English · Latviešu

Privacy Policy

Effective 14 August 2026 · v2.4

1. Who we are and what this policy covers

Pindela is a product of Woodrock Solutions (a trading name), operated by SIA "D & L SERVISS", registration No. 50103412361, VAT No. LV50103412361, Rūpniecības iela 25–33, Rīga, LV-1045, Latvia ("we", "us", "our"). SIA "D & L SERVISS" is the data controller for the personal data described in this policy.

This policy covers the Pindela mobile app (iOS and Android) and the pindela.app website. It explains what information we collect, why we collect it, who we share it with, and the rights you have — under the EU General Data Protection Regulation (GDPR) first and foremost, because Pindela is built EU-first.

Pindela is a game about real places: you photograph a spot in the real world, and other players physically travel there to find it. Location is the core mechanic of the game, so please read section 2 carefully — we have tried to be precise about exactly when your location is used and what happens to it.

Our Terms of Service are available at pindela.app/terms.

2. Information we collect

Account information

You sign in with Google or Apple — there are no Pindela passwords. From your sign-in provider we receive and store:

the provider's user identifier (the OAuth "subject" ID), which is how we recognise your account;
your email address, but only if the provider marks it as verified (Apple private-relay addresses are stored as supplied);
with Google sign-in, the display name Google supplies. With Apple, we request only your email — we never receive or store a name for Apple accounts.

We read nothing else from your provider — no profile picture, no contacts. In the app you also choose a username (public), and we store your avatar colour, language preference, and notification preferences.

Providing this data is necessary to hold an account: without a Google or Apple sign-in you cannot create one, and without the "while using the app" location permission you can browse challenges but cannot post or submit guesses.

Invites

Every account gets its own invite code. If you enter someone else's code when you sign up, we store which account invited you and the code you used. We also count, per day, whether an invited player both posted a challenge and solved one — that is how an invite qualifies for a reward. We never import your contacts and we do not know how you shared your code.

Precise location — the heart of the game

We collect your device's precise (GPS) location at exactly five moments, always in the foreground and never in the background:

When you post a challenge. The exact coordinates where you are standing become the challenge's secret spot. They are kept for as long as the challenge record exists.
When you submit a guess. We read your GPS position and its reported accuracy to verify that you really found the spot. The coordinates of your guess are stored with your guess result — but only temporarily: once the challenge has been over for a retention window (currently 30 days), a nightly job permanently erases the coordinates and keeps only the distance in metres between your guess and the spot, which is what results and leaderboards need. The accuracy reading is used only momentarily to calculate the win tolerance and is not stored.
When you reach a starred spot. We read your GPS position and its reported accuracy to check that you are really at the place, exactly as a guess does. Nothing about where you stood is stored — the collection record keeps only which spot, which day, and the points and pins it paid.
When you use the Pulse functionality. Inside a challenge block you can ask how close you are. We use your position to measure the distance to the spot, turn that into one of three bands — cold, warm or hot — and discard the distance immediately. We store only the band word and the time you used it, so the cooldown can restate your last reading. Your position itself is never stored.
Only if you opt in to "near you" notifications (they are off by default), the app periodically reports your position while you use the map so we can tell you about new challenges nearby. Before saving it, our server snaps this position to the centre of the containing map block — your precise position is never stored for this purpose, and only fixes fresher than 14 days are used for matching. While the setting is off, the app does not transmit this position at all; turning it off stops the collection and immediately clears the stored position.

There is no background location tracking. The app requests only "while using the app" location permission.

Photos you post

Challenge photos are captured live through the in-app camera only — there is no gallery upload, and the app has no access to your photo library. Before posting, the app gives you a blur tool and requires you to blur any identifiable people and vehicle licence plates. When the photo reaches our server, it is re-encoded and all metadata — including any embedded GPS data — is stripped before the photo can be viewed or processed by anyone or anything. Photos are stored in a private storage bucket on our own infrastructure and are only ever served through short-lived, signed links. If you appear in someone else's photo, see section 5.

Gameplay data

We store your gameplay record: challenges you post and play, guesses and their results, points, placements, leaderboard rank, daily streak, achievement badges, and your pins balance (our virtual in-game currency) together with how pins were earned and spent.

