Privacy Policy
Draft · last updated 13 November 2026
Pinged is a player card for gamers: one profile with verified Steam and FACEIT data, friends added by QR code or invite link, and a waitlist until the app is released. This policy explains what personal data we process on pinged.gg and in the Pinged app, why, where it is kept and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (ZZPL).
1. Who is responsible for your data
The data controller is [TODO: legal name and legal form of the company or person operating Pinged], [TODO: registered address], registration number [TODO: company registration number] (“Pinged”, “we”).
- Contact for privacy questions and requests: kontakt@pinged.gg [TODO: confirm this address or set up a dedicated one, e.g. privacy@pinged.gg]
- Data protection officer: [TODO: name and contact, or state that none is appointed because it is not required]
- Representative in the EU (GDPR Art. 27): [TODO: name and address if the controller is established outside the EU, e.g. in Serbia]
2. What we collect, why, and on what legal basis
We only collect what the product needs. “Contract” below means GDPR Art. 6(1)(b) / ZZPL Art. 12(1)(2), “consent” means Art. 6(1)(a) / Art. 12(1)(1), “legitimate interest” means Art. 6(1)(f) / Art. 12(1)(6) and “legal obligation” means Art. 6(1)(c) / Art. 12(1)(3).
| Data | Why we use it | Legal basis |
|---|---|---|
Waitlist. Email address, the nickname you reserve, games you pick, the time you gave consent, your invite code and who invited you, your position on the list, and where you came from (campaign tags utm_source, utm_medium, utm_campaign, utm_content and the first page you opened). | To hold your nickname, confirm your email address, tell you when the app launches, count invited friends, and understand which channels bring sign-ups. | Consent (the box you tick in the form). You can withdraw it at any time. |
| Enquiries from organisers and Discord servers. Name, organisation, type of organisation, email and message; for Discord servers the server name, size range, invite link, email and your role. | To answer you and arrange cooperation or early access to the bot. | Steps taken at your request before a contract; legitimate interest in answering enquiries. |
| Account. Email address, sign-in method (email code, Google, Apple or Discord), date the account was created and last sign-in. | To sign you in and keep your account secure. | Contract. |
| Profile and card. Nickname, display name, avatar, city, languages you speak, when you usually play, games, roles and style tags on your card, card frame, app language, your settings, your invite code and who invited you. | To build and show your player card and run the features you use. | Contract. |
| Year of birth. Stored privately. It is never shown on your card and is not returned to the app after you enter it. | To check the minimum age and apply the protections for players under 18. | Legal obligation and legitimate interest in protecting minors. |
| Linked game accounts. Your SteamID64 and FACEIT ID, your nickname on those platforms, verification status, whether the account is shown on your card, and game data: FACEIT level and ELO, K/D, headshot and win percentage, number of matches, hours in CS2 and whether the Steam account has a VAC ban. See section 3. | To show verified data on your card instead of screenshots. | Contract (you link each account yourself). |
| Friends and safety. Friend requests and friendships (with how you connected: search, link, Steam, match or QR), players you blocked, and reports you send (reason text and what was reported). | To run the friends list, keep blocked players away from you and moderate the service. | Contract; legitimate interest and legal obligation for moderation. |
| Messages. Text of chat messages you exchange with friends, once chat is available. | To deliver messages and show conversation history to you and the other person. | Contract. |
| Notifications. In-app notifications and, if you allow push notifications on your device, a push token and the platform (iOS or Android) for up to 10 devices. | To tell you about friend requests, accepted invites and similar events. | Contract; push notifications only with your device permission. |
| Consents. Which version of the Terms and of this policy you accepted and when; whether you agreed to analytics in the app. | To be able to show that consent was given. | Legal obligation. |
| Usage analytics. On the website: page views and a few events (nickname checked, waitlist joined, invite link copied, enquiry sent, card viewed), with the page language. In the app: nothing unless you switch analytics on. See the Cookie Policy. | To measure how sign-up works and improve the product. | Consent in the app (off by default). On the website: [TODO: consent or legitimate interest, depending on whether analytics runs with or without cookies; see Cookie Policy] |
| Abuse protection. A counter keyed by a one-way hash (SHA-256) of your IP address or email. We do not store the IP address itself in our database. Our hosting provider processes IP addresses to deliver the site and uses your country to suggest a language. | To limit automated sign-ups and attacks, and to open the site in a suitable language. | Legitimate interest in a secure, working service. |
We do not ask for and do not store passwords or access tokens for your Steam or FACEIT account. We do not sell personal data and do not use it for advertising profiles. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
3. Steam and FACEIT data
- Steam. You sign in on Steam’s own page (Steam OpenID). Steam tells us only your SteamID64. With that ID we read from the Steam Web API your public profile summary, ban status and, if your game details are public, your hours in CS2. If your Steam friends list is public, we can show you which of your Steam friends already have a Pinged card.
