Privacy Policy

Self-hosted instances

Pingoid connects to an API instance you choose. Information you submit to example-instance.tld is processed by that instance’s operator under its own configuration and policy. The publisher may not operate, access or be able to delete data on independently operated instances.

Data the app uses

The app keeps selected-instance and account settings locally, and protects stored mobile credentials with Android security facilities. A selected instance can process account/profile details, services and credentials, signals and webhook content, alerts and their preferences, notifications, device/push registrations and operational records needed to provide the service.

Notifications and providers

Push is optional. If enabled, Pingoid uses a UnifiedPush distributor selected on your device, such as ntfy. The selected instance stores the registration required for delivery. Web Push notification payloads are encrypted for the subscription before they are sent to the distributor; the distributor and network still process delivery and network metadata. An instance may also configure email, diagnostics or integrations; its operator should identify those providers.

Controls and deletion

You can change subscriptions and notification settings, revoke credentials, remove a local account or instance, and disable push. Removing a local account does not delete its server account. You can permanently delete your server account in the app. The public Pingoid account-deletion page helps you find your instance’s web flow or request assistance without installing the app. Deletion removes the account profile, credentials, push registrations, alerts and their preferences, notifications and digests. An unshared avatar and its thumbnail are cleaned up by the worker. Account references in invitations and instance links are removed or detached. Copies already stored on other devices must be removed from those devices. Instance-wide services, topics and signals remain available to other users. Contact the responsible operator about personal information in shared content; its presence does not automatically exempt it from an erasure request.

Diagnostics, analytics and retention

The official application automatically sends privacy-minimized Crash logs and technical Diagnostics to an Igin-operated Bugsink service for Analytics, meaning the identification, investigation and correction of application errors. Automatic diagnostics are required; sending a report through the feedback form is optional. The form sends your title, description and reproduction steps to the same Bugsink service. Do not include personal information, passwords or secrets. Reports can include an exception, sanitized stack trace, application release and OS/runtime context. Identity and request fields, cookies, breadcrumbs, local variables and source excerpts are removed before transmission, and recognised sensitive values are filtered. This minimisation does not guarantee full anonymisation, particularly for free-text reports. Session replay, performance tracing, profiling, screenshots, advertising and behavioral tracking are not used. Production Bugsink connections must use HTTPS. Automatic errors and voluntary reports are distinct mechanisms stored in the same service. Events are not linked to accounts by an account identifier; deleting an account does not automatically delete past reports. Retention depends on the hosting settings and actual cleanup jobs; the application guarantees no fixed duration. Igin currently makes no backups of server or Bugsink data. Independent instance operators set their own database, backup and log retention. This website integrates Vercel Analytics and, when configured, Umami, separately from the Android application.

Logs and other records

The API logs each HTTP method, route template, status, response time and size, without query values or route identifiers. Operational errors may contain technical references. Hosting settings determine log rotation and retention; deleting an account does not purge logs. By default, an active worker purges signals without notifications after 30 days, all signals after 365 days and processed delivery work after 7 days. Associated notifications are removed with signals. Operators can configure these thresholds. Current topic states and webhook receipts are separate records with no automatic age purge.

The website contact form is separate from Bugsink. It stores your name, email and message in the receiving instance’s contact file; no automatic age purge is implemented. New messages do not store your IP or user agent; an IP is used temporarily in memory to limit abuse. Contact requests are not linked to an app account and are not deleted by account deletion. Ask the operator to examine or erase personal information in these records.

Purposes and your rights

On an Igin-operated instance, account data is processed to provide the service you request and kept until account deletion. Error diagnostics and voluntary reports serve Igin’s legitimate interest in maintaining a reliable service, without advertising or behavioural tracking. You may request access, correction, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. Contact support@igin.fr for Igin’s processing, identifying the instance without sending passwords. For an independent instance, contact its operator. You can lodge a complaint with the CNIL.