Device and push notification data

If you allow notifications, we store an Expo push token for your device together with its platform (iOS/Android), so we can deliver notifications. Tokens are removed when you sign out and pruned automatically when they stop working.

Subscription and purchase data

All purchases happen through the Apple App Store or Google Play and are managed via RevenueCat. We receive and store the purchase event records needed to grant what you paid for and to keep our books auditable: product identifiers, store transaction identifiers, subscription status and expiry, pins credited, and the full purchase-event records our subscription provider sends us (kept for audit and reconciliation). We also record the express consents you give at checkout (immediate start of Premium; immediate delivery of pin packs) and any withdrawal statements you submit in the app — each with the consent text version, your language and a timestamp — and show them to you permanently in Settings → Purchases & consents, where you can export the record. We never see or store your card details — payment is handled entirely by Apple or Google. Your withdrawal and refund rights are described in our Terms of Service.

Moderation and safety data

To keep the game safe we store: reports you file (reason categories and any free-text description you write), reports filed against your content, moderation strikes, suspensions, appeal requests and their outcomes, moderator decision notes (which are shown to you when a decision affects you), and your block list.

Public request forms

Anyone — with or without a Pindela account — can file an illegal-content notice at pindela.app/report or a photo removal request at pindela.app/photo-removal. These forms ask for your name and email address, a description of the content and your reasons. We use this information only to handle the request; the decision is published under your reference number on the same page — we do not email it. See section 7 for retention.

Technical data

IP address: used transiently, in server memory only, for security rate-limiting. We do not write IP addresses to our application database.
Crash and error diagnostics: via Sentry, our error-monitoring provider. Reports are scrubbed before sending — no request bodies, cookies, or headers, and no automatic collection of your IP address. Mobile crash reports are tagged with your account ID and username so we can investigate problems affecting your account; no location fields are attached.
Session security: sign-in tokens are stored only as cryptographic hashes on our servers, and in encrypted storage on your device.

The pindela.app website

The public website uses Google Analytics only if you allow it: on your first visit a banner offers an equal choice to allow or decline, nothing analytics-related is loaded or stored before you choose, and declining changes nothing about how the site works. If you allow it, Google Analytics (Google Ireland Ltd.) sets its cookies and identifiers to measure aggregate site usage (pages viewed, approximate region, device type); we configure it with IP anonymisation and without advertising signals. You can change your choice at any time via “Analytics choice” in the site footer. Beyond that, the site sets no visitor cookies. (The staff-only /admin area sets a session cookie for our administrators.) Our web servers keep standard access logs, including IP addresses, for security.

3. How we use your information

To run the game — creating and resolving challenges, verifying that guessers physically found the spot, awarding points, streaks, achievements, and pins, and showing leaderboards.
To deliver what you bought — activating Premium and crediting pin packs based on validated store purchases, and keeping the record of your checkout consents and withdrawal statements.
To send notifications — gameplay activity, optional "near you" alerts (only if you opted in), and always-on account and safety notices (e.g. moderation decisions), delivered in your chosen language.
To keep the game safe and fair — content moderation (including notices filed at pindela.app/report and photo removal requests), screening for inappropriate images, the strike and complaint system, blocking, and anti-cheat measures such as validating that guesses come from inside the challenge block and detecting location spoofing.
To secure the service — rate-limiting, abuse prevention, and diagnosing crashes and errors.
To comply with law — keeping purchase records for tax and accounting purposes and responding to lawful requests.

We do not send marketing emails.

