Pogpin
Open Pogpin
Last updated 5 min read

Privacy Policy

The honest, readable version of what data Pogpin touches, why we touch it, and the controls you have over it. No dark patterns, no buried clauses.

On this page

This policy explains how Pogpin (“we”, “us”, “our”) handles personal data across our website and the Pogpin product. We’ve tried to keep it in plain English; the grey boxes are the human translation of each section. If anything is unclear, just ask us.

Who we are

Pogpin is a visual-feedback tool: people drop pinned comments directly onto a live web page, and each pin captures the context a team needs to reproduce the issue. We are the data controller for the information described here. You can reach us any time at [email protected].

What we collect

We group data by why it exists, not by how scary the label sounds:

  • Account data — when you sign up: name, email, password hash, and workspace/role. Guests leaving feedback don’t need an account, so we don’t ask for one.
  • Feedback context — the heart of the product. For each pin we record the browser, operating system, screen size, page URL and the exact element you clicked, plus your comment text and any attachments you add.
  • Billing data — if you’re on a paid plan, our payment processor handles your card. We store the subscription status and invoices, never the full card number.
  • Usage & device data — basic logs, IP address and product analytics events so we can keep the lights on, fix bugs and understand what’s used.
  • Messages — anything you send us by email, the contact form or the newsletter signup.

In plain English a pin captures “what you were looking at” so “it’s broken on my screen” turns into something your team can actually reproduce — not your personal life story.

How we use it

We use data to:

  • run the core product — store, route and display your pins and comments;
  • authenticate you and keep your workspace secure;
  • process payments and send receipts;
  • provide support and reply when you write to us;
  • improve the product through aggregate, de-identified analytics;
  • send service and (if you opt in) occasional product emails.

We do not sell personal data, and we don’t use your feedback content to train third-party advertising models.

If you’re in the EEA or UK, we rely on these lawful bases:

  • Contract — to deliver the service you signed up for.
  • Legitimate interests — to secure, maintain and improve the product, balanced against your rights.
  • Consent — for marketing emails and non-essential cookies, which you can withdraw anytime.
  • Legal obligation — to meet tax, accounting and compliance duties.

Who we share it with

We share data only with vetted sub-processors who help us run Pogpin, under contracts that bind them to protect it:

  • Hosting & infrastructure — to store and serve the app.
  • Payment processing — to handle subscriptions securely.
  • Email delivery — for transactional and opt-in emails.
  • Product analytics & error monitoring — to spot and fix problems.
  • Notification channels you connect — Slack, Discord, Telegram, Microsoft Teams, Lark, Gotify, ntfy, Pushover, email and custom webhooks only receive data when you switch them on.

In plain English the only outside tools that see your data are the ones we need to run the service — and the integrations you deliberately turn on.

Cookies & analytics

We use essential cookies to keep you signed in and the app working. Website analytics run in our own CMS on Cloudflare, without analytics cookies, persistent visitor identifiers or third-party analytics scripts. We record page paths (not full query strings), referrer domains, UTM source/medium/campaign values, coarse country, browser/OS/device categories, language, screen size, foreground time and explicitly named interaction events. We do not automatically capture form contents.

To estimate daily visitors and 30-minute activity sessions, the collector temporarily processes the request IP address and User-Agent into keyed, daily pseudonymous identifiers. Raw IP addresses and full User-Agent strings are not stored in the analytics database. Identifiers change at UTC midnight and are not linked across days. Shared networks, ad blockers and delivery failures can make counts approximate.

Do Not Track and Global Privacy Control disable website collection. You can also use the control below; it stores only an opt-out preference in your browser, not a visitor identifier. If browser storage is blocked, the preference lasts for this tab. Where consent is required, collection can be configured to wait for consent before sending events.

Website reports cover the most recent 90 days. Older analytics records are deleted in bounded batches when an administrator opens a report; without report activity they can remain until the next cleanup. Analytics reports and exports are accessible only to authenticated CMS administrators.

How long we keep it

We keep personal data only as long as your account is active or as needed to provide the service, then delete or anonymise it. Billing records are retained as long as the law requires. Delete your workspace and we remove the associated content on a rolling schedule, save for backups that age out.

Your rights

Depending on where you live, you can:

  • access a copy of your data;
  • correct anything inaccurate;
  • delete your data (“right to be forgotten”);
  • export your data in a portable format;
  • object to or restrict certain processing;
  • withdraw consent at any time.

Email [email protected] and a real person will action it. We won’t make you fill out a maze of forms.

How we protect it

Data is encrypted in transit and at rest. Access is scoped by role and limited to the people who need it to operate the service. No system is perfect, but we treat your data the way we’d want ours treated — and we’ll tell you promptly if something ever goes wrong.

International transfers

We may process data in countries other than yours. When we move personal data out of the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses.

Children

Pogpin isn’t built for children. We don’t knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and we’ll remove it.

Changes to this policy

If we make a meaningful change, we’ll update the date at the top and, for significant updates, let you know in-app or by email. Continuing to use Pogpin after a change means you accept the revised policy.

Talk to a human

Privacy questions, requests, or just a “wait, what does this mean?” — email [email protected]. We read every message.

Less explaining.More shipping.

Drop your first pin

No credit card. No account for reviewers.