pstpst privacy policy

Effective date: 2 November 2026

pstpst lets people invite their groups to an activity and answer Yes or No. pstpst is provided by its developer. For privacy questions or deletion requests, contact waykenstudio@outlook.com.

Platforms and availability

This policy covers pstpst on Android, iOS and iPadOS. Availability differs by platform and build. Signed iOS test builds support Apple device verification, background notifications and active-use XP. Notification permission is optional. Apple test purchases use the Sandbox environment for approved test accounts and do not charge real money; production Apple purchases remain disabled during testing. Advertising and rewarded-ad XP are enabled separately where available. The sections below explain the data processed by each enabled feature.

Information we use

• Account: email address, account ID and the display name you choose. Firebase Authentication handles your sign-in credentials; the app does not store your password in its own database.
• Groups and pings: group names, chosen emoji, selected sounds, membership, invitation codes, ping times, optional short messages, recipients and Yes/No replies. Countdown pings also store the activity's start time, which the sender and recipients can see. Premium schedules also store the creating account, group, message, selected date/time and time zone, recurrence, next run time and processing status. These support invitations, countdowns, scheduled delivery and response tracking.
• Notifications: a device identifier generated by pstpst, the push token, and personal group notification preferences, to deliver pings to phones you enable. Optional silent reply updates show a member's display name and Yes/No response to other eligible members who enable them for that group. Gift notifications show the sender's display name and gifted item to its recipient, subject to the recipient’s platform notification settings. On enabled iOS versions, Apple Push Notification service (APNs) and Firebase Cloud Messaging deliver notifications. The app associates an actual push-routing token with the signed-in account and verified device; granting notification permission is optional. A push message is a delivery hint, not authority to access an account, group or purchase.
• Safety: accepted community-rule version/time, blocked members, hidden-group preferences and private reports with account/group identifiers, relevant name snapshots, reasons and optional details, to prevent unwanted interactions and investigate abuse.
• Purchases: product IDs, Google Play purchase tokens, verification status, subscription status/expiry/renewal setting and an account binding, to unlock and restore Premium, sounds, themes or nameplates, acknowledge purchases and process renewals, expiry and revocations. Gift verification also records whether a payment is a Google Play license-test purchase, complimentary or eligible for a paid-gift XP bonus; test and complimentary gifts do not earn that bonus. Google Play handles Android payment details; Apple handles enabled App Store payment details. pstpst does not receive your payment-card number. On enabled iOS versions, we process Apple product and transaction identifiers, a randomly generated account-binding token, purchase/subscription/refund status and selected verification metadata to deliver and restore purchases. A gift intent also binds the gift product, group and recipient before Apple checkout. The purchase verifier checks Apple-signed transaction data and current Apple purchase state; its application records store selected transaction metadata rather than raw signed purchase envelopes. Sandbox and complimentary transactions do not produce a paid-gift XP bonus. Themes, sounds and nameplates are separate purchases from a Premium subscription.
• Progress: account XP, level, qualifying action types and times, daily participation and ping-award cooldowns, and references preventing duplicate awards. Successful manual pings, first replies and eligible paid gifts can add XP; refunded gifts reverse their bonus. At supported milestones, you can claim separate earned sounds, color themes or app icons. We store the reward identifier, required level, claim time and ownership source to show your inventory and check access. Earned access requires the qualifying level, so reversing a gift bonus can pause it; independently purchased or gifted items are preserved. XP and milestone rewards do not grant Premium or stronger ping delivery. Progress records do not contain passwords, message text or payment-card information.
• Active use: when activity XP is enabled, the app reports short active-use durations, a session code, sequence number and its registered device identifier to our service. We keep the latest session state, accumulated partial duration and award references to credit 5 XP per two active minutes and prevent duplicate or simultaneous credit across phones. There is no daily activity-XP cap, and Premium and free accounts earn it at the same rate. Activity counting pauses after 30 seconds without interaction, when the app is in the background or the screen is off, during ads or checkout, and during connection outages; offline time is not backfilled. Interaction detection stays on this phone: XP tracking does not upload tap coordinates, key contents, typed text, screenshots or activity in other apps. Leaving the app idle or playing automatically scheduled pings does not earn activity XP.
• App updates (Android): Google Play's in-app update service processes device metadata, this app's version and its installed modules or asset packs to check update availability and download size, and to install updates you accept. These checks follow your Google Play account's access to a release. The update service does not receive your pstpst password or ping messages from this app. Google encrypts this data, does not transfer it to third parties and deletes it after a fixed retention period.
• On your device: your age range, local demo groups, settings, account-specific theme and launcher-icon selections, and notification history markers. Your chosen launcher icon is stored on this phone. We ask for a range, not a birthday, and do not upload the age range to our backend.
• Apple device verification, when enabled: App Attest uses Apple’s service and a device-held key to verify eligible iOS app actions. Our service processes account-bound challenges, key identifiers/public keys, verification receipts, counters and request hashes. The private device key stays on the device. These records help prevent replay, token reassignment and unauthorized account actions; they do not grant purchases or XP by themselves. Signed proofs and raw purchase payloads are not deliberately written to the application’s diagnostic logs.
• Service operations: our service providers process network and device information, including IP addresses, for delivery, security and service operation. Google Play Integrity checks app recognition, signing certificates, app version, Play licensing and device integrity to help protect shared actions and purchases against modified apps and abuse. A request hash binds each check to the signed-in account and the requested action; the hash does not contain readable messages, passwords or purchase tokens. Our server verifies Google's response. Integrity tokens are used for verification and are not retained in app logs; security logs contain only outcome categories, not account identifiers or message contents. Development builds may record technical error codes for troubleshooting.