4. What other players can see

Your challenges: while a challenge is live, other players see its photo (once they preview or enrol) and only the map block plus a coarse area label (e.g. "Centrs, Rīga") — never the exact spot. The exact spot is revealed only after the challenge ends, and only to players who enrolled in it. The go-live of every challenge is delayed so you cannot be tracked to the spot in real time.
Your identity to other players: your username, avatar colour, points, rank, placements, and time-to-find appear on leaderboards and challenge winners lists.
Local legend standings: a starred spot is a permanent place anyone can collect once a day. On each one we show the player who has collected it most — their username, avatar colour, how many times they have collected it, and the date they took the title — to every player who opens that spot. You are also shown the username and collection count of the player immediately ahead of or behind you at that spot, and, if you take the title, the username of the player you took it from. This is calculated from the collection records described in section 2. It never includes where you stood or when you were last there, because a collection does not record your position.
Never visible to other players: your email, real name, sign-in provider, your device location (precise or coarse), where you stood when guessing (your own guess position is shown only to you, after the challenge ends and until its coordinates are erased — see section 2), and your purchase, pins, streak, or moderation data.
Blocking: if you block another player (or they block you), you mutually stop seeing each other's challenges and activity and cannot interact with each other's content.
Someone who invited you: if you signed up with another player's invite code, that player sees your username and how many qualifying days you have reached on their Invite friends screen — so they can see their reward progress. They do not see your email, your location, your challenges, or anything else about how you play. You see nothing about them beyond the code you entered.

5. If you appear in a Pindela photo

Challenge photos come from one source: the posting player's in-app camera, used live at a publicly accessible place. Before the photo can be posted, the poster is required to use the blur tool to blur identifiable people and vehicle licence plates, and confirms in our Terms that they obtained any consents needed to photograph and post it. On our server the photo is re-encoded and stripped of all metadata before anyone can view it.

We host these photos on the basis of our legitimate interest in operating a photo game about public places, combined with the poster's confirmation described above. Photos are visible only while the challenge runs and are deleted when the challenge ends — the post-game reveal is a map pin, not the photo.

If you nonetheless believe you are identifiable in a Pindela photo, request its removal at pindela.app/photo-removal — no account needed. You leave your name and email address and receive a reference number; our decision is published under that reference on the same page. You can object to this processing at any time (section 15).

While a removal request or report is being handled, our moderators can access the stored photo — including photos already hidden from players — in order to review it. Photos that were reported are retained as moderation evidence for around 90 days after the report is resolved (section 13).

7. Processing at a glance: purpose, legal basis, retention

This section summarises, per category of personal data, what we use it for, the legal basis, and how long we keep it (Articles 13–14 GDPR). Sections 2 and 13 give the full collection and deletion detail.

Account data

What: sign-in provider user ID, verified email address, display name (Google sign-in only), username, avatar colour, language and notification preferences.
Purpose: operating your account and the game. Legal basis: contract.
Retention: until you delete your account (then only the limited post-deletion records in section 13 remain).

Challenge spot (precise location)

What: the exact coordinates where you stood when posting a challenge — the game content you chose to publish. While the challenge is live, other players see only a ~1.5 × 1.5 km block; the exact spot is revealed to participants after it ends (you are reminded of this before posting).
Purpose: the challenge itself. Legal basis: contract.
Retention: as long as the challenge record exists (deleted with your account).

Guess position (precise location)

What: the exact coordinates where you stood when submitting a guess.
Purpose: verifying the win (distance to the spot), anti-cheat, and handling disputes. Legal basis: contract and legitimate interest (anti-cheat).
Retention: erased automatically once the challenge has been over for the retention window (currently 30 days); only the distance in metres survives, for results and leaderboards.

"Near you" presence (coarse location)

What: the centre of the map block you were last in — the precise fix is generalised before it is ever stored.
Purpose: "new challenge near you" notifications. Legal basis: consent — the setting is off by default, and while off the app transmits nothing.
Retention: overwritten on each report; wiped immediately when you opt out; only fixes fresher than 14 days are used for matching.

Photos

What: challenge photos — captured live in the app, blurred by the poster (people and licence plates), re-encoded with all metadata (including GPS) stripped on the server.
Purpose: the challenge content. Legal basis: contract; for people incidentally in a photo, legitimate interest plus the poster's confirmation (section 5).
Retention: deleted automatically when the challenge ends; reported photos are kept as moderation evidence for around 90 days after the report is resolved.

Analytics events

What: usage events (screens, gameplay actions) tied to your internal account ID — never your email or name.
Purpose: understanding how the game is used so we can improve it. Legal basis: consent — opt-in in every country, off by default.
Retention: nothing is collected before you opt in or after you opt out; events already collected are kept under our analytics provider's limited retention settings.

