Ping

1. Introduction

Ping is published by Smart Kiitös Oy (Finnish business ID 3231458-1). This policy explains what information Ping touches, where it lives, and what choices you have.

If anything is unclear, email us: [email protected]

2. What We Collect

Ping has no Smart Kiitös-operated backend that stores your check-ins, mood, photos, notes, or social graph. We don't have a database with your name in it.

What this means in practice:

• Your data lives on your iPhone (local) and in your own iCloud (synced).
• We cannot read your check-ins, even if we wanted to.
• We cannot recover lost data — if you sign out of iCloud and delete the app, your data is gone.

The one path that sends data outside your device + iCloud is the Report flow (see Section 6). That flow uses your default Mail app to email our support address. Apart from that, only the anonymous usage counts in Section 7 leave the device, and you can switch them off. If you create a family web page, the summary described in Section 8 is published for the people you send the link to.

3. What's Stored Locally

Ping uses SwiftData inside an App Group container on your device to store:

• Your name and emoji avatar (you provided)
• Your check-in window settings (start hour, end hour, active days)
• Your check-in history (mood, optional note, optional photo, timestamp)
• Your friend list metadata (display names from CKShare invites, friendship streak counts, last-nudge timestamps)
• Your emergency contact list (name, phone, relationship, escalation timing)

This data stays on your device. The app does not send it to any server we operate.

4. What's Synced Between You and Friends (via CKShare)

When you add a friend in Ping, the app creates a CloudKit Share (CKShare) under your own iCloud account. Your check-ins are written into that shared CloudKit zone. Your friends' devices read from that zone using their own iCloud credentials.

Important properties of this design:

• Data is stored on Apple's iCloud infrastructure, governed by Apple's privacy policy. We do not see it.
• Only CKShare participants (people you explicitly invited) can read your shared check-ins.
• CKShare invitations carry your display name and emoji so participants know who is sharing with them. We do not read your iOS Contacts to populate this.
• Photos in your check-ins are stored as CloudKit assets in the shared zone. They are accessible to share participants only.

When you remove a friend (long-press a friend card → "Block & remove"), Ping calls CKShare.removeParticipant. The friend's device loses read access; their existing local copies of past check-ins remain on their device unless they delete them.

5. Subscription Data

Ping Pro purchases run through Apple StoreKit. We never see your Apple ID, payment method, billing address, or any payment details. Apple sends Ping a receipt token; we use it only to verify locally that the subscription is active.

Apple's privacy policy applies to subscription data: apple.com/legal/privacy.

6. Report Flow (the only path that emails out)

If you report a friend for abusive content (long-press friend → "Report"), Ping opens your default Mail app with a prefilled message to [email protected]. The email body contains:

• The reason you selected (Spam / Harassment / Sexual / Hate / Other)
• The reported friend's CloudKit record ID (an opaque identifier — not the friend's name)
• Your own user ID (so we can match the report to the share relationship)
• App version, iOS version, device model, and timestamp (so we can debug)

The email does not include the friend's name, your name, or any check-in content. We respond to reports within 24 hours per the Terms of Service.

If your device has no Mail account configured, Ping shows an alert with a "Copy support email" action so you can email us another way.

7. Anonymous Usage Counts

Your device keeps simple counters of feature events for each day. After a day is over, it uploads one summary record for that day to Apple’s iCloud (CloudKit) servers, into a public CloudKit database belonging to Smart Kiitös. No third-party service is involved, and no servers of ours.

What the record contains — and nothing else:

• Which app it comes from, and the date
• Your app version
• Your device’s region setting — the country chosen in system settings, not your location
• Whether you have Pro or not
• A coarse “days since install” bucket: 0, 1–6, 7–29, 30+, or “existing user”
• Counts of in-app events: which screens were opened, which features were used (for example a check-in, a nudge, an invite sent, a friend added), which multi-step flows were started or completed, which errors were shown, when the upgrade screen was shown or closed, and purchases

What it never contains:

• Anything you create or enter — your name, mood, notes, photos, friends’ names, emergency contacts or phone numbers
• Your email or Apple ID
• Any device identifier or advertising identifier
• Your location

Apple’s servers attach an opaque random identifier to each record. We do not read it, and we cannot link records to a person or to each other across days.

The counts are not linked to your identity, not used for tracking, not shared with or sold to anyone, and not used for advertising. Their only purpose is understanding which features are used so we can improve the app. In the App Store privacy label they are declared as Usage Data › Product Interaction, used for Analytics, not linked to you, not used for tracking.

Your control: it is on by default for everyone, including installations from before version 1.0.5. Turning it off stops uploads and deletes any counts not yet sent.

