Privacy Policy

Version 2026-09-22b. When you create a profile we record which version you agreed to. Without stating the version here, that record would be worthless, because it could no longer be established which text was meant. If something material changes, we increase the version number and ask again.

Controller

PentzStudio One, owner David Pentz — contact: contact@pentzstudio.one. Postal address: see Legal notice.

Principle

We are deliberately sparing with data: no cookies, no advertising pixels, no fingerprinting, no tracking across apps or websites. This policy covers two things at once, and they process different amounts: this website with the waiting list, and the app. What applies only to the app starts at the section „The app“.

Audience measurement

For this website we use Vercel Web Analytics to count how often which page is opened. No cookies are set and no IP addresses are stored. Vercel derives an identifying value from the incoming request, which is discarded after 24 hours, and stores for each page view the time, the page opened, the referring page, an approximate location at country, region and city level, and the operating system, browser and device type. No profile across several visits or across other websites is built from this. The results are visible to us alone. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring reach). You may object to this processing under Article 21 GDPR; an email to contact@pentzstudio.one is enough.

Waiting list

If you join the waiting list, we process your email address and the optionally chosen neighbourhood in order to notify you once Pin & Tonic launches in your region (Article 6(1)(b) GDPR — pre-contractual measure at your request). The data is transmitted to our mailbox via Resend (email delivery service). It is not passed on to third parties for advertising. You may request deletion of your entry at any time by email.

Hosting

The website is hosted by Vercel Inc. When it is accessed, technically necessary data (IP address, time, page requested, user agent) is processed in server logs (Article 6(1)(f) GDPR — operation and security of the website). Vercel may process data in the USA; EU standard contractual clauses are in place.

Fonts

Fonts are loaded via Google Fonts (Article 6(1)(f) GDPR). Your IP address may be transmitted to Google LLC (USA) in the process. Google is certified under the EU-U.S. Data Privacy Framework.

Getting in touch

If you contact us by email or by Instagram direct message (@pintonic.app), we process the data you provide in order to deal with your enquiry (Article 6(1)(b) GDPR). For Instagram, Meta's privacy policy applies in addition.

The app (iOS)

For the native app we process only what the function strictly requires. The legal basis is performance of the user agreement (Article 6(1)(b) GDPR) or your consent (point (a)), for example for location. For notifications, what is set out under „Notifications“ below applies. Account, profile, recordings, photos and messages are held by our processor Supabase in a data centre in the EU (Frankfurt). Individual functions involve further services, and for the pre-call your voice leaves our database as well. Which places those are and what each of them receives is set out in full under „Who receives data“.

