Privacy

Pinbora is a map of places recommended by people you know. This page says what we collect, why, who can see it, and what you can do about it. It is written in plain English on purpose. If anything is unclear, email hello@pinbora.com.

Who we are

Pinbora is run by its founder, in New South Wales, Australia. We are responsible for your data (in European terms, the data controller). Contact: hello@pinbora.com.

What we collect

• Your account: your email address, the name you give, and a colour we assign for your initials. If you set a password, our sign-in provider stores it scrambled; we never see it.
• What you add: places (name, category, position on the map), your level for each (Been there, Recommended, Must go), the year, a note, quick notes (Book ahead, Good for kids), and tags naming friends who were with you; tips about a city; your want-to-go list and any link you saved a place from; your bucket list (the cities, countries and places you dream of going, each with a line of yours); asks you make; Worth it? questions and answers; trips you plan or join and what is on the board (ideas, plans, bookings with a reference, a cost and who paid, comments); your page (a handle, a line, a link) if you switch it on; who you follow; your circles.
• From people without an account: on an answer page, a name and pins; on a Worth it? page, a name and an answer. That browser holds a secret so the person can change what they wrote.
• Forwarded booking emails: if you forward a confirmation to your trip's address, our email provider receives it and we read out a reference, a total, dates and a name, which we keep on the board. We do not keep the email itself; the provider holds a copy for a limited period, then deleted. If it has a link to manage the booking, we keep that link for you alone: on the board only you can see or open it, never the other tripmates, never in an email, and it is deleted a week after the trip ends. The same goes for a booking link you add yourself.
• Notifications: if you turn them on for a phone or a browser, the address its push service gave it and two keys to encrypt messages for it, plus a label such as “iPhone”. Turning them off, or logging out on that phone, deletes them.
• How Pinbora is used: a log of kinds of action and timings (for example that an ask was opened, or how long adding a pin took), which never holds a place name, a note or an email address. Our hosting provider keeps ordinary server logs (your IP address and the pages requested) for its standard period.
• Cookies: only what signing in needs (your session), a short-lived cookie that remembers a link you opened before signing in, one that remembers the last city you chose on the map, so it opens there next time on that device, and one that remembers you hid the getting-started card (both are kept nowhere else, and logging out deletes them). No advertising or analytics cookies, so no cookie banner.

Why

• To run the service you asked for: your map, your friends' pins, your trips (the contract between us).
• To show your Recommended and Must go pins to the people you choose, and nobody else.
• To email you about your own activity and your friends' requests: one welcome when you join, a friend saving your pin, answers to your ask, a question about a place near where you have been, changes on a trip, a tripmate tagging you in a comment, pins a friend added for a trip you told them about, someone asking to be your friend. Every email has a link that stops that kind of email, and your pop-up has a switch for each. The same notices go to your phone only if you turned notifications on there, and follow the same switches.
• To keep Pinbora safe and to see whether it works, from counts and timings only (our legitimate interest).

We do not sell data, and there is no advertising. Public signals on Pinbora cannot be bought.

Who sees what

These rules are enforced in the database, not only on the screen.

• Friends (people who accepted each other) see your Recommended and Must go pins, your tips, your bucket list and your name. Never your Been there pins (except a friend you tagged on one), your want-to-go list (a place you also put on your bucket list shows there), your asks, your trips or your circles. Whether an entry on your bucket list is done comes from your Recommended and Must go pins, which friends see anyway; a Been there never ticks one. A friend who opens your bucket list from their map is counted, nothing more.
• People who follow you, only if you switched your page on, see the same as friends: your Recommended and Must go pins, your tips and your name. Not your Been there pins, your lists (your bucket list included), your asks or your trips. You see their names, nothing else. Switch the page off and it all disappears from their maps at once.
• Asks: only you see the answers to your ask. A friend who answers signed in makes the pin their own, visible as their pins are.
• Worth it?: only you see the answers to your question; each person who answered sees their own answer. Friends who have been near the place are emailed; you never learn who, or how many.
• Trips: everyone on a trip sees everything on that board, comments included, and the names of the other tripmates. A booking's reference, cost and who paid are the one exception: they show to the people the booking is for (who's on it, ticked on its card; a confirmation you forward starts with you) and to whoever booked it, never to the rest of the trip, the organiser included; everyone still sees that the booking exists, its dates and who is on it. Joining a trip makes you friends with its organiser and, when the organiser left “Tripmates become friends with each other” on, with the other tripmates who are in; the trip link says so before you join, and you can remove any of them under Friends. A comment can be deleted by whoever wrote it; the trip's log says who commented on what, never the words. A tripmate you tag in a comment (“@JJ”) gets its words by email, or on their phone, and keeps them even if the comment is deleted later. A booking's own manage link goes further still: only the person who booked it sees it.
• Your page, if it is on, shows to anyone who has the link your name, your line, your link and the cities you have Recommended or Must go pins in, with a count. Never a place name.
• Nobody else. There is no public browsing and no searching for people or places across accounts.
• The person who runs Pinbora can see the database as its administrator, for maintenance and support. Never through the app, and not as a matter of course.