pstpst does not read your device's address book, precise location, microphone or photo library in this version. Optional iOS camera access scans invitation QR codes on the device. Camera frames are not uploaded or saved by this scanner; only the decoded invitation is used for a preview and, after your confirmation, a join request. Denying camera permission leaves copy/paste invitation entry available. We do store in-app group connections and member names. User-uploaded sounds and images are not supported yet. Firebase Analytics is not enabled.

What other people see

Gift purchases store the purchased item, payment verification, purchaser account binding, whether the gift was sent and the recipient account ID. You choose a recipient from existing group members; their display names help you choose. We check shared membership, blocks and existing item ownership before transferring a gift. The recipient receives ownership of that Shop item, without automatic changes to their settings, and can see received items and the sender's display name in Gifts. Monthly and yearly Premium, individual Shop items, collections and gifts are separate options.

If you equip a nameplate, we store its design and selected Neon color with your account and share that cosmetic selection with members of your groups. It decorates your current display name inside the app. Other members can see it without buying the design; payment verification records remain private. You can remove the equipped design in Shop. Nameplate artwork is not included in notifications.

Invitation QR codes contain the same expiring invitation link as the copy/share controls. Google Play services provides the optional QR scanner and processes scanning on the device; pstpst receives the scanned code and does not retain camera images. Pasting invitation links remains available. Only the invitation link is sent to our service to preview or join a group.

Group members can see group membership and display names. A ping's sender and its recipients can see that ping, its optional message and its replies. Messages also appear in recipients' notifications, subject to their phone's notification settings; avoid including sensitive information. Your email address and payment verification records are not displayed to group members. Anyone with a valid invitation code can use it to join; share codes only with people you intend to invite. Group owners can remove members; removal ends that member's group access and invalidates existing invitation links. Previously delivered information cannot be recalled.

Advertising and privacy choices

Where advertising is enabled on iOS, pstpst uses Google AdMob and User Messaging Platform (UMP) privacy choices. It waits for applicable consent choices and adult eligibility, requests non-personalized ads and disables publisher first-party ID. Test builds may use clearly identified Google test ads; test ads do not earn production XP. Google may process IP addresses and derived approximate location, app or device identifiers, ad views and interactions, crash information and performance diagnostics for advertising, measurement and fraud prevention. The app does not request access to the iOS advertising identifier through App Tracking Transparency. Non-personalized ads do not mean that no data is collected. Live advertising and rewarded-ad XP remain disabled until their configuration and testing are complete.

When advertising is enabled, adults using the free version may see Google AdMob banners. We wait until premium ownership is checked and Google's User Messaging Platform allows ad requests. Our ad requests ask for non-personalized ads. Non-personalized advertising may still use device storage or identifiers and requires applicable privacy choices.

Optional bonus-XP ads are available to adults when the ad service is ready. Free and Premium members can choose to complete one rewarded ad for 50 XP. Each ad requires a fresh choice, and ad length and format vary. Ordinary pings and replies do not require an ad, and declining or closing an ad does not block other features. Google receives a random reward-session code, not your pstpst account ID, email, group names or message text. Our service validates Google's signed completion, ad unit, reward and transaction before crediting XP to the account that started it. Verification can be delayed; closing the app does not move an earned reward to another account. XP is personal, has no cash value and cannot be sent, sold, exchanged for money or converted into gifts. Ad clicks and installs do not earn extra XP. Premium removes banners; optional bonus-XP ads are requested only when you choose one.

Google's advertising services may process IP addresses (including approximate location), device or app identifiers, interactions and diagnostics for advertising, measurement and fraud prevention. This version removes the Android Advertising ID permission and disables publisher first-party ID. These settings do not prevent all data processing. See Google's Privacy Policy and Google advertising information.

Where Google requires a privacy-options form, open Settings > Privacy > Ad privacy choices to review or withdraw choices. If consent settings cannot be checked, pstpst continues working without requesting new ads unless Google's SDK permits requests using valid prior choices. Verified Premium ownership prevents banner requests; a new optional rewarded ad still requires your explicit choice and the same privacy checks. If you buy Premium after ads have run, already processed information is not erased automatically.

