Privacy policy

Our Core Privacy Promise: On-Device Processing

Your notifications stay on your device. Notification content is never uploaded.

Pingfold uses Android Notification Access to see incoming notifications and apply the delivery choices you configure, including Immediate delivery, scheduled Digests, blocking, custom exception rules, Focus sessions, and Profiles.

Captured notification titles, messages, bodies, sender names, and verification codes stay on your device. Pingfold does not upload your captured notification content or history to its services, telemetry, cloud synchronization, or system backups. Optional settings exports described below are separate from notification history.

• Recent Content & search: Pingfold can keep recent notification titles and messages locally in app-private storage so you can review recent alerts, search your history, and build precise exception rules. Recent Content is excluded from device backup, can be disabled and deleted from Settings at any time, and offers a user-selectable retention window of 1, 7, or 30 days (defaulting to 30 days).
• Structural notification history: Pingfold stores structural metadata (such as delivery disposition, timestamps, and rule matches) in a private local database to power your Activity windows, Inbox, and Noise Insights. This structural history contains routing information rather than notification text and supports retention options of 7 days, 30 days, 90 days, or keep-until-deleted. Clearing structural history automatically removes linked Recent Content. In version 1.1.0, turning off an app's Keep local previews control also removes its saved Recent Content and Digest titles/snippets. Content-free routing history and app choices remain; re-enabling previews applies only to future notifications.
• Digest previews: Queued notifications and delivery previews are stored in a separate, bounded local store (queued previews remain up to 72 hours and delivered previews up to 24 hours). You can clear Digest previews at any time via the Clear Digest control in Settings.
• Backup and device transfer disabled: Android cloud backups (Google Drive backup) and device-to-device transfers are explicitly disabled in Pingfold's manifest. App-owned data and notification history are never included in system backups.

Information We Process and Collect

Pingfold is designed with strict data minimization. We process and collect only the data necessary to provide notification management, maintain stability, and support optional features:

• Notification data (local only): notification titles, messages, sender names, package names, channels, timestamps, and delivery decisions. Processed in real time on-device and stored solely in local app-private storage. Never uploaded.
• App configuration & rules (local only): your per-app preferences (Immediate, Digest, Block), exception rules, phrase matchers, schedules, Focus sessions, and saved Profiles. These stay in app-private storage unless you choose to export settings.
• Settings export and import (optional PRO feature): you can save a settings file through Android's file picker. It can contain app package names, exception names and match phrases, channel IDs, ordered Profile definitions and schedules, Digest settings, appearance, and theme. It does not contain captured notification history, titles or bodies, purchase credentials, app-lock secrets, or analytics and crash-diagnostics choices. The file is not password-encrypted by Pingfold. Your chosen file provider may store or sync it outside this device. Pingfold does not upload it to our services. Import shows a review before applying settings; copies of exported files must be deleted separately from their chosen storage location.
• Usage analytics (optional, user-controlled): Usage analytics is enabled by default on a fresh install after Pingfold's fail-closed startup consent state finishes loading. You can turn it off at any time in Settings › Privacy & diagnostics. While enabled, Pingfold sends a bounded catalog of 21 privacy-limited feature-use events to Google Analytics for Firebase (such as navigating screens, creating an exception, opening Digest, requesting Google Play's in-app review flow, launching a built-in share intent, or entering the optional Supporter purchase funnel). Pingfold's custom analytics events never contain notification content, app names, exception names, rule names, notification identifiers, or user identifiers. Advertising ID collection, automatic screen reporting, and ad personalization are disabled in the manifest. Google may derive approximate (coarse) location from masked IP addresses. While collection is enabled, the Firebase SDK may also process app-instance identifiers, app lifecycle and session events, and Google Play in-app purchase metadata such as product and price. Crashlytics and related SDKs may process installation identifiers and technical session information.
• Crash diagnostics (optional, user-controlled): Crash diagnostics is enabled by default on a fresh install after Pingfold's fail-closed startup consent state finishes loading. You can turn it off independently at any time in Settings › Privacy & diagnostics. While enabled, Firebase Crashlytics sends technical crash stack traces, device metadata, OS version, and a single custom diagnostic flag (whether the notification listener was connected). Pingfold does not attach notification content, app names, exception names, or user text to crash reports. Disabling the control closes Pingfold's reporting gate and requests deletion of unsent reports. Firebase's collection setting takes full effect on the next launch. Crash reports may remain locally while collection is disabled and may be sent if you later re-enable it. Already-sent reports follow Firebase's retention and deletion controls.
• Lifetime Supporter purchase data (optional feature): if you purchase or restore the optional Lifetime Supporter / PRO tier, Google Play Billing processes the transaction. Pingfold does not collect, handle, or store credit card or payment information. Our isolated supporter service (hosted on Cloudflare) receives the Play purchase token, an obfuscated claim identifier, and session tokens to verify entitlement and prevent fraud or replay.
• Supporter security checks: versions using signed PRO receipts send an installation public-key digest and a fresh request nonce to our supporter service. The private key stays in Android Keystore. Protected versions use Google Play Integrity for purchase, Restore, and entitlement checks. Google processes app, device, and account integrity signals; our service sends the Integrity token to Google to verify those signals. The request is bound using a digest, without sending notification content, rules, app inventory, or raw purchase/session credentials in that digest. These checks are separate from the analytics and crash-diagnostics switches and do not run as a dependency of core notification control.
• Supporter display name (optional): Lifetime Supporters may optionally enter a public display name for the Founding 1,000 Supporter Roll. Publication is subject to moderation review. No real name or email is required. You can edit, unpublish, or delete your display name at any time directly in the app, removing it from the current public Supporter Roll entry.