- FACEIT. You sign in on FACEIT’s own page (FACEIT Connect). We request only your identity and receive your FACEIT ID and nickname. With that ID we read your level, ELO and lifetime CS2 statistics from the FACEIT Data API.
- We refresh this data automatically about once a day for FACEIT and about every two days for Steam, and when you tap “Refresh” (at most once every 15 minutes).
- You can hide a linked account from your public card or unlink it at any time. Unlinking deletes that account and its game data from Pinged.
- Valve and FACEIT are independent controllers of the data in your accounts with them; their own privacy policies apply there. Pinged is not affiliated with or endorsed by Valve or FACEIT.
4. What other people can see
Your card at pinged.gg/your-nickname is public: anyone with the link can see your nickname, display name, avatar, city, languages, games and the linked accounts and statistics you have not hidden. Your email address, year of birth, settings, blocks and reports are never public. You decide whether your card appears in search. Reports are anonymous: the reported player is not told who reported them.
5. Who processes data for us and where
Your data is stored in the European Union. We use these service providers (processors):
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, live messaging, file storage | Frankfurt, Germany |
| Vercel | Hosting of the website and the API | API in Frankfurt; website delivered through Vercel’s global network |
| Resend | Sending email (waitlist confirmation, sign-in codes) | [TODO: sending region configured in Resend] |
| PostHog | Product analytics | EU cloud (Frankfurt) |
| Expo, Apple and Google push services | Delivery of push notifications to your device | United States and other countries |
| Sentry | Error reports, once enabled | [TODO: confirm whether Sentry is used at launch and in which region] |
If you sign in with Google, Apple or Discord, that provider learns that you use Pinged and acts under its own privacy policy. Some providers above are owned by companies in the United States; where personal data can be accessed from outside the EU/EEA or Serbia, the transfer is covered by [TODO: confirm signed data processing agreements and the transfer mechanism for each provider: EU Standard Contractual Clauses and/or EU–US Data Privacy Framework]. We share data with authorities only when the law requires it.
6. How long we keep data
| Data | Kept for |
|---|---|
| Waitlist entry | Until you unsubscribe, ask us to delete it or delete your account, and otherwise no longer than [TODO: period after the app launches, e.g. 12 months]. The email confirmation link is valid for 7 days. |
| Account, profile, card, linked accounts, friends, blocks, messages | Until you delete them or your account. Inactive accounts: [TODO: whether and after how long inactive accounts are deleted] |
| Notifications | 90 days, then deleted automatically. |
| One-time account linking requests | Valid for 5 minutes and deleted about an hour after they expire. |
| Abuse-protection counters (hashed IP or email) | Up to one day. |
| Reports | Reports about you are deleted with your account. Reports you sent stay with moderation without your identity for [TODO: retention period for resolved reports] |
| Enquiries from organisers and Discord servers | [TODO: retention period, e.g. 24 months after last contact] |
| Analytics events, server logs, database backups | [TODO: retention configured in PostHog, Vercel and Supabase] |
7. Your rights and how to use them
You have the right to:
- Access and portability. In the app, Settings lets you download all your data as a JSON file (at most once per hour).
- Correction. Edit your card and settings in the app at any time.
- Deletion. Delete your account in the app; see Delete your account.
- Withdraw consent. Unsubscribe from waitlist emails with the link in any email, and switch analytics off in the app settings. Withdrawal does not affect earlier processing.
- Restriction and objection. You can ask us to limit processing or object to processing based on legitimate interest.
For anything you cannot do in the app, write to kontakt@pinged.gg from the email address of your account. We answer within 30 days. Using your rights is free of charge.
You can also complain to a supervisory authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, Belgrade, poverenik.rs); in the EU, the data protection authority of the country where you live.
8. Minors
- Pinged is for players aged 15 and over. If the year of birth shows you are younger, a card is not created.
- Until you turn 18 your card does not appear in search and you can receive friend requests only through your QR code or invite link. These settings cannot be switched off earlier.
- If we learn that we hold data of a child under 15, we delete it. Parents and guardians can contact us at kontakt@pinged.gg.
- [TODO: in some EU countries the age of digital consent is 16 (e.g. Germany, the Netherlands): decide whether to raise the minimum age there or require parental consent]
9. Security
Data is hosted in the EU and sent over encrypted connections. Database tables are protected by row-level access rules, one-time tokens are stored only as hashes, and we keep platform IDs instead of platform credentials. No system is perfectly secure; if a breach puts your rights at risk, we will inform you and the authority as the law requires.
10. Changes to this policy
Each version of this policy has a date. When we change it in a way that matters, the app asks you to accept the new version, and we inform waitlist members by email where required.