• Email address — for signing in and for important notices. Never visible on your profile, never used for advertising.
• Coarse location — for the map, only an approximate cell is stored, around 600 by 700 metres, never your exact coordinates. Others see only that cell and its centre, never your actual location.
• Location during BlindCrush — one exception, and only there: when you tap “We’re both here” at the drawn meeting, we use your exact location to check two things — that you are at the drawn venue, and that both phones are next to each other. Without that check, the free month could be arranged over the phone without anyone actually meeting. For this, the location of whoever confirms first is stored temporarily. It is deleted as soon as the second person confirms, and at the latest two hours after the meeting. The second person’s location is never stored. Nobody but the check itself can read this value. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by taking part in BlindCrush and tapping “We’re both here”. If you don’t take part, none of this happens.
• Meeting places for BlindCrush — before a draw we look for public places in the area of the people who signed up, meaning a café, bar, restaurant, park or square. The search runs through the Overpass interface of OpenStreetMap, an outside service run by volunteers free of charge. What goes there is a point rounded to roughly one kilometre for that area, never your exact location and nothing about you as a person. What comes back is the name, address and position of the places found; the draw then picks the nearest one. These place details come from OpenStreetMap and are provided under the Open Database License.
• Voice recordings — your profile voice and voice messages. Anyone who sends you a request hears you, and you hear whoever you send a request to; after a match you keep hearing each other. With Plus, a signed-in member near you can listen to your profile voice by spending one of their weekly contacts; those contacts are limited, with Plus as well. Anyone you blocked, or who blocked you, does not hear you. A spoken question attached to a request is heard only by the person asked, and only while the request is open. Voice messages in chat are heard only by the two people involved. If a recording is reported, or if your phone could not check it, what is set out under „What we do not do with your voice“ applies in addition. All recordings are retrievable exclusively through short-lived, signed links. A new recording overwrites the old one.
• Pre-call (Plus) — after a match, the two of you can talk for two minutes, once per pair. What we store is the course of events, not the conversation: which match it belongs to, who asked, whether it was accepted or declined, when both were ready, when it started and ended, and who hung up. Nothing is recorded, not even „just in case“. The voice connection itself does not run through our database but through the provider LiveKit; what goes there is set out under „Who receives data“. Access is issued for that one room, for your account and for the length of the call, for audio only and with no right to record. The record of events stays as long as the match exists and goes with it, or with your account. Our internal daily report shows only how many calls took place in the current month and how many minutes they added up to, with no names.
• Daily voice answers (Airtime, Blockwalk) — voluntary, short spoken answers to a question of the day. Unlike your profile voice, these are audible to everyone who also answered that day (not only requests and matches) — that is the point of the format. Retrievable only through short-lived, signed links, and deleted in full the following day (file and database entry). A nightly run removes everything that is not from the current day — depending on when you recorded, that is between a few hours and just under two days.
• Evening plan — one tap a day on one of five buttons: drinks, going out, doing something, staying in, early night. We store your account, the date and the button you picked, and nothing else. In particular no location and nothing about your mood; we deliberately do not ask about that. Nobody can see who tapped what. All that is shown is a number, how many people are out tonight, and only from eight answers upwards, because in a small area a small number would stop being an aggregate and start being a name. A nightly run deletes everything that is not from the current day.
• Wingman testimonial (Plus) — optional: a third person invited by you can contribute a short voice recording about you through a link (without an account of their own), which is then audible on your profile. The same release rules apply as for your profile voice (requests and matches only). Setting it up is part of Plus, meaning getting the link, replacing the link and switching it on, and it is audible to others only while your Plus is running. Without Plus you expressly keep: switching it off, deleting it, listening to your own testimonial, and reviewing one that is waiting. Anyone who ends their subscription should not have to pay in order to get rid of something about themselves. You can hide it or delete it entirely at any time; the invitation always comes from you — the recording never comes about unasked.