How We Use Information

We use information solely to:

• intercept, organize, schedule, and quiet notifications according to your preferences;
• deliver scheduled Digest summaries and reminders on your device;
• display local notification history, Noise Insights, and Rule Activity on-device;
• verify, activate, and restore optional Lifetime Supporter purchases;
• display approved display names on the public Founding 1,000 Supporter Roll when explicitly published by the user;
• diagnose technical issues, investigate crashes, and improve app stability when optional diagnostics are enabled; and
• protect the supporter backend from abuse, replay attacks, and unauthorized access.

Advertising and Tracking

Pingfold does not display advertisements. Advertising ID collection, ad tracking, and ad personalization signals are disabled in the app. We do not sell, rent, or trade your personal information with data brokers or third-party advertisers.

Device Permissions

Pingfold requests only the permissions necessary to operate:

• Notification Access (BIND_NOTIFICATION_LISTENER_SERVICE): Required for Pingfold's core purpose—inspecting incoming notifications to organize, schedule, or block them according to your preferences. All notification content remains on your device.
• Post Notifications (POST_NOTIFICATIONS): Required on Android 13 and newer to deliver scheduled Digest summaries, reminders, and service health alerts.
• Schedule Recovery after Restart (RECEIVE_BOOT_COMPLETED): Used to rearm Digest and other scheduled actions when the device restarts. Digest delivery uses inexact Android alarms and may occur after the selected time due to platform scheduling or power management.
• Internet & Network State (INTERNET, ACCESS_NETWORK_STATE): Used by the approved Firebase libraries for optional telemetry (when enabled) and by the optional Lifetime Supporter verification service. Network-state access reports connectivity state to those networking components; it does not grant notification-content access. Core notification management functions completely without internet access.
• Background Work (WAKE_LOCK): Contributed by approved libraries so bounded background service work can complete when needed. It does not grant access to notification content or bypass Android's background scheduling limits.
• App Lock (USE_BIOMETRIC): Used only when you enable the optional free app lock, so Android can authenticate with supported biometrics or device credentials. Pingfold does not receive or store biometric data.
• In-App Purchases (BILLING): Required by Google Play Billing to process the optional Lifetime Supporter purchase.

Pingfold does not request access to your contacts, precise location, camera, microphone, photos, media storage, phone calls, SMS messages, or Accessibility Services.

Third-Party Services

Pingfold integrates with a limited number of third-party services:

• Google Play Services and Play Integrity: for app distribution, updates, in-app purchase processing, and app/device/account integrity checks on protected supporter requests.
• Google Analytics for Firebase: for privacy-limited usage analytics (optional, user-controlled in Settings).
• Firebase Crashlytics, Installations, and Sessions: for crash diagnostics and stability metrics (optional, user-controlled in Settings).
• Cloudflare Infrastructure: hosts the isolated supporter verification backend and database for Lifetime Supporter verification and the Founding 1,000 Supporter Roll.

These providers process data according to their own privacy policies and terms of service.

