Privacy Policy

Privacy Policy for Pingify (GDPR-Compliant)
Effective Date: 21-04-2025

At Pingify, we value your privacy and are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and relevant local data protection laws. This Privacy Policy explains what information we collect (or don’t), how we handle it, and your rights as a user of the Pingify App, Pingify NFT Tags (“Tags”), and related services (collectively, the “Service”).

1. Who We Are

Pingify is a decentralized service that allows users to interact with programmable NFC Tags and blockchain-based NFTs. The Service is designed with privacy by design and by default principles.

Data Controller:
Rebel Code
KVK: 90638050
📧 privacy@pingify.io

2. What Personal Data We Collect

Pingify does not collect or process personal data such as names, emails, or location data. Your identity is based solely on your blockchain wallet, and:

  • No user accounts are created

  • No personal identifiers are stored on our servers

  • No unencrypted user data is transmitted or collected

3. Local Storage of Private Keys

Your blockchain private key is generated and stored locally on your device using Expo SecureStore, which utilizes the device’s secure enclave (e.g., iOS Keychain, Android Keystore) to prevent unauthorized access.

🛡 Pingify does not have access to your private key and cannot recover it if lost.

4. Blockchain and NFT Data

  • All NFTs minted using Pingify are stored on the Polygon blockchain.

  • Any metadata associated with NFTs is encrypted using AES-GCM 256.

  • The decryption key is embedded in the NFC Tag URL, which you control.

You are responsible for managing and securing these URLs. As blockchain data is public and immutable, please be mindful of the data you choose to encode.

5. Third-Party Services and Subprocessors

We rely on third-party services to deliver parts of our functionality:

  • Push Protocol (blockchain messaging using PGP encryption)

  • Stripe (payment processing)

  • Netlify (hosting)

  • Netlify Functions + Firebase (notifications)

These services may process user data under their own privacy terms. We only use GDPR-compliant providers and ensure data minimization at all times.

6. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases:

  • Consent: Use of the Pingify App and optional services (e.g., notifications).

  • Legitimate Interest: Minimal use of secure third-party services to deliver the core functionality.

  • Contractual Necessity: Processing payment-related information via Stripe.

7. Your Rights Under GDPR

As a data subject, you have the right to:

  • Access any personal data we may hold about you (none by default).

  • Correct inaccurate or outdated data (if any).

  • Erase your data (“right to be forgotten”).

  • Restrict or object to processing.

  • Data portability, where applicable.

To exercise any of these rights, contact us at privacy@pingify.io.

Please note: Because Pingify does not collect user data or create user accounts, we may not be able to identify or verify individuals for such requests unless you provide proof (e.g., Wallet address + message signature).

8. Data Retention

Message data:

Messages, and message related data are stored on our moki.chat node:

  • End to End encrypted messages (AES-GCM 256)

  • Wallet IDs and usernames

You can request that any of this data is removed by emailing support@pingify.io

Pingify does not store any additional data on its servers. Local device data (such as your Wallets private key) is retained only on your device. If you have iCloud keystore sync or Google play backup enabled then they private key is encrypted before backing up online and is not accessible to us.

9. Children’s Privacy

Pingify is not intended for children under 13. We do not knowingly collect any personal data from minors.

10. Data Security

We use industry-standard measures to protect your data:

  • Local private key storage with Expo SecureStore

  • Encrypted blockchain data using AES-GCM 256

  • Secure messaging on our Moki Service Node using AES-GCM 256

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in technology or legal obligations. Changes will be posted in the App and on the Pingify website.

12. Contact Us

For any privacy-related inquiries or GDPR rights requests, you can reach us at:
📧 privacy@pingify.io