PinStash Privacy Policy
Effective: 30 September 2026 · Last updated: 30 September 2026
Türkçe sürüm1. Who is responsible
PinStash is published by Tahsin Canpolat , an individual developer based in Türkiye, who is the data controller under the Turkish Personal Data Protection Law (KVKK) and, where it applies, the GDPR.
| Contact | info@pinstash.app |
|---|---|
| Address | İstanbul, Türkiye |
2. What we process
PinStash only processes what the app needs to work. There is no advertising network, no analytics SDK and no third-party tracker in the app.
2.1 Account
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (stored irreversibly hashed) | Creating your account and signing you in | Performance of a contract |
| Session token | Not having to sign in on every launch | Performance of a contract |
2.2 Profile
Name, bio, city, website and profile photo are optional: you enter them and can change or remove them at any time. Your photo is kept in a private (non-public) file area scoped to your own folder and is shown through short-lived signed links.
Your name is visible to other users on reviews you write . Your bio, city, website, email address and the contents of your collections are not shown to others.
2.3 Collections and reviews
When you save a place we store Google's place identifier (place_id) plus your own note, tags and ordering. If you make a collection public, its name and the places in it are visible to other signed-in PinStash users; collections are private by default. Your place reviews and ratings are visible to other users.
2.4 Location
If you grant location permission we use your device location to find places near you . Your location is:
- resolved to a district name by your device's operating system;
- sent to our server and on to Google in order to run the search;
- never stored in our database — it is held in memory while the app is open.
If you decline, the app still works: you pick the area to search by hand.
2.5 Usage and subscription
We store how many places you have saved, collections you have created and reviews you have written (for badges), your AI route preferences, and how many AI routes you generated this month (for the plan limit). If you subscribe we store the subscription state received from the store (plan, start/end date). We never see your card or payment details — the Apple App Store or Google Play handles payment.
2.6 Kept on your device
Your language and theme preference and your session key are stored in your device's own secure storage and are not sent to our server. Deleting the app deletes them.
3. Who we share with
We do not sell your data. We use these providers only to run the service:
| Provider | Purpose | What is sent |
|---|---|---|
| Supabase | Database, accounts, file storage, server functions | The account, profile and collection data listed above |
| Google (Maps Platform — Places API) | Place search and place information | Search coordinates and search text. Your account or name is not sent. |
| Resend | Verification and password reset emails | Your email address |
| Apple App Store / Google Play | Subscriptions | Subscription state. We do not see payment details. |
Our database and files are held in Supabase's Frankfurt (Germany) region, and Google and Resend also run servers outside Türkiye. By using the app you accept that your data may be processed abroad through these services.
We may also disclose data where we are legally required to, or to protect a legal right.
4. Google content
Place names, addresses, ratings, reviews and photos in the app are fetched live from Google and are not stored in our database . Their use is subject to Google's own terms; see the Google Privacy Policy .
5. How long we keep it
We keep your data while your account exists. If you delete your account, it and everything attached to it — collections, saved places, reviews, profile details and your profile photo — is permanently deleted and cannot be recovered. You can start the deletion yourself from Settings → Delete my account.
6. Your rights
Under KVKK art. 11 you may ask whether your data is processed, request information, ask for correction or deletion, object to processing and seek compensation for damage. If you are in the European Union, the GDPR gives you rights of access, rectification, erasure, portability and objection.
You can exercise most of these directly in the app: edit your profile, delete collections and reviews, or remove your account entirely. For anything else write to info@pinstash.app ; we answer within 30 days at the latest.
7. Security
All connections are encrypted. The database enforces row-level security: each user can only reach their own rows. Profile photos are kept in a non-public area. Requests to Google run on the server, so API keys are not shipped inside the app. No system is perfectly secure, though — if you spot a security problem, please write to us.
8. Children
PinStash is not directed at children under 13 and we do not knowingly collect their data. If you are under 18 you should use the app only with the consent of a parent or guardian.
9. Changes
If we update this policy we change the date on this page. We will tell you in the app or by email about any significant change.