Privacy Policy

At PinShare (operated by Magic Life LLC), we value your privacy. This policy explains how we collect, use, and protect your personal information in compliance with GDPR and CCPA.

1. Information We Collect

1.1 Information You Provide

• Account information: Email, name (optional)
• Content: Pin locations, photos, notes, and gate/access codes you create. Gate codes are encrypted at rest (AES-256-GCM) and visible only to people you share the pin with, according to the pin's visibility settings
• Waitlist: Email, name (optional), referral source

1.2 Information Collected Automatically

• Anonymized IP hash: We convert your IP to an irreversible hash to prevent abuse
• Device information: Browser type, operating system (to optimize experience)
• Precise location data: A pin stores the exact coordinates of the place you mark. We collect location only when you create a pin and with your consent — we do not track your device in the background. Anyone who opens a pin's link can see that pin's location, subject to the pin's visibility settings
• Approximate country/city: Via Cloudflare geolocation for localized content

1.3 Information We Do NOT Collect

• Precise location without your explicit consent
• Payment information (handled by Stripe)
• Location history or continuous tracking
• Third-party tracking cookie data

2. How We Use Your Information

3. Cookies and Similar Technologies

We use only essential cookies required for service operation:

• Session cookies: To keep you logged in
• Language preference: To remember your preferred language

Product analytics: With your consent, we use PostHog to understand which features are used so we can improve them. If you have not chosen yet, PostHog is not loaded and captures nothing; it loads only if you accept in the cookie banner, and if you decline, it never loads. When PostHog is active, a profile is created only for identified users, such as when you are signed in.

We do NOT use: Advertising tracking cookies, third-party tracking pixels, or fingerprinting technologies.

4. Data Sharing

We do not sell your personal information. We share data only with:

• Infrastructure providers: Cloudflare (hosting, CDN)
• Payment processor: Stripe (for transactions)
• Authentication: WorkOS (for secure login)
• Analytics: PostHog (product analytics, with your consent — see Cookies and similar technologies)
• Email delivery: Resend (account and notification emails)
• SMS delivery: VoIP.ms (text messages you opt into, such as job updates)
• Authorities: When required by law

5. Data Retention

• Waitlist data: Until launch, then converted to accounts or deleted upon request
• Account data: While you maintain an active account. When you delete your account, we delete your account record, pins, photos, gate codes, saved places, business profiles, job records, credit balance and history, and sessions — see your rights in section 6
• Pins and content: Until you delete them or you delete your account
• Server logs: 30 days

6. Your Rights (GDPR/CCPA)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interest
• Non-discrimination: (CCPA) We will not discriminate if you exercise your rights

You can delete your account and all associated data yourself, without contacting us: in Settings while signed in, or — signed out — on our account deletion page, which verifies ownership through your account email. We keep the deletion-request record itself as proof the request was handled.

To exercise these rights, contact us through our contact page. We will respond within 30 days.

7. Data Security

We protect your data through:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest
• Secure passwordless authentication (WorkOS AuthKit)
• IP anonymization through hashing
• Cloudflare infrastructure with DDoS protection

8. International Transfers

Your data may be processed on servers located outside Puerto Rico. We use providers that comply with approved transfer mechanisms (SCCs, certifications).

9. Children's Privacy

PinShare is not directed to children under 16. We do not knowingly collect information from minors. If you discover that a minor has provided data, contact us to delete it.

10. Changes to This Policy

We may update this policy periodically. We will post significant changes in the application and update the "last updated" date.

11. Contact

For privacy questions or to exercise your rights:

Magic Life LLC
Contact Us
Puerto Rico

For complaints about data handling, you may contact the data protection authority in your jurisdiction.