Privacy policy

Effective 28 September 2026

You can play Pinpick without an account. Then none of your data reaches us. If you create an account, we keep only what online play needs. Non-personalized ads appear between practice and bot games; we do not track you and we do not sell your data.

Who is responsible

The data controller for the Pinpick app and its game server is Neslihan Emir, who runs Somewise. For any privacy question or request, write to hello@somewise.io.

Playing without an account

The daily vault, practice, duels against a bot and duels on the same phone work without an account. In these modes the following is stored only on your device and never sent to us:

Your nickname, level, XP and achievements
Your game history and daily vault results
Your settings (haptics, tile style) and your notebook
Your Brass balance, streak seals, the looks you bought, the past vaults you opened and a record of your purchases (product and transaction number)

You can remove them with Profile → Settings → Reset progress, or by deleting the app.

What we collect when you create an account

Account details: your email address, username, display name and password. We never store your password in plain text; we keep only an irreversible hash of it.
Sign in with Apple or Google: the user ID and email address the provider gives us. If you choose to hide your email with Sign in with Apple, we receive Apple's relay address. Apple shares your name only on the first sign in; we keep it to suggest a username and to use as your display name. We never see your password.
Game data: your online matches, the secret code you set for a match, your guesses, results, rating and league, and your night tournament results.
Social connections: your friends, the players you follow and who follow you, and the players you block.
Reports: if you report a player, the reason you choose and the note you write.
Notification token: if you turn on the vault hour alert, your phone's Apple notification token, the app language and whether you want the alert. The token is used only to send this alert, never to identify or track you. It is deleted when you turn the alert off or sign out.
Technical records: when you last opened the app, and the connection logs the server keeps for security (such as IP address and time).

Why we use it

To create your account, verify your sign in and keep your session
To run matches, pair opponents, and calculate rankings and leagues
To run friendships, follows and duel invitations
If you ask, to tell you when vault hour opens (at most one notification a day)
To prevent abuse, review reports and keep the service secure

We do not use your account data for advertising, we do not sell it, and we do not track you across other apps or websites. The app contains no analytics tools. The only third-party tool is Google AdMob, which shows the ads.

What other players see

Other players can see your username, display name, rating and league, number of matches, wins, draws and losses, and your follower and following counts. Your opponent in a match sees your guesses and, when the match ends, your secret code. Your email address is never shown to any player.

Ads appear only between practice and bot games, and when you choose one: a rewarded ad for Brass or for a hint from the Master. There are no ads in the daily vault, in duels or in the night tournament. With the No ads pack, ads between games never appear.

Non-personalized: ads are not chosen by your interests. We do not ask for Apple's tracking permission, and your device's advertising identifier (IDFA) is not used.
What Google processes: to show an ad, limit how often the same ad appears, prevent fraud and count impressions, Google may process your IP address (only for coarse location), device and operating system information, your interaction with the ad (impression, tap), identifiers Google creates for this app, and diagnostic logs of the ad tool.
Not sent to us: this data does not reach us linked to your identity, and your account details (email, username) are not sent to Google. How Google uses this data is described in Google's policy.
Consent: in the European Economic Area, the United Kingdom, Switzerland and Türkiye, we ask for your choice before the first ad. You can play even if you do not consent; ads are then shown in a limited way. You can change your choice at any time in Profile → Settings → Ad privacy.
Content: ads are limited to content suitable for a general audience.

Purchases and Brass

Apple handles payments. Your card and payment details never reach us. The product you buy and its transaction number are kept only on your device, to process and restore the purchase. Your Brass balance is also kept only on your device for now; if you delete the app, your Brass is lost. You can get permanent items (No ads, look packs) back on the same Apple account with Shop → Restore purchases.

We do not share your personal data with third parties. The only exceptions:

Infrastructure: the hosting provider of the game server stores data only on our behalf.
Apple and Google: if you sign in with them, the sign in itself is subject to their privacy policies. If you delete your account, we also revoke Sign in with Apple at Apple.
Google AdMob: the device and ad data described above under Ads, to show ads.
Apple Push Notification service: if you turned on the vault hour alert, the alert text and your phone's token go to Apple so it can deliver the alert.
Apple payments: your purchases are made through Apple and are subject to Apple's terms.
Legal obligation: if there is a lawful request from the competent authorities.

Keeping and deleting

We keep your data for as long as your account is open. You can delete your account from the app at any time: Profile → Settings → Delete my account. When you delete it:

Your account, email, friendships, follows, blocks, notification token and online matches are permanently deleted.
If you have a match in progress, you forfeit it.
Reports you made stay for review, but they are no longer linked to you.
Your level and XP on your device are not deleted; you can remove them with Reset progress. Your Brass and purchases also stay on your device.

Copies left in server backups are deleted when the backup retention period ends.

Security

All connections between the app and the server are encrypted (HTTPS). Passwords are stored as hashes. Your session key stays only on your device and is deleted when you sign out.

Children

Online accounts are for people aged 13 and over. Children under 13 can play without an account; then no data reaches us. Ads are not personalized and are limited to content suitable for a general audience. If you think a child under 13 has created an account, write to us and we will delete it.

Your rights

Under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies to you, the EU General Data Protection Regulation (GDPR), you have the right to:

Learn what data we process about you and ask for a copy
Ask us to correct inaccurate data
Ask us to delete your data (you can also do this in the app)
Object to processing and file a complaint (in Türkiye, with the Personal Data Protection Authority)

Send your request to hello@somewise.io. We reply within 30 days at the latest.

Changes

If we change this policy, we update this page and its effective date. If the change is significant, we also let you know in the app.