Advertising data

What: the data Google processes to serve ads in the free tier (IP address, coarse device data, and — only with your consent — advertising identifiers for personalisation). We do not build or store ad profiles ourselves.
Purpose: funding the free tier. Legal basis: legitimate interest for non-personalised ads; consent for personalised ads. Personalised ads require an in-app 18-or-older self-declaration together with that consent; without both, ads stay non-personalised.
Retention: processed by Google under its own policies; Premium removes ads entirely (the advertising SDK is not even initialised).

Purchase records, checkout consents and withdrawal statements

What: store purchase events (product, transaction IDs, subscription status, pins credited), the express consents you gave at checkout (with text version, language and timestamp), and any withdrawal statements with their reference numbers.
Purpose: delivering what you bought, proving the consents and statements consumer law requires, accounting and audit. Legal basis: contract and legal obligation.
Retention: purchase and tax records at least 5 years (accounting law). Consent and withdrawal records are kept even after account deletion, with the reference to your account removed, because they remain necessary as evidence of the consents given and for legal claims (GDPR Art. 17(3)(e)).

Public request forms (report / photo removal)

What: the notifier's name and email address, the description of the content and the reasons given, plus our decision.
Purpose: handling the notice or removal request, publishing the motivated decision under its reference, and handling any reply or appeal. Legal basis: legal obligation (Digital Services Act) and legitimate interest.
Retention: for the duration of the proceeding — as long as needed to handle the request, any appeal and any legal claims arising from it.

Invites and referral rewards

What: who invited whom, the code used, the number of qualifying days reached, the Pins paid to each side, whether the invite counted toward Premium, and whether we reversed it.
Purpose: running the invite programme, paying and — where an invite is abusive — reversing rewards, and preventing fraud (for example self-invites or accounts created only to farm rewards). Legal basis: contract (the reward you were promised) and our legitimate interest in preventing fraud and protecting the game's economy.
Retention: for as long as the inviting account exists. If you delete your account, the invites you made are deleted with it. If a player you invited deletes theirs, the invite record is kept but stripped of every reference to them — it then holds no personal data about them and exists only to evidence the reward the inviter earned.

Everything else

Push tokens: contract; removed at sign-out and pruned when they stop working.
Moderation and safety records: legitimate interest (keeping the platform safe, defending claims); retention in section 13.
Crash reports and transient IP use: legitimate interest (security and diagnostics); see section 2, Technical data.

9. Analytics and advertising

Analytics and ad personalisation are off by default — in every country — and stay off until you switch them on. On first run, before you even sign in, the app shows a privacy choices screen with equal "Reject all" and "Accept all" options; the game is exactly the same whichever you choose. On iOS, personalised ads additionally require accepting Apple's App Tracking Transparency prompt, and in the EEA/UK Google's consent flow (UMP) also applies. If you decline, you keep the full game with non-personalised ads.

You can change either choice at any time in Settings → Privacy ("Share usage analytics" and "Personalised ads"). Ad personalisation also respects your device settings — the iOS App Tracking Transparency setting, and Android's "opt out of ads personalisation" / "delete advertising ID" settings.

The app applies your choice before analytics starts — automatic collection is disabled at build level and is only enabled after you have explicitly opted in.

Analytics: Firebase Analytics events are tied to your internal account ID only — never your email or name. If you opt out again, collection stops and the analytics user ID is cleared.
Ads (free tier): the free tier is ad-supported. An occasional full-screen ad may be shown when you return to the map after a challenge you played has been resolved (capped per session, never as your first action of a session, and never blocking a guess), and you can choose to watch opt-in rewarded ads to earn pins. Ad content is restricted to a family-safe rating. Non-personalised ads still involve Google processing your IP address and coarse device data for delivery, frequency capping and fraud prevention.
Minors: Pindela requires users to be 16 or older. We do not store an age, so personalised advertising is shown only to players who confirm in the app that they are 18 or older and consent to it; if you do not confirm this, you keep non-personalised ads and are never profiled for advertising. You can withdraw at any time in Settings → Privacy, and turning personalised ads back on asks you to confirm 18+ again.
Premium removes ads entirely — the advertising SDK is not even initialised for Premium accounts.