Data Storage and Security

Notification content, structural history, and app preferences are stored in app-private databases and settings storage on your device. Android cloud backups and device-to-device transfers are disabled. Optional settings exports are separate files chosen by you and do not include notification history or captured message content.

All network communication for approved telemetry, Google Play, and supporter services uses encrypted HTTPS/TLS transport. Beginning with version 1.1.0/code 11, protected versions also encrypt PRO claim, refresh, and recovery requests and responses at the application layer and verify separately signed server receipts. Older supported versions may use HTTPS without this additional exchange layer. Session credentials are protected on the device using Android Keystore; server sessions expire after 30 days and can be renewed through verified purchase recovery. This is a session lifetime, not a guarantee that all server records are deleted after 30 days. Notification processing remains isolated from network code.

Data Retention and User Controls

You can manage local data and optional collection in Pingfold. Server-side purchase and security records have the retention limits described below.

• Notification Content & History: You can adjust Recent Content retention (1, 7, or 30 days) and structural history retention (7, 30, 90 days, or keep until deleted), or clear them immediately via Settings.
• Rules & Profiles: You can edit, pause, or delete exception rules, reset app modes, and delete saved Profiles at any time.
• Analytics & Crash Diagnostics: Both controls default to on for a fresh install after fail-closed startup resolution. You can independently toggle Usage analytics and Crash diagnostics off in Settings › Privacy & diagnostics. Disabling analytics invokes resetAnalyticsData(). Disabling crash diagnostics closes the reporting gate and requests deletion of unsent local reports.
• Supporter Profile & Anonymization: Lifetime Supporters can edit, unpublish, or delete their stored display name at any time directly from the Supporter Profile screen in the app. Deleting the display name clears the current profile and removes it from the current public Supporter Roll view without a manual request. Earlier public name updates may remain in bounded roll-change history until that history is compacted. Deleting your stored name also clears earlier profile-response payloads from the live database. Other profile responses stop being reused for retries after seven days; scheduled maintenance clears expired payloads. Minimal request keys, hashes, ownership markers and timestamps remain to reject stale retries. Provider logs and existing backups follow their separate retention and are not instantly erased.
• Security and service records: the supporter service keeps bounded operational outcomes and short-lived replay-prevention records. Application-encryption replay records contain random exchange IDs and timestamps, not purchase tokens or notification content. Request logs do not contain raw purchase/session/Integrity tokens, signed receipts, or decoded verdict bodies. Infrastructure providers may process connection metadata such as IP addresses. Provider logs and backups follow their configured retention; these are not instantly erased by clearing the app or removing a display name.
• Local Data Deletion: You can delete all local data at any time by clearing app data in Android system settings (Settings › Apps › Pingfold › Storage & cache › Clear storage) or by uninstalling Pingfold.
• Supporter Ledger Records: Purchase, entitlement, and fraud-prevention records on the supporter service are retained to verify lifetime purchases, honor refunds or revocations, preserve Founding-rank integrity, and meet legal and accounting obligations.

Data Deletion and Anonymization

Because Pingfold does not require accounts, passwords, or emails to use the app, notification history and app-private configuration are removed when you clear app storage or uninstall the application. Any settings files you exported remain in your chosen storage until you delete them. Uninstalling does not cancel your Google Play purchase or delete the server records needed to verify and restore it.

Lifetime Supporters can delete or unpublish their display name directly from the Supporter Profile screen in the app. This removes the name from the current profile and current public roll entry, but earlier public name updates can remain in a bounded change history until older roll versions are compacted. The history keeps approximately the latest 50 roll versions, which does not represent a fixed number of days. Prior names in server request-replay records are not automatically erased by this action. Purchase, entitlement, and security records are retained separately.

To request deletion of other identifiable server-side data that can be deleted, or to ask what must be retained for purchase verification, accounting, fraud prevention, security, or legal reasons, contact us at studiosskookum@gmail.com.

Children's Privacy

Pingfold is not directed to children under the age of 13 (or 16 in applicable jurisdictions). We do not knowingly collect personal information from children.

Changes to This Privacy Policy

We may update this Privacy Policy as Pingfold evolves. The "Last updated" date at the top of this policy will reflect any revisions.

Contact Us

If you have questions about this Privacy Policy or data privacy in Pingfold, please contact Skookum Studios:

• Email: studiosskookum@gmail.com
• Phone: +92 303 0156789