• Couple stories — once you have both confirmed a date, you can record twenty seconds together about how it went. We store the recording, which match it belongs to, who recorded it, and when each consent was given or withdrawn. It only becomes audible once both of you have agreed. There are two separate consents: audible inside the app to all signed-in members, and additionally usable outside it, meaning on our website or in our social channels. The second exists only together with the first; without it the recording never leaves the app. Either side alone can withdraw at any time, without giving reasons, either just the use outside the app or all of it, and still long after the match has ended. A full withdrawal is final: the file is deleted, and no new recording can be made for that match. One limit we state plainly: what was already published outside the app we take down on our side, but we cannot retrieve copies other people made in the meantime. The legal basis is your consent (Article 6(1)(a) GDPR), and a second, separate one for use outside the app.
• Photos — these only exist once both sides have confirmed a date (reveal). Before that there are none. You take the photo at that moment with the camera or choose one from your library. Both happen only when you tap: we do not access the camera or the library in the background, and we see nothing of your library except the picture you pick yourself. Only the person you met gets to see it.
• Who you are looking for — your entry for "I am" and "I want to meet". Your sexual orientation can be inferred from this. See the section "Information that is specially protected".
• Wishes — once a week you can write us a short text about what you feel the app is missing, between five and five hundred characters. We store your account, the text and the time. There is no public list, no voting and no comments; other members see none of it. The text goes into our internal daily report, an email to our own mailbox, sent via Resend. That email contains the text and a short identifier, not your name and not your email address. If we build what you asked for, we give you a free month of Plus; for that we record that this wish has been dealt with. Your wish stays stored for as long as your account exists.
• Developer hour — every now and then we announce an event where you can write to the developer directly until he closes it. We store your account, your text (five hundred characters at most) and the time. Your message is seen by the developer alone, and his reply by you alone. Other participants see neither your message nor the fact that you are there. He sees which account wrote, and nothing beyond that. After the event ends the messages are deleted. One exception, and we name it: anything left unanswered we first carry over as a wish, so that a suggestion is not lost merely because someone did not get their turn. From then on the same applies to it as to a wish.
• What’s coming up — the overview of when Airtime, Blockwalk and BlindCrush happen is worked out by your phone from fixed times. Nothing is sent to us for it, nothing extra is stored, and nothing about you is evaluated. We still list it here so that this policy names everything the app shows.
• Someone you trust — you can save a phone number so you can send a short message before and after a date. That number never leaves your device. It sits only in the settings of your phone; we do not store it and we never see it. Nor does the app send the message: you send it yourself from your own messaging app. If you choose „I’m here“, the message contains a map link with your exact location; that too goes only to the number you entered, and not to us.
• Notifications — only if you allow them in your phone’s prompt. We notify you of events that concern you: a new request, an answer to your spoken question, a match, a new message, a request for a pre-call and its acceptance, a wish we have built, and the result of a BlindCrush you take part in. Members with a moderation role are also told about new reports. In addition we announce three formats: Airtime and Blockwalk, as long as you are visible on the map and have not answered that day, and BlindCrush one hour before it starts. A notification can contain another person’s alias, for example who wrote to you, who you matched with, or who was drawn at BlindCrush. A notification never contains the content of a message.
  For this we store a device token for your phone in our database. It comes into being only after you have agreed in your phone’s prompt.
  Legal bases: for storing the token on your device and accessing it, Section 25(2) no. 2 TDDDG, because without it the notifications you switched on cannot technically be delivered. For notifications about events that concern you, performance of the user agreement (Article 6(1)(b) GDPR). For the announcements, our legitimate interest in you not missing formats that take place only at a particular time (Article 6(1)(f) GDPR). You may object to these announcements at any time under Article 21 GDPR; an email to contact@pentzstudio.one is enough, and you will not receive them any more.
  You can switch notifications off at any time in your phone’s settings. When you sign out and when you delete your account, we delete the token from our database. Notifications reach an iPhone through Apple, see „Who receives data“. Without this service there are technically no notifications on the iPhone.
• Usage events — we count how often which function is used, for example how often the map was opened or a request accepted. No identifier is stored with these counts, neither yours nor anyone else’s: a row holds only the name of the event, the time, and for a few events a location reference which, at four geohash characters, is roughly twenty kilometres coarse, so considerably coarser than the cell on the map. No content is in there: no text, no recording, and not who you sent a request to. A count therefore cannot be attributed to a person, not even by us. We need it to find faults and to see whether a function is used at all. It is deleted after 90 days.

