No. 10173), we are the personal information controller for your account and for what Pinstr keeps for it.

When you work in an organization's space, that organization decides who belongs there and what happens to the work added to it. For that work, we keep and process it for the organization as well as for you.

Questions, requests and complaints: [email protected].

What Pinstr keeps, and why

Your account

• Your email address, to send you a sign-in code, and so people can invite you.
• Your name, and if you give them a company or role and your letters. Your name is printed on your photo stamps and shown to the people you share with.
• Your devices: for each device you sign in on, a random number, what it is (such as "Chrome on Windows"), when it was first and last used, and when it was signed out. Only you can see this list, so you can sign out a lost phone.
• If your organization asks you to sign in with your work Google or Microsoft account, the email address, name and account number that sign-in gives us.

Your photos and videos

• The files as taken, and smaller copies Pinstr makes so they open quickly.
• Their details: where each was taken (your precise location), which way the camera faced, the time, the GPS accuracy, the camera and lens, the floor, the height of a drone, and the route walked while filming a video. On phones with a barometer, the air pressure at the moment of each photo, to tell floors apart.
• What you write and do with them: titles, notes, tags, statuses, approvals, markup, crops, comments on board posts, albums, and corrections to where a drone photo lies.
• Proof of when and where: a fingerprint of each file (its SHA-256), the time it reached Pinstr, whether the phone said its location came from a location-faking app (Android), and the GPS's own time beside the phone's clock. These let Pinstr show that a photo is unchanged since it was taken.

Why: to put your photos on the map, keep them safe, sync them between your devices, and share them with the people and links you choose.

Your location, beyond your photos

• Sharing your location with a project or trip, only when you start it: your position goes to that space's people while you share, also when you leave Pinstr (your phone shows that it does, with Stop). Pinstr keeps only where you were last seen, and clears it each night after the share ends. Sharing stops by itself when the time you chose is up, or when you leave the site if you chose that.
• "Where are you?" requests from people in your spaces, and your answers.
• Site walks and routes you record: the path you walked, also when you leave Pinstr, kept on your phone until you add it to a space.
• Point lists you save with Points: the coordinates you check on the map or import from a file, with each point's name, height and code. Kept in the space you made them in, for its people (or in My library); points not yet saved stay on your device.
• Your home, if you mark it, so photos taken near it lose their place on a trip's shared pages and its trip book. Nobody else ever sees it.

Spaces you work in

Projects, sites, organizations and trips: their names, places and areas, drawings and overlays (those drawn on the map too), map tags (a place's name and words, seen only by you until you share it with the space), their people and roles, invitations, board posts, notifications (what happened, and who did it), which photos you have opened, and for organizations on Business, a history of every change and who made it.

Links you make

A link shows what its maker chose to anyone who has its address, without an account. Its maker decides whether places are exact, rounded to about a kilometre or hidden; whether titles, notes, times and stamps show; and, on trips and in My library only, who took each photo. Links never show people's names in a project. An organization's links can show each photo's proof. On free links Pinstr counts viewers, and on any link the satellite views, with a random number kept in each viewer's browser. Photos taken with Pinstr's early camera have their stamp, place included, in the picture itself: a link that rounds or hides places lists them without their picture. A photo you hid in My library never shows in a link.

Limits for people without an account

What anyone can do without signing in (opening satellite on a link, reporting a link, the sign-in screen telling Pinstr that a code didn't work or wasn't sent, a device checking that its account still exists) is limited per internet address, so one person can't use it up for everyone. Pinstr never stores the address: only a code made from it and the day with a secret key, which can't be turned back into the address and changes every day. Why: to stop misuse. Kept two days.

Satellite

When you open Satellite, Pinstr records that a satellite view started: your account, the device's random number, the space (or the link) and the time. Each view is counted against the space's plan, and nobody can start more than a few a day.

Problem reports

• Sent by the app when something goes wrong (an error, a crash, a visit that ended unexpectedly): the app's version, the kind of device and the camera lenses Pinstr found on it, the last few screens' names, its memory and connection, and where the error happened in Pinstr's code. Email addresses, file links, long numbers and exact positions are removed first; positions are rounded to about a kilometre. Never photos, videos, notes or project names.
• Sent by you (Report a problem, or shaking the phone): your words, and a picture of your screen if you leave it on. You see the picture first and can mark it. The picture shows whatever is on your screen, which may include photos, places, notes and email addresses.

Why: to find and fix problems. You can switch automatic reports, shaking and the screenshot offer off in Account.

Reports about content

When you report a photo, a video or a link, we keep what you reported, why, your words, and who sent it, so we can look into it.

People you block

When you block someone, we keep who you blocked and their name as you saw it, so that what they do stops reaching you. They aren't told. You can unblock them in Account.

Notifications

To reach your phone when Pinstr is closed, we keep your phone's notification token. The words of each notification, such as a person's name, a space's name or an "I'm here" note, pass through Google's Firebase Cloud Messaging on their way to your phone, and on to an iPhone through Apple's Push Notification service.

Spoken notes

Notes you speak are turned into words by your phone's own speech recognizer. Where a phone can't do that on the phone itself, it sends the sound to its maker's service (Google's on most Android phones, Apple's on an iPhone), and Pinstr says so when that happens. Pinstr keeps only the words.

On what legal basis

We process this information to give you the service you signed up for; with your consent where your phone asks (location, camera, microphone, photos, notifications); for our legitimate interests in keeping Pinstr secure, working and free of abuse; and where the law requires it.

What stays on your device

• What you take in Pinstr stays in My library, on the device that took it, until you add it to a project or trip, or back it up for yourself. Until then, only a fingerprint receipt leaves the device: the file's fingerprint, its size and the time it was taken, never the picture or where. It lets your other devices tell you the photo exists, and gives it its label.
• Your phone's own photos (in the Android and iPhone apps, with your permission): Pinstr shows them in My library where they are, keeping a list of their places and times on the phone. Nothing is copied or sent until you add one. Albums you switch off aren't read at all, and which photos you hid stays on the phone.
• Lock Hidden, if you turn it on, asks for your phone's own fingerprint, face or screen lock before your hidden photos show. Your phone checks it; Pinstr only learns whether it was given.
• Place names, search, the camera's look at each place, and a day of air pressure readings at sites with floors are worked out and kept on the device.
• A photo only on your phone is lost with the phone. Pinstr tells you how many are only on it.
• Android's cloud backup takes nothing of Pinstr's. Moving to a new phone with Android's transfer brings Pinstr's photos, never your sign-in.

Who can see what you add

My library

Only you, on your own devices.

A project, site or trip

Its people, as their role allows. Its admins can change and remove what's there, and remove people.

An organization

Its admins, across its sites. What you add to it is the organization's record: it gets its own copy, which stays if you leave.

A link

Anyone with its address, showing only what its maker chose, until it's switched off or ends.

Photos you add to someone else's space stay there, with your name, if you leave or delete your account.

What we see

To run Pinstr, we can see account details (email address and name), devices, how much each space and account stores, and counts. We don't open your photos, videos, notes or locations, except:

• a screen picture you send with a problem report;
• content someone reported, to decide what to do about it;
• something you ask us to look at;
• where the law requires it.

Every look at an account in our console is recorded.

Who else handles it

We use these companies to run Pinstr. Each handles only what its part needs, under its own data protection terms. Some are outside the Philippines, so your information may be stored or processed in Singapore, the United States and other countries.

Supabase

The database and sign-in: your account, your spaces, your photos' details, reports. In Singapore.

Cloudflare

The website, photo and video storage (R2), the service that checks every file request, Pinstr's map files, encrypted backups, and the support email's forwarding. On Cloudflare's network, which answers from data centres near you.

Resend

Sending sign-in codes: your email address and the code.

Google Firebase Cloud Messaging

Notifications to phones: the phone's token and the notification's words.

Apple

Notifications to iPhones (Apple's Push Notification service): the iPhone's token and the notification's words, handed on by Firebase.

Esri

Satellite pictures and their dates. Pinstr's server starts each satellite view with Esri, telling it nothing about you; then Esri sees which area your device asks for and its internet address.

OpenStreetMap and CARTO

Searching for a place by name (what you type) and the site map in a printed report (the area asked for).

Google or Microsoft

Only if your organization requires sign-in with work accounts.

Your phone's maker

Speech recognition, as above.

We don't use analytics or advertising services, and the website is told to contact nothing beyond the services above. When paid plans arrive, payments will go through the app stores or a payment provider, and this policy will say what they receive.

How long it's kept

Your account and what you add

Until you delete it, or your account.

A deleted photo or file

Removed from storage within about a day.

Backups

Nightly, encrypted, kept 90 days. Our database provider's own daily backups, up to 7 days. A copy of the nightly backup on our own computer, 14 days. Something deleted leaves the backups when they expire.

Notifications

60 days.

Problem reports and their screen pictures

90 days.

Reports about content

A year after they're dealt with. If you delete your account, your name leaves them.

People you block

Until you unblock them, or either account is deleted.

Receipts of changes, used for syncing

180 days.

Your last shared location

Cleared each night after the share ends.

Satellite views

40 days. After that, only how many each space used each month.

The daily codes from internet addresses, for limits

2 days.

A signed-out device in your list

90 days.

How to delete your account, and what goes and what stays: Delete your account.

How it's protected

• Everything travels encrypted (HTTPS).
• The database itself decides who may see and change what, so a modified app can't reach more than its person may.
• Photos and videos are fetched only with short passes the database signs for each person.
• Backups are encrypted before they leave our computer.
• A lost or stolen phone can be signed out from another device, and erased when it next connects. A device that hasn't reached Pinstr for 7 days hides what it holds until it does.

Pinstr does not use end-to-end encryption: the service can technically read what is stored, which is why the rules above limit who does. If a breach puts you at real risk, we will tell you and the National Privacy Commission as the law requires, within 72 hours of knowing.

Your choices and rights

• See and take your data: everything you added is in the app; Export project saves a project with its original files.
• Correct it: change your name in Account and your photos' details in the app.
• Delete it: delete photos, spaces and links in the app, or your whole account (how).
• Stop sharing: switch off location, camera, photos and notifications in your phone's settings, and problem reports in Account.
• Ask us: to see what we hold about you, to correct, block or erase it, or to object to how we use it. Email [email protected]. We answer within 30 days.

Under the Data Privacy Act you also have the right to be informed, to data portability and to damages, and to complain to the National Privacy Commission (privacy.gov.ph).

Children

Pinstr is for people 18 and over. We don't knowingly keep information about children. If you think a child has an account, tell us and we'll delete it.

Changes

When this policy changes, we'll update this page and its date. If a change affects what we do with what you've already given us, we'll tell you in the app before it applies.