The pindela.app website

The website has its own, separate analytics consent. A banner offers an equal allow / decline choice before anything loads; your choice is stored in your browser (not on your account) and can be changed at any time via “Analytics choice” in the site footer. Declining — or simply ignoring the banner — means Google Analytics never loads. The website choice is independent of your in-app analytics choice.

10. Your consents and how to change them

We never assume consent. Every consent in Pindela is off until you turn it on, and every choice is recorded with the version of the text you saw and a timestamp, so there is always an auditable record of what you agreed to and when.

Analytics and ad personalisation: chosen on the first-run privacy choices screen (before sign-in) and changeable any time in Settings → Privacy. Your choice — with the consent text version and time — is stored in encrypted storage on your device, and every change re-stamps the record.
"Near you" notifications: off by default. Opt in or out in the app's notification settings; opting out stops the collection and immediately wipes the stored (already coarsened) position.
Checkout consents: the express consents described in our Terms (immediate start of Premium; immediate delivery of pin packs) are shown as boxes that are never pre-ticked, and are recorded on our servers — product, consent text version, language and time — before the store payment sheet opens. They are permanently visible and exportable in Settings → Purchases & consents.
Withdrawing consent is as easy as giving it and takes effect immediately, going forward — it does not affect the lawfulness of processing that already happened.

11. Automated decision-making

Uploaded photos are screened automatically for nudity/inappropriate content. Content may be temporarily hidden by automated systems — for example while a flagged photo awaits review, or when several players report it — but every final decision (removal, strike, suspension or ban) is made by a human moderator, including when the screening tool fails (failures default to human review). Anti-cheat signals likewise flag activity for review rather than punishing automatically. Decisions on public reports and photo removal requests state whether automated means were used. We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

12. International transfers

Our own servers and photo storage are hosted with Hetzner in the EU (Germany), and our error monitoring (Sentry) uses Sentry's EU data region. Some providers (e.g. Google, Apple, RevenueCat, Expo) may process data in the United States or elsewhere. Where data leaves the EEA, we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

13. Data retention and deletion

While your account exists: account and gameplay data are kept for as long as you have an account. Specific shorter periods:

Challenge photos are deleted automatically when the challenge ends (it is solved out or its timer expires) — the post-game reveal is a map pin, not the photo. Photos that were reported are retained as moderation evidence and deleted around 90 days after the report is resolved.
Exact challenge coordinates are kept as long as the challenge record exists (they are the content you published). Guess coordinates are erased automatically once the challenge has been over for the retention window (currently 30 days) — from then on, only the distance in metres remains in your gameplay record, which is all that results and leaderboards need.
Your coarse "near you" position is collected only while the opt-in is on (it is off by default), overwritten each time it updates, cleared immediately when you turn "near you" notifications off, and only fixes under 14 days old are ever used.
Read notifications are purged 7 days after you read them.
Sign-in refresh tokens expire after 30 days and are stored only as hashes.

Deleting your account: you can delete your account at any time in Settings → Delete account (you confirm by retyping your email or username), or request deletion on the web at pindela.app/delete-account. Deletion is permanent and removes your profile, email, your challenges' photos (including from storage), your guesses and locations, points and leaderboard entries, enrolments, achievements, pins, notifications, devices and push tokens, blocks, appeals, and reports you filed. Challenges nobody else played are removed entirely; challenges other players played are kept in anonymised form (see below) so those players keep the points they earned.

Important: deleting your Pindela account does not cancel an active subscription — cancel it first in the store: on iOS, Settings → [your name] → Subscriptions; on Android, Google Play → your profile → Payments & subscriptions → Subscriptions.

What we keep after deletion, and why:

