Privacy Policy

1. Who We Are

pingable.me (“we”, “us”, “our”) is a service that lets people create QR codes for anonymous, private communication. The data controller is Pingable, 25is Martiou 32a, 151 27 Melissia, Greece (VAT ID / ΑΦΜ: EL189065690). This policy explains what data we collect, why, and your rights under the General Data Protection Regulation (GDPR).

If you have questions about this policy, contact us at privacy@pingable.me.

2. What Data We Collect

2.1 QR Code Owners (registered users)

When you sign in (via Google or email magic link), we receive and store:

• •Account information: name, email address, and profile picture from your Google account.
• •QR code configuration: names, welcome messages, and contact method details (phone numbers, email addresses, URLs, usernames) that you choose to add.
• •Activity data: a timestamp of your last activity, used solely to determine whether to send you email notifications about new messages.
• •Notification preferences: whether you have email and/or browser push notifications enabled.
• •Push subscription data: if you enable browser push notifications, we store the subscription endpoint and encryption keys provided by your browser. This data is used solely to deliver notifications to that specific browser.

2.2 Scanners (people who scan QR codes)

Scanners do not need to create an account. When someone scans a QR code and uses the Pingable Chat feature, we store:

• •A random device identifier generated and stored locally on their device (in browser localStorage). This is not linked to any personal information.
• •Chat messages: the content of messages sent through Pingable Chat.

We do not require scanners to provide a name, email, phone number, or any personal details to use the chat.

2.3 Scan Analytics

When a QR code is scanned, we record:

• •Approximate location: city, region, and country, derived from the scanner's IP address. We do not store the IP address itself.
• •Device type: whether the scanner is using a mobile, desktop, or tablet device, derived from the browser's user agent string.
• •Timestamp: when the scan occurred.
• •Precise location (optional): if a scanner chooses to share their location via the browser prompt, we store GPS coordinates and accuracy. This is entirely voluntary — the scanner must explicitly tap “Share your location” and grant browser permission.

This data is used to provide QR code owners with scan analytics. Approximate location data derived from IP addresses cannot be used to identify individual scanners. Precise GPS location is only collected with the scanner's explicit consent.

2.4 Cookies and Local Storage

• •Authentication cookie: a session cookie set by NextAuth.js to keep you signed in. This is strictly necessary for the service to function and does not require consent.
• •Local storage: scanners' device identifiers and conversation references are stored in the browser's localStorage to maintain chat continuity. No tracking or advertising data is stored.
• •Service worker: a small script that runs in your browser to receive push notifications. It does not collect any additional data.
• •Product analytics (Umami): we use Umami, a privacy-friendly analytics tool, to understand which pages and features are used. It is cookieless, sets no identifiers on your device, does not track you across other sites, and collects only aggregated, non-identifying usage data. Data is processed in the EU.
• •Marketing cookies (Meta Pixel): on our public marketing pages only, and only if you accept via the cookie banner, we load the Meta (Facebook) Pixel. It sets cookies such as _fbp to measure page visits and the effectiveness of our advertising. These cookies are never set on the signed-in app or the QR scanner pages, and are not set at all unless you consent.

We do not use any advertising, analytics, or third-party tracking cookies without your consent. Strictly necessary cookies (such as the authentication cookie) are always used, as they are required for the service to function.

You can change or withdraw your choice at any time: Manage cookie preferences.

3. How We Use Your Data

We use your data for the following purposes:

• •To provide the service: displaying your QR codes, delivering chat messages, and showing scan statistics.
• •To send notifications: email and/or browser push notifications about new chat messages when you are offline (if enabled in your settings).
• •To prevent abuse: rate limiting on messages to prevent spam.

We do not sell your data, use it for advertising, or share it with data brokers.

4. Lawful Basis for Processing (GDPR)

5. Third-Party Processors

We use the following third-party services to operate pingable.me. Each processes data on our behalf under appropriate data processing agreements:

6. Data Retention

• •Account data: retained while your account is active. Deleted upon account deletion request.
• •QR codes and contact methods: retained while you keep them. You can delete individual QR codes at any time.
• •Chat messages: retained while the associated QR code exists. Deleting a QR code deletes all its conversations and messages.
• •Scan analytics: retained while the associated QR code exists.

7. Your Rights (GDPR)

As an EU resident, you have the following rights regarding your personal data:

• •Access: request a copy of all data we hold about you.
• •Rectification: correct any inaccurate data.
• •Erasure: request deletion of your data (“right to be forgotten”).
• •Data portability: receive your data in a machine-readable format.
• •Restriction: request that we limit processing of your data.
• •Objection: object to processing based on legitimate interest.
• •Withdraw consent: where processing is based on consent, you may withdraw it at any time.

You can exercise several of these rights yourself directly in your account settings: export a full copy of your data, or permanently delete your account and all associated data. For any other requests, email us at privacy@pingable.me. We will respond within 30 days.

8. Data Security

We protect your data with the following measures:

• •All data in transit is encrypted with TLS (HTTPS).
• •Database access is restricted with row-level security policies.
• •Authentication is handled via industry-standard OAuth 2.0.
• •We do not store passwords — authentication is delegated to Google.

9. Children's Privacy

pingable.me is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email to registered users. The “last updated” date at the top of this page reflects the most recent revision.

11. Contact

For any privacy-related questions, requests, or complaints:

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.