Privacy Policy

Version 2026-08-31. When you create a profile we record which version you agreed to. Without stating the version here, that record would be worthless, because it could no longer be established which text was meant. If something material changes, we increase the version number and ask again.

Controller

PentzStudio One, owner David Pentz — contact: contact@pentzstudio.one. Postal address: see Legal notice.

Principle

This website is deliberately sparing with data: no cookies, no advertising pixels, no fingerprinting.

Audience measurement

We use Vercel Web Analytics for anonymous, aggregated counting of page views (how many visits, which page) — without cookies, without storing IP addresses, without an individual user profile. The results are visible to us alone. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring reach).

Waiting list

If you join the waiting list, we process your email address and the optionally chosen neighbourhood in order to notify you once Pin & Tonic launches in your region (Article 6(1)(b) GDPR — pre-contractual measure at your request). The data is transmitted to our mailbox via Resend (email delivery service). It is not passed on to third parties for advertising. You may request deletion of your entry at any time by email.

Hosting

The website is hosted by Vercel Inc. When it is accessed, technically necessary data (IP address, time, page requested, user agent) is processed in server logs (Article 6(1)(f) GDPR — operation and security of the website). Vercel may process data in the USA; EU standard contractual clauses are in place.

Fonts

Fonts are loaded via Google Fonts (Article 6(1)(f) GDPR). Your IP address may be transmitted to Google LLC (USA) in the process. Google is certified under the EU-U.S. Data Privacy Framework.

Getting in touch

If you contact us by email or by Instagram direct message (@pintonic.app), we process the data you provide in order to deal with your enquiry (Article 6(1)(b) GDPR). For Instagram, Meta's privacy policy applies in addition.

The app (iOS)

For the native app we process only what the function strictly requires. The legal basis is performance of the user agreement (Article 6(1)(b) GDPR) or your consent (point (a)), for example for location and notifications. All data is held by our processor Supabase in a data centre in the EU (Frankfurt).

• Email address — for signing in and for important notices. Never visible on your profile, never used for advertising.
• Coarse location — for the map, only an approximate cell (about 1 km) is stored, never your exact coordinates. Others see only this blurred cell, never your actual location.
• Location during BlindCrush — one exception, and only there: when you tap “We’re both here” at the drawn meeting, we use your exact location to check two things — that you are at the drawn venue, and that both phones are next to each other. Without that check, the free month could be arranged over the phone without anyone actually meeting. For this, the location of whoever confirms first is stored temporarily. It is deleted as soon as the second person confirms, and at the latest two hours after the meeting. The second person’s location is never stored. Nobody but the check itself can read this value. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by taking part in BlindCrush and tapping “We’re both here”. If you don’t take part, none of this happens.
• Voice recordings — your profile voice and voice messages. Anyone who sends you a request hears you, and you hear whoever you send a request to; after a match you keep hearing each other. With Plus, a signed-in member near you can listen to your profile voice by spending one of their weekly contacts; those contacts are limited, with Plus as well. Anyone you blocked, or who blocked you, does not hear you. A spoken question attached to a request is heard only by the person asked, and only while the request is open. Voice messages in chat are heard only by the two people involved. All recordings are retrievable exclusively through short-lived, signed links. A new recording overwrites the old one.
• Daily voice answers (Airtime, Blockwalk) — voluntary, short spoken answers to a question of the day. Unlike your profile voice, these are audible to everyone who also answered that day (not only requests and matches) — that is the point of the format. Retrievable only through short-lived, signed links, and deleted in full the following day (file and database entry). A nightly run removes everything that is not from the current day — depending on when you recorded, that is between a few hours and just under two days.
• Wingman testimonial — optional: a third person invited by you can contribute a short voice recording about you through a link (without an account of their own), which is then audible on your profile. The same release rules apply as for your profile voice (requests and matches only). You can hide it or delete it entirely at any time; the invitation always comes from you — the recording never comes about unasked.
• Photos — these only exist once both sides have confirmed a date (reveal). Before that there are none. You take the photo at that moment with the camera or choose one from your library. Both happen only when you tap: we do not access the camera or the library in the background, and we see nothing of your library except the picture you pick yourself. Only the person you met gets to see it.
• Who you are looking for — your entry for "I am" and "I want to meet". Your sexual orientation can be inferred from this. See the section "Information that is specially protected".
• Push token — only if you allow notifications, for alerts (for example a new request, Airtime, Blockwalk). Revocable at any time in your device settings. Delivery runs through the Apple Push Notification service; your device token is transmitted to Apple in the USA (Apple Inc., European Commission adequacy decision on the EU-U.S. Data Privacy Framework). Without this transfer there are technically no notifications on an iPhone.
• Usage events — anonymous product statistics (for example how many people became visible). Without location detail finer than the coarse cell and without being combined into a personal profile.