Purchase and tax records — retained for at least 5 years, as required by the Latvian Accounting Law, no longer linked to a Pindela profile; these records may still contain your former account identifier inside the stored purchase events. (Legal obligation.)
Checkout consent and withdrawal records — the record of the express consents you gave at checkout and any withdrawal statements survives deletion with the reference to your account removed, because it remains necessary as evidence of those consents and statements and for legal claims. (GDPR Art. 17(3)(e).)
Moderation audit records — retained for up to 5 years after deletion in pseudonymised form: they are no longer linked to an account, but may still reference your former username or details of the moderated content, so we can keep the platform safe and defend legal claims. (Legitimate interests.)
Public request records (pindela.app/report and photo removal) are not tied to a Pindela account; they are kept for the duration of the proceeding, as described in section 7.
Anonymised challenge records — a challenge that other players played survives with your identity removed and its photo deleted, so those players keep the points and placements they earned on it; only the challenge's spot and gameplay results remain, no longer linked to you in any way. (Anonymisation — the record is no longer personal data.)
Backups — deleted data leaves our rolling backups within 30–90 days.
Invites you received. If you were invited by another player, the record of that invite stays on their account — it is what evidences the reward they earned — but every reference to you is removed, so it no longer contains your personal data. Invites you made are deleted with your account.

Note for Apple users: deleting your Pindela account removes your data from our systems; you can additionally revoke Pindela's access in your Apple ID settings ("Sign in with Apple").

14. Children

Pindela is for people aged 16 and over. The game involves precise location and travelling to real-world places, so we do not permit younger users. We do not collect a date of birth or store an age; personalised advertising is shown only to players who confirm in the app that they are 18 or older (section 9). We do not knowingly collect data from anyone under 16 — if we learn that we have, we will delete the account and its data. If you believe a child under 16 is using Pindela, contact us at Show email address….

15. Your rights

Under the GDPR you have the right to:

Access your data and receive a copy;
Rectification of inaccurate data;
Erasure ("right to be forgotten") — see section 13 for the built-in deletion paths;
Restriction of processing;
Data portability (a machine-readable copy of data you provided);
Object to processing based on legitimate interests — including objecting to a photo you appear in (section 5);
Withdraw consent at any time (analytics, personalised ads, "near you" notifications) — this does not affect the lawfulness of processing carried out before your withdrawal, and we will stop the consent-based processing going forward.

To exercise any right, use the in-app tools where available or email Show email address…. Your purchase and consent record is exportable directly in the app (Settings → Purchases & consents). We respond within one month (extendable by two months for complex requests, in which case we will tell you). We may need to verify that a request comes from the account holder.

You also have the right to lodge a complaint with a supervisory authority — in Latvia, the Datu valsts inspekcija (Data State Inspectorate), www.dvi.gov.lv — or with the data protection authority of the EU/EEA country where you live. For consumer disputes about purchases or the service, you can contact the Consumer Rights Protection Centre (PTAC), www.ptac.gov.lv.

If you disagree with a content moderation decision affecting you, you will receive a statement of reasons, and you can complain free of charge — suspensions and bans directly from the in-app lockout screen, and any moderation decision (including reports we declined to act on) via pindela.app/report or Show email address… within 6 months. Full details are in our Terms of Service.

16. Changes to this policy

We may update this policy as Pindela evolves or the law changes. For material changes we will notify you in the app in advance and update the version and effective date above. Where a change involves processing that requires your consent, we will ask for that consent before the change applies to you — continued use alone is never treated as consent. If you do not agree with a change, you can delete your account at any time.

17. Contact

SIA "D & L SERVISS" (Pindela, a Woodrock Solutions product) Rūpniecības iela 25–33, Rīga, LV-1045, Latvia Reg. No. 50103412361 · VAT LV50103412361 Email: Show email address…

Please contact us first with any privacy question or complaint — we will do our best to resolve it directly.

Privacy Policy

1. Who we are and what this policy covers

2. Information we collect

Account information

Invites

Precise location — the heart of the game

Photos you post

Gameplay data

Device and push notification data

Subscription and purchase data

Moderation and safety data

Public request forms

Technical data

The pindela.app website

3. How we use your information

4. What other players can see

5. If you appear in a Pindela photo

6. Legal bases (GDPR)

7. Processing at a glance: purpose, legal basis, retention

Account data

Challenge spot (precise location)

Guess position (precise location)

"Near you" presence (coarse location)

Photos

Analytics events

Advertising data

Purchase records, checkout consents and withdrawal statements

Public request forms (report / photo removal)

Invites and referral rewards

Everything else

8. Who we share your information with

9. Analytics and advertising

The pindela.app website

10. Your consents and how to change them

11. Automated decision-making

12. International transfers

13. Data retention and deletion

14. Children

15. Your rights

16. Changes to this policy

17. Contact