Pingoo Privacy Policy

1. Scope and service provider

This policy applies to the Pingoo iOS app, Pingoo's self-hosted server, and related support services. The personal information processor and service provider is Eric Wang (legal name: 王伟; developer of Pingoo). Contact: pingoo888@163.com. “We” and “us” refer to this service provider.

2. Information we process

Account and profile

• Username, email address or mainland China phone number, password hash, verification delivery and validation results, account ID, and sign-in sessions required for registration and sign-in;
• When you use Sign in with Apple, the Apple user identifier and the name, email address, or private relay address you choose to share;
• Nickname, gender, birthday, avatar, timezone, language, holiday settings, and interface preferences you choose to provide. Gender and birthday are optional. Age is calculated dynamically from your birthday in the app and is not stored as a separate field. The original avatar photo is not retained; only the crop you confirm is uploaded;
• Installation identifiers, device sessions, device security verification results, and necessary security audit records created to prevent abuse and protect accounts.

Content you create

• Original note text, additional details, titles, tags, reminder times, recurrence rules, completion status, and AI-organized results. Journals also include the date an entry belongs to, the time it was actually recorded, and content you confirm or edit. Location-related content also includes destinations, place search text, names, addresses, coordinates, city, district, speech transcripts and alternative transcripts, reminder areas, and arrival or departure conditions. With your separate consent to upload location snapshots and system location access, a note mentioning a place may include the device coordinates, accuracy, collection time, and location source from a single measurement at submission. This information is stored with the note on Pingoo’s server to help identify the place you mean;
• System calendar sync is off by default. When enabled, the title, original text, and confirmed time are written to the Apple Calendar you select and may then be synced by iCloud, Exchange, or another calendar account;
• Calendar event identifiers remain on the current device and are not uploaded to Pingoo's server.

Voice, notifications, membership, and feedback

• Local speech recognition uses Apple’s system speech recognition, and Apple may process audio online when required by the device or system. Free users use Apple speech recognition only and do not send recordings to Doubao or MiMo. When you are a VIP member, are signed in, have authorized third-party AI, and have remaining AI uses and cloud voice minutes, cloud speech recognition sends the current recording through Pingoo’s server to the voice service providers listed in Section 4. Pingoo does not persist the audio and releases it when processing ends. The final transcript is handled as a regular note;
• Notification permissions, push identifiers, reminder titles, and delivery status are used to send reminders. You can enable “Hide Sensitive Content” so the lock screen shows only a generic message. When input contains a location, or when you select a place or enable a location reminder, the app may request While Using the App location access. Device location is used for place search and arrival or departure reminders. Separately authorized location snapshots also help improve place identification. These snapshots are not sent to third-party AI or Alibaba Cloud or written to diagnostic logs. Pingoo does not continuously collect device location;
• When you enable widgets or Live Activities (Lock Screen and Dynamic Island), selected note titles, times, checklist progress, destinations, distances, and available static map previews may appear outside the app. To display and update this content, the current device keeps necessary display data, and Pingoo processes push identifiers, associated notes, and display preferences and sends necessary reminder content through Apple notification services. You can disable Live Activities or enable Hide Sensitive Content;
• To provide membership, restore purchases, and manage AI quotas, we process Apple product IDs, transaction identifiers and signature-verification results, subscription and auto-renewal status, entitlement source and validity, base AI quota, add-on purchase and usage records, and cumulative cloud voice-processing duration and quota periods. We do not receive payment credentials such as your bank card number;
• When you submit feedback, we process the feedback text, any contact details you provide, up to three images, and the app version, iOS version, and device model. We retain only images you confirm for submission and remove their metadata;
• To operate and troubleshoot the service, we record request identifiers, features accessed, request types, processing results, errors, request counts, and processing times. These diagnostic logs do not contain full note text, passwords, verification codes, or API keys.