What we do not do with your voice

At Pin & Tonic the voice is the profile. So we say explicitly what does not happen to your recordings. We store them and play them to the people allowed to hear them. Nothing beyond that. We do not analyse the voice technically. We build no voiceprints, run no speaker or speech recognition, no transcription, and no automatic estimate of mood, age, origin or gender. We do not listen to your recordings ourselves. If a profile is reported, a person here can listen to that profile’s recordings in order to assess the report.

Biometric data under Article 4(14) GDPR only arises when features are derived through specific technical processing in order to uniquely identify a person. That is precisely what we do not do. Your recordings are therefore personal data, but not a special category under Article 9 GDPR. The legal basis is the user contract (Article 6(1)(b) GDPR): without a voice there is no profile here. Should we ever introduce technical analysis of voices, for instance to detect fake accounts, we will ask you separately and explicitly beforehand. Without your yes, what is written here stands.

What you say is up to you. The app does not ask about health, belief, political opinion or origin. Keep in mind that people who know you can recognise you by your voice. You are blind to strangers, not to acquaintances.

We do not track across apps or websites, we use no advertising SDK, and we pass on no data for advertising purposes.

Information that is specially protected

Pin & Tonic asks who you would like to meet. Your sexual orientation can be derived from that entry, which makes it a special category of personal data under Article 9(1) GDPR. The Court of Justice of the European Union has held that it is enough for such information to be capable of being inferred indirectly — it does not matter whether you state it expressly.

We may process such data only with your explicit consent (Article 9(2)(a) GDPR). We obtain it when you create your profile: the sentence you agree to there names exactly this. Without that consent no profile is created, and without a profile you are visible to nobody.

We record which version of this policy you agreed to, and when. Article 7(1) GDPR requires this, and it is also in your interest: if something material changes, we can see whom we have to ask again.

You may withdraw your consent at any time (Article 7(3) GDPR), without giving reasons and without disadvantage. Withdrawal takes effect for the future; what was lawfully processed until then is unaffected. In practice you withdraw by deleting your account in the app — that removes this information as well. An email to contact@pentzstudio.one is equally sufficient.

How long we keep things

• Profile, voice, Wingman testimonial — as long as your account exists. When the account is deleted they disappear, including the files themselves and not only the entries pointing to them.
• Voice messages and chats — as long as the match exists. If either side deletes their account, they disappear for both.
• Daily voice answers (Airtime, Blockwalk) — until the following day. A nightly run deletes everything that is not from the current day.
• Photos — as long as your account exists; they only come into being after a date confirmed by both sides anyway.
• Location cell — as long as you are visible, at most seven days. After that you disappear from the map without having to do anything.
• Waiting list — until you are invited, or until you object.
• Record of your consent — as long as your account exists, because otherwise we could not demonstrate that it was given.
• Server logs at the host — a few days, to fend off technical attacks.

Minimum age

Pin & Tonic is 18+. When a profile is created, the date of birth is requested and checked; an earlier date does not produce a profile. We do not knowingly process data of minors. If we learn of such an account, we delete it.

Deletion. You can delete your account at any time directly in the app (Settings → "Delete account"). This removes profile, voice, photos, chats, matches and any Wingman testimonial entirely. Daily voice answers (Airtime, Blockwalk) expire by the following day in any case.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Articles 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority.

Language of this policy

Pin & Tonic is offered in German and English and is advertised in those two languages only. This policy is therefore available in German and English. The German version is the original; in case of doubt about its meaning, the German wording prevails. Deutsche Fassung.