8. Family Web Page (optional)

If you create a family web page (Me → Family Web Page), people without the app can open a link to see whether you checked in today and send you a hug. Ping copies what the page needs into a record in a public iCloud (CloudKit) database belonging to Smart Kiitös, under a random address nobody can guess:

• your name and emoji
• your check-in window, check-in days and time zone
• the mood and time of your check-ins in the last 8 days, and when you last checked in

Anyone who has the link can see this and send you a hug by entering a first name. That name and the time are stored in the same database, and your iPhone shows them as a hug notification. Notes, photos, friends and emergency contacts are never included. The page is served by Cloudflare, which passes its requests on to iCloud. We keep no log of who opens the page.

When you stop the link, its record is deleted and the page shows that the link has ended. Nothing about you can be seen through it after that.

9. Notifications and the Safety Net

Push service. So that a friend's nudge, hug or safety alert reaches you right away, even when Ping is closed, Ping registers your phone's push token with our push service (push.smartkiitos.com, on Cloudflare). It keeps the token, a random address, which app it belongs to and when it was last updated. Nothing about you. Your friends' phones send pushes through it with a key only your friends get, and only Ping's fixed kinds of message (nudge, hug, safety alert, overdue activity), never free text. Each kind has a daily limit.

Safety net. If you link an emergency contact to a Ping friend, Ping also tells our server your check-in schedule, so a missed check-in still reaches that friend when your phone is dead, off or lost. The server keeps a random id, your name, your time zone, your check-in window and days, the contact's delay, when you last checked in, and the push keys of the friends to notify. Never notes, moods, photos or phone numbers. You can turn it off in Check-in & Safety Net; turning it off or removing your linked contacts deletes it from the server. If the app doesn't contact the server for three alert days in a row, it stops alerting.

10. What We Don't Do

Ping does not:

• Run a third-party analytics SDK (no Firebase, Mixpanel, Amplitude, etc.)
• Show advertisements
• Use third-party advertising or tracking SDKs (no AppsFlyer, Adjust, Branch, etc.)
• Read your iOS Contacts (we use CKShare metadata only for friend names)
• Read your location or use GPS
• Read your full Photo Library (PhotosUI shows the picker; only the photo you select enters the app)
• Read your microphone, calendar, or other system data
• Sell, rent, or share your data with third parties

The App Store privacy "nutrition label" for Ping reflects this: minimal data linked to you, no data used for tracking.

11. Children

Ping is not intended for children under 13. Some regions require a higher minimum age. We do not knowingly collect personal data from children under 13.

If you believe a child under 13 is using Ping, contact [email protected] and we will help remove the account. Apple's Family Sharing and parental controls are the proper tools for managing children's app access.

12. Data Retention & Deletion

Your data is retained as long as it lives in your iCloud and on your device.

To delete your local data

Delete the Ping app from your iPhone. Local SwiftData and the App Group container are removed by iOS.

To remove yourself from shared data

Open each CKShare you participate in (under iOS Settings → [Your Apple ID] → iCloud → Manage Storage → CloudKit, or directly from inside Ping by removing each friend) and remove yourself.

Friends you previously shared with retain their local copies of your past check-ins until they delete the app or remove the share on their end. We cannot reach into another user's iCloud to delete your past check-ins.

To delete iCloud-stored data entirely

Sign out of iCloud after deleting the app, or use Settings → [Your Apple ID] → iCloud → Manage Storage to remove Ping's CloudKit data.

To stop the family web page

Open Me → Family Web Page → Stop Link. The page's record is deleted and the link shows that it has ended. To have hugs already sent through the page removed too, email us.

We don't keep server-side copies, so there's no central account for us to delete.

13. International Transfers

Ping data lives in Apple iCloud regions. Apple chooses the storage region based on your Apple ID's country setting and Apple's infrastructure decisions. Apple's data transfer practices apply.

Because Ping does not operate its own servers, no Smart Kiitös-controlled cross-border transfer happens. The family web page (Section 8), the push service and the safety net (Section 9) run on Cloudflare's global network, so a request may be handled outside your country.

14. Security

• Transport: All CloudKit traffic uses TLS by Apple's defaults.
• At rest: Data on your device is encrypted using Apple's standard on-device encryption (the iPhone's data protection class).
• Authentication: Access to shared data requires a valid iCloud account. CKShare participation is enforced by Apple's CloudKit access control.

We rely on Apple's platform security. Our only server code is small: the function behind the family web page, the push service and the safety net check (Sections 8 and 9). None of it can read your check-ins, notes or photos.

If you discover a security issue, please email [email protected]. We respond to security reports within 24 hours.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. For material changes, we'll notify you in-app on next launch.

Continued use of Ping after changes take effect means you accept the updated policy.

16. Contact

Email: [email protected]

For privacy questions, data deletion help, security reports, or any other concern. We respond within 24 hours.