Internal builds may disable advertising entirely. Development builds use Google's test ad units when test advertising is enabled and do not generate advertising revenue or production XP from test ads.

Ages 13 and up

pstpst is intended for people aged 13 or older. Under-13 users cannot proceed past the age-range screen. Ads are disabled for everyone who selects an age range below 18. You can correct the range in Settings. If you believe an under-13 child has provided account information, contact us so we can investigate and remove it.

Providers and international processing

We use Google Firebase for authentication, the database and push delivery; Cloudflare for the API and delivery queue; Google Play for Android purchases; Apple for enabled App Store purchases, device verification and APNs delivery; and Google AdMob/UMP for advertising and privacy choices when enabled. Providers may process information outside your country. Our main Firestore database is in europe-west1; that does not mean all processing occurs there. Information is sent over encrypted HTTPS connections.

Provider information: Firebase privacy, Cloudflare privacy, Google privacy, and Apple privacy.

Retention and deletion

For enabled Apple features, account deletion removes account-linked Apple entitlement records, device-key registrations, push registrations/claims, outstanding verification challenges and account-security limits through the deletion queue. It removes the deleted account’s UID from Apple purchase ledgers and account-binding records, while selected transaction identifiers and pseudonymous binding tombstones may remain to prevent receipt reuse, reconcile refunds and preserve gifts belonging to other people. Those other people’s records remain linked to their own accounts. Apple verification challenges expire after two minutes; expiry is not instant deletion, and stale challenges are removed during subsequent verification activity or account deletion. Minimal Apple server-notification deduplication metadata may be retained while needed to prevent replay and reconcile purchases. An expiry marker does not mean immediate deletion.

Account progress, earned-reward claims, the latest activity-session state and award history remain while needed to provide your level and inventory, correct refunds and prevent duplicate credits. Account deletion removes the progress summary and partial activity duration, activity-session records, earned-reward claims, associated award history and reward-ad sessions. A minimal one-way hash of verified ad transaction identifiers is retained without your account ID, email or display name to prevent replay. Pending reward deliveries are processed by our delivery queue and deleted after completion; service outages can delay this processing.

Saved schedules remain until you delete them or delete your account; completed and paused entries remain visible so you can review and remove them. Canceling Premium stops access at the end of the paid period; renewal payment problems can also pause scheduling. A schedule can be deleted without an active subscription. Recurring schedules remain tied to their chosen time zone. A missed occurrence may be skipped, and cooldowns, account/group restrictions and notification preferences still apply.

Ordinary pings stop accepting replies after ten minutes. Countdown pings notify recipients immediately and stop accepting replies when their countdown ends, from one minute to 24 hours after sending. The app and notification show the start time; delivery still depends on connectivity and notification settings. Countdown pings do not send a second reminder at the start. Expiry does not immediately delete the record. A scheduled cleanup removes ping records that expired more than seven days ago and expired invitation records; processing can take longer during failures or backlogs. Account, group and purchase information is kept while needed to provide the service and restore ownership.

To delete your account, sign in and use Settings > Account > Delete account. You may need to sign in again first. Deletion is queued and retried: it removes your account, device registrations, preferences and private purchase records, removes your group membership, and anonymizes pings you sent. Groups with other members remain; ownership can transfer to another member. Recipient lists and replies associated with your account are removed from retained pings.

You can also request deletion by emailing the contact above from your account email address. We may verify account ownership before acting. Deleting an account does not automatically refund a Google Play or Apple purchase or cancel a recurring store subscription. Manage or cancel the subscription separately through the store where it was purchased (Google Play or Apple account subscription settings); the app links to subscription management in Shop and Account. Purchase restoration after deleting and recreating a pstpst account is not currently supported; contact us before deleting if you need help with paid items. Providers may retain separate records under their own policies or legal obligations.

Your controls

Deleting a purchaser account removes its unsent gifts and removes the purchaser account ID from sent-gift records. A minimal payment verification record and a pseudonymous purchase binding remain for sent gifts so recipients retain their items and refunds can be processed. Deleting a recipient account removes its gift ownership and recipient account ID. Gift purchases do not create a cash balance and cannot be exchanged for money in the app.

Groups > group menu > Members & safety offers reports, blocking and hiding. Settings > Safety offers unblock/show controls. Report records are retained for investigation and abuse prevention for up to 90 days, including after account deletion; scheduled cleanup may take longer during outages or backlogs. Other members cannot read reports. Blocking does not remove shared membership or recall previously delivered information. See the community rules.

You can change your display name, mute groups, disable notification delivery on a phone, use Android or iOS notification settings, correct your locally stored age range, review applicable ad privacy choices, and request access, correction or deletion of your account information by contacting us. Rights and available remedies depend on where you live. We do not sell your group or ping content.

Changes

We may update this policy as pstpst changes. We will update the effective date and provide additional notice for material changes where required.