Who receives data

This is the complete list. Apart from these, nothing from the app goes anywhere, and nobody passes anything on for advertising.

• Supabase — our processor for the database, sign-in, file storage and server functions. Account, profile, recordings, photos, messages and the entries described above are held here. The project sits in a data centre in the EU (Frankfurt).
• Cloudflare — our processor Supabase in turn uses Cloudflare, Inc as a subprocessor to run its infrastructure (listed on Supabase's subprocessor list under "Provision of hosting services"). Cloudflare sits technically in front of Supabase's services: when a connection is made to account, profile, file storage and server functions, your IP address and the technical request data needed to establish the connection go there before the request reaches Supabase. Cloudflare, Inc is based in the USA. Cloudflare has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework; should that certification lapse or become invalid, Cloudflare states it relies on EU standard contractual clauses instead.
• LiveKit — the voice connection for the pre-call, run as LiveKit Cloud. For the duration of the call, your voice, a room identifier derived from the match, your account identifier and the connection data a live connection technically needs, including your IP address, go there. We record nothing, and access is issued with no right to record. The legal basis is performance of the user agreement (Article 6(1)(b) GDPR): without that connection there is no pre-call. If you never have one, nothing goes there.
• Resend — our email delivery, in the EU, Ireland region. It carries the sign-in code to your email address, the confirmation of a waiting list entry, and our internal daily report to our own mailbox.
• Apple — notifications to an iPhone run through the Apple Push Notification service. The device token and the title and text of the notification go there, including another person’s alias where applicable. If your iPhone cannot be reached, Apple keeps a notification for 24 hours at most; we set this limit on every notification. Under its developer terms, Apple may collect technical information about the use of the service in order to improve it. According to those terms, Apple looks at the content of a notification only in exceptional cases, for example because of a legal obligation or to fend off misuse. Apple Inc. is based in the USA. According to Apple, it bases transfers of personal data from the European Economic Area on the European Commission’s standard contractual clauses.
• OpenStreetMap, Overpass — the place search for BlindCrush meeting points, see above. A rounded point for an area goes there, and nothing about you as a person.
• Vercel — operation of this website including audience measurement, see the Hosting and Audience measurement sections. The app itself sends nothing to Vercel. If you open one of our web pages from inside the app, such as this policy or the Wingman link, the Hosting section applies to that request.

Protection against misuse

Separately from the counting above we keep a second, short trail, and this one is not anonymous. We say so openly here, because a brake without an identifier could not slow anyone down.

Three things are recorded, each with your account identifier and the time: that the map was queried, that a profile was viewed, and that someone queried the map unusually often in a short period. For the last one we also record how many queries there were within the hour, how large the queried area was, and which coarse region it covered. No content is ever in there, and neither is who was viewed.

What for: so that nobody can comb the map systematically and collect the whereabouts of other people. Above a certain number of queries per hour a brake applies, and where behaviour stands out, a person here takes a look. The legal basis is our legitimate interest, and that of every other member, in an app where you are not spied on (Article 6(1)(f) GDPR). You may object under Article 21 GDPR; we will then weigh your reasons against the protection of everyone else.

Retention: 30 days. How that number is arrived at, so you can follow it: the look a person here can take at behaviour that stands out reaches back 30 days at most. Keeping it for less would mean that look falls on periods for which nothing is left. Keeping it for longer would be a stockpile without a purpose. If you delete your account, this trail disappears immediately and in full.

What we do not do with your voice

At Pin & Tonic the voice is the profile. So we say explicitly what does not happen to your recordings. We store them and play them to the people allowed to hear them. We build no voiceprints, run no speaker recognition, and no automatic estimate of mood, age, origin or gender. We do not listen to your recordings routinely. There are two exceptions, and we name both.

First, a report. It is not only a profile that can be reported but every single recording someone gets to hear: your profile voice, an answer in Airtime or Blockwalk, a couple story, a voice message from a chat, a spoken question attached to a request, the answer to it, and a Wingman testimonial. Only someone who actually heard the recording can report it. Once a report has come in, a person here listens to that recording in order to judge whether it stays. The permission covers only the reported recording and only while the report is open; it is not a licence to listen to whatever else of yours is there. The legal basis is our legitimate interest in an app without abuse (Article 6(1)(f) GDPR) together with the app store operators’ requirement to act on reported content within 24 hours.

Second, a recording your phone could not check. In that case a person here listens to it before it becomes audible to others. Why anything is checked at all is explained in the next paragraph.

And then there is the check on your device. Before a recording is uploaded from the app, your phone converts it into text and compares that text against a list of forbidden words. This happens entirely on your device. The text is not stored, not transmitted to us, and discarded after the comparison. We never see it, and the recording itself is not given to any third party for this. We do this because the app store operators require a method for filtering user generated content. We point this out when you create your profile. The legal basis is the user contract (Article 6(1)(b) GDPR); no consent is required for it, and none is obtained. If your phone finds nothing forbidden, the recording is uploaded. If it finds a forbidden word, it is not. If your phone cannot check — because you denied permission for speech recognition, because no speech model is present on the device, or because the recording was too quiet — it is either not uploaded or listened to by a person here before publication.