Who helps us run it

These companies process data for us under their own terms and data processing agreements.

• Supabase: the database and sign-in, in Singapore, outside Australia.
• Vercel: hosting. The app's servers run in Singapore, next to the database; Vercel keeps the server logs.
• Resend: sends our emails, and receives booking emails forwarded to a trip's address.
• MapTiler: the map itself. Your browser fetches the map tiles directly, so MapTiler sees your IP address and the area of map on your screen.
• Komoot Photon and OpenStreetMap Nominatim: venue search and city lookup. What you type in a search box, or a position on the map, goes to them from your browser or our server, with the IP address of whichever sent it.
• Google (Google Maps Platform): place search in “+ Add a pin”, on a trip's board and on the page where friends answer an ask. When you start typing in one of those boxes (on the answer page, as soon as you tap it), your browser loads Google's search; once you pause, it sends Google the words you typed and the area round the city being searched, with your IP address. Of what Google finds, we keep only the place you pick: its Google place ID and position, or the same place's OpenStreetMap record when we find it there. Google's use is under Google's Privacy Policy.
• Wikipedia and Wikidata: what a place is. Our server asks them about a venue by the name of its article; nothing about you goes with it.
• MET Norway (the Norwegian Meteorological Institute): the weather beside a trip's days. Our server asks it for the forecast at the trip's city, rounded to about a kilometre; nothing about you goes with it.
• Your phone's push service (Google for Android and Chrome, Apple for iPhone and Safari, Mozilla for Firefox, Microsoft for Edge): delivers a notification if you turned them on. Each message is encrypted for your phone before it leaves us, so the push service cannot read it; it sees that a message was sent, and when.
• Cloudflare: our domain's name records only. No traffic passes through it.
• When you paste a Google Maps link, our server fetches that page once to read the place's name. Nothing about you goes with it beyond an ordinary page request from our server.

Where your data lives, and for how long

• Your data is stored by Supabase in Singapore, outside Australia. Wherever it is stored, we remain responsible for it under Australian privacy law. If you are in the European Union or the United Kingdom, any transfer outside your country is covered by Supabase's data processing agreement, which includes the standard contractual clauses.
• We keep your data while your account exists.
• An account that was never signed in to (a sign-in code requested at an address with a slip in it, say, and never typed) is deleted after 8 days, with the address it was made for.
• Pins given on an answer page without an account stay with the person who asked, until they remove them. The offer to keep those pins on an account of your own lasts 7 days.
• We keep no separate backups of the database, so what is deleted is gone at once.
• Our email provider keeps a copy of emails sent and received for a limited period, then deleted.

Your rights, and where the buttons are

• See and take your data: your avatar, then Your data, then Download my data. One file with everything on your account, in plain words.
• Delete your account: the same place. Everything of yours goes at once: your pins, notes, lists, asks, comments on trips, trips you organised with nobody else in, your page and its followers, your email address and your sign-in. Places your friends also pinned stay, without your name; boards you joined keep the things you added, without your name. No database backup keeps a copy.
• Correct anything: everything you added can be edited or removed in the app.
• Stop emails: the link at the foot of each email, or the switches under Emails in your pop-up.
• Ask or complain: email hello@pinbora.com. In Australia you can also complain to the Office of the Australian Information Commissioner (oaic.gov.au); in the European Union or the United Kingdom, to your local data protection authority.

Children

Pinbora is not for people under 16. If we learn that an account belongs to someone under 16, we delete it.

Security

Everything travels encrypted. Who sees what is enforced in the database itself. You sign in by an emailed link or a password. We never collect card details.

Changes

When this page changes, the date at the top changes with it. If a change matters to you, we email you about it. See also the terms.