3. Purposes of processing

• To provide registration, sign-in, separation between accounts, cross-device sync, note organization, reminders, calendar features, and membership;
• With your explicit consent, to use third-party AI to organize note categories, titles, tags, dates, times, and places; to use necessary location information to help find the place you mean and provide arrival or departure reminders according to the settings you confirm;
• To verify transactions and entitlements, calculate and deduct AI quotas, and handle refunds or restored purchases;
• To handle feedback, protect the service, diagnose failures, limit abnormal requests, fulfill deletion requests, and provide user support;
• To comply with applicable laws and regulations. Pingoo does not sell personal information or use data for cross-app tracking or third-party advertising.

4. Third-party AI and other service providers

Third-party AI consent is managed separately for each Pingoo account on each device. We send natural-language notes to third-party AI only after you consent on the current device. After you withdraw consent, that device stops cloud sync and no longer uploads new natural-language notes or sends them to third-party AI. Existing notes on the device are not deleted, and you can still enter and save notes manually. Withdrawal does not cancel tasks already submitted, and consent on other devices must be managed separately.

• Xiaomi MiMo (an AI service provided by Xiaomi): used for note organization and cloud voice correction. It may receive original note text, additional details, timezone, region, holiday information, and a pseudonymous account identifier. This identifier can link requests from the same account and does not anonymize the original text. For location-related input, it may also receive speech transcripts and alternative transcripts, your city and district, and relevant place names and addresses; device coordinates are not attached. Cloud voice correction may also provide it with the current recording. Pingoo uses MiMo services offered for mainland China accounts. Processing and retention are governed by its Privacy Policy and applicable service arrangements;
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. and its affiliates): used for note organization. It may receive the necessary text-related information and pseudonymous account identifier described above. It does not receive voice audio, and device coordinates are not attached. Data is stored in mainland China. Under its current Privacy Policy, the provider may use input and output for model training and service improvement after security encryption and de-identification, which does not mean complete anonymization;
• Zhipu (北京智谱华章科技股份有限公司): used for note organization. It may receive the necessary text information and pseudonymous account identifier described above, including original text, additional details, timezone, region, holiday information, and relevant transcripts, place names, and addresses. It does not receive voice audio or attached device coordinates. Personal information collected and generated through its operations in China is stored in China. Processing and retention are governed by its Privacy Policy (Chinese) and applicable service arrangements;
• Volcengine Doubao (Beijing Volcano Engine Technology Co., Ltd.): receives the current recording when a VIP account with remaining AI uses and cloud voice minutes uses cloud speech recognition. Pingoo transmits the audio only to complete that request and does not persist it in its own systems;
• Alibaba Cloud (place information services): used to look up and identify places in notes. It may receive place search text, city, district, and relevant place names or addresses. We do not provide this service with the complete original note, a Pingoo account identifier, or device coordinates. Returned place names, addresses, and destination coordinates are stored with the note and synced to your devices;
• We do not separately attach email, phone number, nickname, avatar, password, verification code, or payment credentials from your account profile to these models. Personal information you put into notes or recordings is sent as part of that content. Model output may be inaccurate; please review it before use;
• Apple and its affiliates: provide Sign in with Apple, speech recognition, place search and location, notifications, widgets and Live Activities, calendar, in-app purchases, and device security verification, and process necessary data under Apple’s policies;
• Alibaba Cloud SMS: processes phone numbers and SMS requests for mainland China phone registration, password reset, and sensitive-operation verification. Pingoo retains account phone numbers, necessary verification information, and delivery results, but not verification-code text;
• Tencent Cloud Email Service (Tencent Cloud Computing (Beijing) Co., Ltd.): in production, processes the recipient address, sender address, email subject, template variables, and necessary delivery results to send verification codes for registration, password reset, account linking, sensitive-operation verification, data deletion, and account deletion. The service processes this information in mainland China, and this information is not used for advertising or cross-app tracking. Tencent Cloud handles the information under its Privacy Protection Statement. You may exercise related rights through us at pingoo888@163.com, and we will handle or help relay the request;
• Tencent Cloud Storage (Tencent Cloud Computing (Beijing) Co., Ltd.): privately stores avatars and confirmed feedback images in production.

Opening an external map: only when you choose an installed map app for navigation does Pingoo pass it the destination name, coordinates, and necessary source identifier. That app provides navigation under its own permissions and privacy policy.

We require these providers to process data only for the agreed purpose and only to the extent needed, and to protect it to at least the standard in this policy and applicable law. They may not use it for another purpose without authorization, except for processing already described in this section. If the service region changes in the future and personal information would be transferred across borders, we will provide advance notice and complete the procedures required by applicable law. Test and production environments are separated, and production user data is not used for development or testing.

5. Retention periods

• Account identities, profile information, preferences, and user content are generally retained until you delete the relevant content or permanently delete the account;
• Separately authorized location snapshots are retained with their notes until you delete the corresponding note, all notes, or the account. Backup cleanup follows the maximum 30-day period below. Turning snapshot uploads off does not automatically delete snapshots in previously submitted notes or cancel their submitted processing tasks;
• Pingoo does not persist cloud voice-correction audio in its own systems. It is released when the request completes, fails, or is cancelled. Retention by Apple or AI providers is governed by their policies and our applicable service arrangements;
• Feedback text, contact details, and confirmed images are retained for 90 days from submission and then deleted automatically. Permanently deleting the account or making a separately verified deletion request deletes them earlier. “Delete All Data (Keep Account)” does not delete feedback immediately;
• Audit records used to check whether AI processing worked correctly are kept for no more than 30 days and are deleted with the related note;
• Server diagnostic logs are kept for no more than 7 days and are then deleted automatically;
• Deletion-request status and security audit records are used only to confirm completion, handle disputes, and ensure deleted content does not reappear after backup recovery. They are deleted or anonymized when those purposes are complete and do not contain your email address or original note. Necessary deletion records used for backup cleanup contain no user content and are kept for no more than 30 days;
• Production backups are retained for no more than 30 days. Previous deletion requests continue to apply when data is restored, so deleted content does not reappear;
• Transaction, refund, and security-audit information is retained for the period necessary for Apple reconciliation, legal obligations, disputes, or fraud prevention.

6. Your choices and rights

• Review, grant, or withdraw third-party AI consent for the current device under “Me → Data & Privacy.” After withdrawal, third-party AI organization and cloud sync stop on that device, and existing notes are not deleted. Consent on other devices must be managed separately;
• Location snapshot upload is off by default. Grant or withdraw it separately under “Me → Data & Privacy → Review Details & Location Consent.” Declining affects only the use of your current position to help identify places, not AI organization, manual place selection, or system location reminders, subject to their respective permissions. Precise location may reveal where you were when submitting a note; a single snapshot is attached to help identify the place you mean only with your separate consent and system location access. After withdrawal, new notes no longer receive a snapshot;
• Disable microphone, speech recognition, notification, location, or calendar permission in iOS Settings. Declining these permissions does not prevent text or manually structured notes; location reminders need location access;
• Under “Me → Data & Privacy,” generate and share the currently available data copy (basic account and profile information, holiday preferences, and notes), or use “Delete All Data (Keep Account).” That deletion removes notes, AI jobs, and reminder-related data, but keeps sign-in identities, sessions and devices, nickname, avatar, preferences, feedback, and membership transaction records;
• Under “Me → Account & Security,” permanently delete the account. Account deletion cannot be undone, except that minimum records required for legal obligations, Apple reconciliation, security audits, or fraud prevention may remain for the necessary period. Deleting a Pingoo account does not cancel an Apple auto-renewable subscription; cancel any active subscription in your Apple Account subscription settings first;
• For access, correction, copying, or deletion that is not directly available in the app, including separate deletion of feedback, contact us using the email below. We verify identity and respond within the period required by applicable law.

7. Security

We protect data through encrypted transmission, credential protection, and access restrictions. System logs do not contain full note text, verification codes, sign-in credentials, API keys, or push identifiers. We maintain these safeguards, but no internet transmission or storage system can be completely secure.

8. Minors

Pingoo is not directed to children under 14. Users aged 14 to 18 should use Pingoo only after a guardian has read and agreed to this policy. If we learn that a child's personal information was processed without a guardian's consent, we will delete it as soon as reasonably possible.

9. Policy updates

If important processing purposes, third-party AI services, or user rights change, we will update the date and provide notice through an in-app message or another reasonable method. Changes that require new authorization will not automatically rely on prior consent.

10. Contact us