A Wingman testimonial is recorded by another person in a browser, not by you in the app. It is therefore not checked there but on your phone, when you listen to it. Until you release it, nobody hears it but you.

Biometric data under Article 4(14) GDPR only arises when features are derived through specific technical processing in order to uniquely identify a person. That is precisely what we do not do. Your recordings are therefore personal data, but not a special category under Article 9 GDPR. The legal basis is the user contract (Article 6(1)(b) GDPR): without a voice there is no profile here. Should we ever introduce technical analysis of voices, for instance to detect fake accounts, we will ask you separately and explicitly beforehand. Without your yes, what is written here stands.

What you say is up to you. The app does not ask about health, belief, political opinion or origin. Keep in mind that people who know you can recognise you by your voice. You are blind to strangers, not to acquaintances.

We do not track across apps or websites, we use no advertising SDK, and we pass on no data for advertising purposes.

Information that is specially protected

Pin & Tonic asks who you would like to meet. Your sexual orientation can be derived from that entry, which makes it a special category of personal data under Article 9(1) GDPR. The Court of Justice of the European Union has held that it is enough for such information to be capable of being inferred indirectly — it does not matter whether you state it expressly.

We may process such data only with your explicit consent (Article 9(2)(a) GDPR). We obtain it when you create your profile: the sentence you agree to there names exactly this. Without that consent no profile is created, and without a profile you are visible to nobody.

We record which version of this policy you agreed to, and when. Article 7(1) GDPR requires this, and it is also in your interest: if something material changes, we can see whom we have to ask again.

You may withdraw your consent at any time (Article 7(3) GDPR), without giving reasons and without disadvantage. Withdrawal takes effect for the future; what was lawfully processed until then is unaffected. In practice you withdraw by deleting your account in the app — that removes this information as well. An email to contact@pentzstudio.one is equally sufficient.

How long we keep things

• Profile, voice, Wingman testimonial — as long as your account exists. When the account is deleted they disappear, including the files themselves and not only the entries pointing to them.
• Voice messages and chats — as long as the match exists. If either side deletes their account, they disappear for both.
• Pre-call — the record of events, as long as the match exists. The conversation itself is not stored, so there is nothing to keep.
• Evening plan — until the following day. A nightly run deletes everything that is not from the current day.
• Couple story — as long as both consents stand. If either side withdraws in full, the file is deleted too.
• Wishes — as long as your account exists.
• Developer hour messages — until shortly after the event ends. If one went unanswered, its text is kept as a wish.
• Usage events — 90 days, then deleted automatically.
• Trail for protection against misuse — 30 days, then deleted automatically, and immediately when you delete your account.
• Daily voice answers (Airtime, Blockwalk) — until the following day. A nightly run deletes everything that is not from the current day.
• Photos — as long as your account exists; they only come into being after a date confirmed by both sides anyway.
• Location cell — as long as you are visible, at most seven days. After that you disappear from the map without having to do anything.
• Waiting list — until you are invited, or until you object.
• Record of your consent — as long as your account exists, because otherwise we could not demonstrate that it was given.
• Device token for notifications — until you sign out or delete your account.
• Notifications at Apple — 24 hours at most, and only while your iPhone cannot be reached. After that the service discards them.
• Server logs at the host — a few days, to fend off technical attacks.

Minimum age

Pin & Tonic is 18+. When a profile is created, the date of birth is requested and checked; a date of birth less than 18 years ago does not produce a profile. We do not knowingly process data of minors. If we learn of such an account, we delete it.

Deletion. You can delete your account at any time directly in the app (Settings → "Delete account"). This removes profile, voice, photos, chats, matches, any Wingman testimonial, a couple story, your wishes and the trail for protection against misuse entirely. Daily voice answers (Airtime, Blockwalk) expire by the following day in any case.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Articles 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority.

Language of this policy

Pin & Tonic is offered in German and English and is advertised in those two languages only. This policy is therefore available in German and English. The German version is the original; in case of doubt about its meaning, the German wording prevails. Deutsche Fassung.