Privacy Policy

We collect only the essential data required to operate our timer-based safety verification system:

• Account Data: Email address, basic profile information, and authentication credentials. Our service is intended strictly for individuals aged 18 and older.
• Trip Metadata: User-defined destination labels, expected arrival deadlines, and temporary geographic coordinates submitted at trip creation.
• Trusted Contacts: Email addresses and phone numbers of the emergency contacts you designate. You act as the Data Controller for these third-party contacts and must ensure you have their consent prior to addition.
• Heir Data (Dead Switch): Securely encrypted contact details for your designated Trustee, along with optional emergency media files uploaded by Pro tier users.
• Technical Telemetry: IP addresses and basic device interaction logs required for rate-limiting, DDoS protection, and preventing unauthorized system abuse.

Our order process is conducted by our authorized online reseller and Merchant of Record (MoR). The MoR manages all transaction processing, local tax compliance, billing inquiries, and financial returns.

Ping After does not store, process, or transmit your raw credit card details or banking information. All payment data is handled directly by our MoR in strict compliance with PCI-DSS Level 1 security standards.

We implement a multi-layered defense-in-depth security architecture:

• Field-Level Encryption at Rest: Highly sensitive records, including Dead Switch Heir configurations and private notes, are encrypted at the database field level using AES-256-GCM authenticated encryption.
• Envelope Encryption: User Data Encryption Keys (DEKs) are individually wrapped using master Key Encryption Keys (KEKs) managed through secure environment variables and key management systems.
• Just-In-Time (JIT) Processing: Decrypted data exists in server RAM strictly during the momentary execution of an emergency alert dispatch and is immediately wiped from memory upon transmission.
• Network Isolation: Our databases and core backend services reside within an isolated Virtual Private Cloud (VPC) with zero public external access.

We adhere to strict data minimization principles. We do not store your data indefinitely:

• Instant Location Wipe: The exact moment you confirm safety (tapping "Arrived Safely") or cancel an active trip, your precise GPS coordinates are permanently purged (Hard Deleted) from our active databases.
• Historical Metadata: We retain brief, anonymized metadata (without precise GPS coordinates) of your last 5 trips solely to populate your personal account history dashboard.
• Heir System Package: If the background Dead Switch triggers after an extended period of inactivity, the emergency data package dispatched to your Trustee contains full details of your most recent trip along with summarized, non-precise metadata of your 2 preceding trips (totaling 3 trips of context) to assist in emergency locating efforts.
• Smart Emergency Links: Public web links generated during an active emergency alarm self-destruct automatically after exactly 48 hours, rendering the shared location data permanently inaccessible.
• Pro Media Expiry: If your Pro tier subscription lapses, any large uploaded emergency files (such as audio or video attachments) are soft-locked, then permanently deleted after 60 days of inactivity to conserve storage.

To provide reliable global service, we share limited, necessary data categories with verified enterprise sub-processors under strict contractual data protection agreements:

• Mapping & Geolocation Providers: We utilize third-party mapping APIs (such as Google Maps) within the client interface strictly to translate user-selected destination points into coordinates. These providers do not receive your continuous background location.
• Cloud Object Storage: Emergency media files uploaded by Pro users are stored in secure, S3-compatible cloud edge networks (such as Cloudflare R2) using presigned, time-limited access URLs.
• Telecommunication Gateways: When an alarm triggers, user names, destination addresses, and contact details are routed through enterprise SMS and email dispatch providers (such as Resend, Twilio, or Vonage) solely for immediate message delivery.

Ping After is a timer-based check-in application, not a background surveillance tool. We explicitly do not:

• Track, log, or query your real-time GPS location in the background while your trip is running.
• Sell, rent, or trade your personal data, trip metadata, or contact lists to advertisers or data brokers.
• Access your device microphone, camera, or local media gallery without explicit, feature-triggered user consent.

Depending on your jurisdiction (including GDPR in Europe and CCPA in California), you possess fundamental rights regarding your data:

• Right to Access & Portability: You may request an export of the personal account metadata stored on our servers.
• Right to Rectification: You can update or correct inaccurate profile and contact information directly through your account settings.
• Right to Erasure (Account Deletion): You may initiate permanent account deletion at any time from your app settings. Upon request, your account enters a 7-day grace period during which all automated alarms and scheduled trips are immediately suspended. If you do not log back in during these 7 days, your account, trip history, and associated cloud storage files are permanently and irreversibly hard-deleted from our production systems.

If you have questions, privacy inquiries, or data deletion requests regarding this Privacy Policy, please reach out to our support team: