Pingolin Terms of Service

Acceptance. Creating an Account, or otherwise using the Service, forms a binding agreement between you and Pingolin as of that date. If you do not agree to these Terms, do not use the Service.

Who may use the Service. You represent and warrant that you are at least 16, and if you are under 18, that a parent or legal guardian has consented to your use of the Service and these Terms. If we learn that an Account belongs to someone under 16, we will delete that Account and its data, subject to any preservation we are legally required to make. A Guardian-Managed Account under Section 5 does not lower this age requirement.

Personal and household use only. The Service is for personal and household use by individuals and families, not for business or organizational use.

Modification of these Terms. We may change these Terms from time to time. A change that materially reduces your rights or increases your obligations takes effect 30 days after we notify you by email or prominent website notice; continuing to use the Service after that period means you accept it. If you do not agree to the material change, you may cancel your subscription within that 30-day period, or delete your Account at any time.

Account. You must register for an Account to use the Service. Creating an Account requires a valid email address and password, and issues you a recovery key (the “Recovery Key”) as described in Section 6. You will keep your registration information accurate, complete and current. You will not let anyone else access the Service through your Account, except under a Guardian-Managed Account established under Section 5, and you will not access the Service through anyone else’s Account. You are responsible for all activity under your Account. Registration is subject to an automated integrity check as described in Section 8; a failed check may prevent an Account from being created, and you may contact [email protected] for manual review.

Access. Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Service.

Acceptable use. You will use the Service only for lawful purposes and in accordance with these Terms, the documentation we publish, your plan tier, and applicable law (collectively, the “Documentation”).

Restrictions. You will not, and will not permit any third party to: (a) violate any law, regulation, or third party’s rights; (b) stalk, harass, threaten, or covertly monitor any person — anyone whose location, notes, or other Account content you can see must know that you can see it; (c) track the location of anyone who has not voluntarily joined your Circle, except under a Guardian-Managed Account established under Section 5; (d) send abusive, threatening, or harassing content in a check-in message, place name, or other text visible to another person; (e) attempt to gain unauthorized access to the Service, another person’s Account, or data, including by circumventing any restriction, rate limit, or authentication mechanism; (f) decipher, decompile, reverse engineer, disassemble, reproduce, modify, distribute, or create derivative works of the Service or its source code, except as permitted by law or by an open-source license we have published; (g) interfere with or disrupt the Service, including through automated tools, bots, or denial-of-service attacks; (h) scrape, crawl, or harvest data from the Service; (i) use the Service for surveillance, law enforcement investigation, or intelligence gathering, whether or not lawful where you are; (j) use the Service to store or share content that infringes copyright, is defamatory, or is otherwise unlawful; (k) resell, sublicense, rent, or lease the Service, or use it to build a competing product; or (l) misuse our support channels or submit false reports of abuse or misconduct.

Modification and discontinuation of the Service. We may introduce, modify, or withdraw features. Before removing a feature you are using, we will give at least 30 days’ notice; before discontinuing Track or Note entirely, we will give reasonable notice so you have time to export your data.

Privacy Policy. We collect, use, and disclose personal information as described in our current privacy policy at pingolin.com/privacy (the “Privacy Policy”), which is part of these Terms.

No training, profiling, or automated decisions. We do not use your data to train machine-learning models, ours or anyone else’s. We do not profile you or make automated decisions about you, other than the registration integrity check in Section 8.2 and the automatic limits in Section 2.9 — each reviewable by a person on request.

Service limits and availability. We do not guarantee uninterrupted access. The Service may be unavailable for maintenance, updates, or reasons beyond our control; we will use reasonable efforts to give advance notice of planned maintenance. We apply automatic limits to protect the Service and your Account — these apply to ordinary use and are not a suspension. They include a cap on concurrent signed-in sessions (beyond which the least recently used session is signed out) and rate limits on sign-in, password reset, and Account deletion. A correct password does not count against a rate limit, and failed sign-in attempts count against both the originating address and the Account, so a third party cannot lock you out. If a limit is blocking your own use of your Account, contact [email protected]; if someone else is deliberately triggering a limit against you, we can exempt your Account from it.

Pingolin is not an emergency service and is not a substitute for one. No alert, notification, Circle notification, place alert, destination, check-in, or location update summons police, fire, ambulance, or any other emergency responder, and no one at Pingolin monitors them. In an emergency, contact your local emergency services directly.

No delivery warranty. We do not warrant that any alert, notification, or location update will be delivered, delivered promptly, or delivered accurately. Delivery depends on conditions we do not control, including: mobile network, Wi-Fi, and satellite positioning availability; device battery level and power-saving modes; operating-system restrictions on background activity; the permissions granted to the application; the push notification service in use (and, on our Google-free Android builds, whether you have installed one at all); and the accuracy of the position your device reports. You are responsible for keeping the application installed, permitted, and operational on any device you rely on.

Circle notifications override your privacy settings. The “notify my circle” feature sends your exact location to every member of the selected Circle, regardless of your privacy settings for that Circle — overriding a pause, an approximate position, or real-time sharing switched off entirely. This follows from end-to-end encryption: your location is sealed with the Circle’s key and cannot be disclosed to some members but not others, so it cannot be directed to individual members. It also emails every member a notice to open the application, which itself names no person and no place. If a Circle contains someone you would not want to see your location, use a different Circle — and create it before you need it. The applications warn you before notifying a Circle from which you have hidden your location, but that warning depends on settings the application already holds; it is not available immediately after installing, restoring, or being added to a Circle, so treat it as a courtesy, not a guarantee.

Delivery reports and check-ins. Delivery information shown in the applications is best-effort, not a guarantee. A delivery confirmation shows only that a device reported receipt — not that anyone has seen the notification — and is not an acknowledgement.

Circles and roles. The Service uses “Circles” to organize groups of users, share location and location history among them, and enable alerts. Each Circle has one owner (the “Circle Owner”), who alone may delete the Circle, transfer it, or designate administrators (“Circle Admins”). Circle Admins may remove members and rotate the Circle’s keys. Ownership, not authorship, governs: someone who created a Circle and later transferred it is an ordinary member.

Visibility on joining. Joining a Circle shares your current position at full precision, your location history, and your device battery level with every member — all enabled by default. A Circle’s history is retroactive: someone who joins later can read everything the Circle recorded before they arrived, for the applicable retention period, without advance notice. Any other member may set an alert that fires when you arrive at, leave, or go quiet at a location, and you cannot see who has set such an alert or whether one exists. Controls for each of these are in that Circle’s privacy settings and described in the Documentation. An alert set on a place, rather than a person, fires for everyone who arrives or leaves and is not stopped by those controls; leaving the Circle ends it.

Your responsibility. You are responsible for: (a) any decision to add someone to a Circle or give them access to one; and (b) all activity under any Circle you own as Circle Owner, including ensuring it complies with these Terms. Where a Circle has more than one Circle Owner or Circle Admin, each is jointly and severally liable for that Circle’s activity.

Leaving, removal and transfer. You may leave any Circle you do not own at any time, which immediately stops that Circle being served to you; what other members have already downloaded stays on their devices. A Circle Owner cannot simply leave — they must transfer the Circle to another member or delete it. Deleting a Circle destroys everything it holds, including data contributed by other members. Neither leaving nor removal is quiet: the person disappears from the roster and the Circle’s keys change. If a Circle Owner is unable to act, a Circle Admin may request transfer of ownership; the Circle Owner is notified by email and in the application, may refuse with one action, and ownership passes to the requesting Circle Admin only if the Circle Owner does not respond within 14 days.

Disputes between members. We do not adjudicate disputes between Circle members over ownership, membership, or what should have been shared, and we will not act for one member against another on that basis — regardless of their relationship, including spouses, separated partners, relatives, or a parent and adult child.

A user who is at least 16 but under 18 may use the Service either: (a) through their own Account, with guardian consent under Section 1.2 — in which case the guardian does not hold the minor’s keys and cannot read the Account’s contents; or (b) through an Account established and controlled by a parent or legal guardian (a “Guardian-Managed Account”). These are different arrangements with different consequences.

Guardian obligations. A guardian who establishes a Guardian-Managed Account: (a) creates the Account using the guardian’s own email address and password, which unseals the Account’s encryption keys and so lets the guardian read everything the Account holds, including the minor’s notes; (b) must supply the minor’s email address, to which we send a link letting the minor set a separate password that the guardian neither sees nor chooses; (c) is responsible for the minor’s use of the Service and compliance with these Terms; (d) must be a member of any Circle the minor participates in; and (e) must specify, when creating the Account, the date the guardian’s access ends — no later than 2 years after creation.

Disclosure. While a device is sharing location, the Service says so. Where an Account is marked as a Guardian-Managed Account, the Service shows a standing notice in the applications for as long as the guardian’s access continues. This depends on the Account having been marked as such when created; an unmarked Account shows nothing, and a password shared informally after creation looks to us like a single user. The rest of the disclosure is the guardian’s responsibility: they must ensure the minor understands the arrangement and knows who can see them and what those people can see. Section 2.4(b)’s ban on covert monitoring applies within a family as much as outside one.

Transfer at majority. On the minor’s 18th birthday, the Account becomes theirs, they become bound by these Terms, and the guardian’s responsibility for their use of the Service ends — whether or not the guardian’s access has ended. On the date specified under Section 5.2(e), the guardian’s password stops working; the Account holder may also end the guardian’s access sooner, at any time, from the Account’s security settings. Ending guardian access terminates the guardian’s password, signs the guardian out of every device, deletes any passkey the guardian registered, invalidates any Recovery Key the guardian holds, and clears the Account’s recovery address. It closes every route in — it does not reach anything already read. We will not end guardian access while the Account holder has never set their own password, since that would leave no one able to open the Account. A guardian who has not handed over an Account after the minor’s 18th birthday is a person with access to someone else’s Account, and Sections 2.4(b) and 6.5 apply.

How encryption works. Your data is encrypted on your device before it reaches us, using keys your device generates at random. Those keys are sealed with a key derived from your password — which is why changing your password re-seals them rather than stranding your data. Your password is never sent to us. We hold your encryption keys only as sealed material we cannot open.

Loss of password and Recovery Key. You are solely responsible for safeguarding your password and Recovery Key. If you lose both, your data is gone — it cannot be recovered by you, by us, or by anyone else, and we cannot decrypt it for you or for anyone. Losing only the Recovery Key is survivable: while you can still sign in, replace it from your security settings. Only one Recovery Key is valid at a time, and issuing a new one invalidates the old one.

Password reset. If you can receive email at your Account address or a verified recovery address, you may reset your password without a Recovery Key. A reset returns the Account, but not the data by itself: you recover the address, subscription, and ability to sign in, but everything the Account held stays sealed under keys that can no longer be unwrapped, and your device generates new ones.

Limits of encryption. Your sealed key material and the settings protecting it are stored in the same database. Someone who obtained a copy of that database could try to guess a weak password offline and unseal what it protects. Your password’s strength is part of this protection, not an optional extra.

Compromise. Notify us immediately at [email protected] of any unauthorized use of your Account, any loss, theft, or disclosure of your password or Recovery Key, or any other compromise. If you cannot sign in because someone changed both the password and the email address, write from the address previously on the Account and we can suspend it. Subject to Sections 13 and 17, Pingolin is not liable for damage or loss from unauthorized Account access caused by your acts or omissions. Where someone else has or had access to your Account, close it out by: changing the Account email and removing any recovery address that is not yours; changing the password; replacing the Recovery Key; deleting any passkey or authenticator you did not register and enabling two-factor authentication; and signing out every device you do not recognize. Each step closes a route the next cannot.

Ownership. Except as expressly stated in these Terms, Pingolin retains all right, title, and interest in the Service and its intellectual property, including the Pingolin name, logo, trademarks, service marks, branding, and all modifications, improvements, and derivative works (“Pingolin IP”). These Terms give you no right to use Pingolin’s IP without our prior written permission.

Feedback. You are not obliged to give us feedback. If you provide feedback, suggestions, or recommendations (“Feedback”), you grant us a non-exclusive, worldwide, perpetual, irrevocable, royalty-free licence to use it without compensating you, and you agree the submission is gratuitous and creates no fiduciary or other obligation for us.

No publicity. We will not identify you as a user of the Service, or display your name, in marketing materials.

Sharing. The Service lets you share notes with named individuals and share content within a Circle (“Shared Content”). Sharing is addressed to a person you name: the copy is encrypted to them, with no public link or forwardable URL. A person you share a note with may accept, decline, or block it, and by default can edit it unless you specify otherwise; there is no version history. Removing someone’s access ends it going forward but cannot undo a copy already made — nothing we do changes that.

Limitation of Pingolin’s role. We cannot read Shared Content and cannot confirm, assess, or remove it — we are not in a position to moderate content at all. Where a report and the circumstances justify it, what we can do is act on the Account: suspend it, close it, and preserve the records we hold. We cannot reach inside a note and remove specific material, and you should not expect that we can.

Reporting unlawful content. If content shared with you is unlawful, use the report control on the item or write to [email protected]. A report should: identify the item; explain, in enough detail for us to assess it, why you say it is unlawful; give your name and email address (which may be omitted for a report concerning an offence against a child); and confirm your good-faith belief that the report is accurate and complete.

Reporting misuse and covert monitoring. If you are in immediate danger, contact your local emergency services first. If you believe someone is using the Service to follow you without your knowledge, write to [email protected] identifying the Account or Circle involved, what is happening, and what you would like us to do.

Statement of reasons. If we restrict your Account, we will notify you by email without undue delay, stating: what we did, its scope and duration; the substance of what we were told; the term or law we relied on; whether a person or an automated check made the decision; and how to contest it. A person will review any reply; we aim to respond within 5 working days and will reverse a decision made in error, with nothing deleted meanwhile.

DMCA policy. Pingolin publishes no content and offers no public links, but we maintain a designated agent under the Digital Millennium Copyright Act (“DMCA”) regardless. A valid DMCA complaint must include, in writing: the electronic or physical signature of someone authorized to act for the copyright owner; identification of the copyrighted work claimed to be infringed; identification of the allegedly infringing material and information sufficient to locate it (recognizing that we cannot read it and will act on the Account, not its contents); information sufficient to contact you; a statement of your good-faith belief that the use is not authorized by the copyright owner, its agent, or law; and a statement, under penalty of perjury, that the information is accurate and that you are, or are authorized to act for, the copyright owner. We will tell you if a notice is deficient. Send notices to:

Renewal and cancellation. Paid subscriptions bill in advance, monthly or annually, and renew automatically at the frequency and price then in effect until you cancel. You may cancel any time. Cancellation takes effect at the end of the paid billing period, and you keep access until then; fees due before your Account ends remain payable. We cannot cancel an App Store subscription for you, and we will not sell you the same product on our website while an App Store subscription for it is active.

Price changes. Where we set the price, an increase requires at least 30 days’ notice and cannot take effect earlier; a reduction requires no notice. On the App Store, Apple sets, changes, and notifies prices under its own rules, and we can neither shorten, extend, nor apply a price Apple has not applied.

Discounts, introductory prices and trials. Before you confirm a purchase with a discount, introductory price, or trial, we will show you: what you pay now, what you pay once the offer ends, and when that happens. A trial becomes a paid subscription at its end unless you cancel first.

Lapse. If a subscription lapses, nothing you have already created is deleted for being over a limit, and no one is removed from anything. Existing places, Circles, alerts, and destinations keep working, and a Circle keeps all its members even above the free-tier limit. What you cannot do is create new places, alerts, or destinations until you are within the free limits or subscribe again. Location history is the exception: history beyond the free-tier period survives 30 days after Premium ends, then is permanently deleted. If a payment fails, Premium continues for up to 14 days while payment is retried, and the 30-day period runs from the end of that retry window, not from the missed renewal. If any Circle member subscribes within the 30 days, the history is restored intact. Notice of this period appears in the applications and on the website, not by email, and nothing is shown while a failed payment is still being retried.

Premium in a Circle. If any Circle member holds a Premium subscription, the whole Circle gets Premium features. A second subscription in the same Circle buys nothing extra — it is only worth having for Circles the other subscriber is not in. Your plan card shows whether your Premium is your own or comes from a Circle. If the member whose subscription covers a Circle stops paying or leaves, the whole Circle drops to free-tier limits, including shorter location history — so another person’s billing can change what you can see without their telling you.

Taxes. Where we are the seller, any tax we must charge is included in the total shown before you confirm.

Mutual. Each party represents and warrants that it has full power and authority to enter into these Terms.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS AND SUBJECT TO SECTION 17, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE,” AND YOUR USE OF IT IS AT YOUR OWN RISK. PINGOLIN AND ITS LICENSORS MAKE NO WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, WE DO NOT WARRANT THAT: (A) THE SERVICE WILL MEET YOUR REQUIREMENTS; (B) THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE; (C) ANY DEFECT WILL BE CORRECTED; OR (D) ANY ALERT, NOTIFICATION, OR LOCATION UPDATE WILL BE DELIVERED, TIMELY, OR ACCURATE.

By Pingolin. We will defend you against any third-party claim that the Service infringes or misappropriates a third party’s intellectual property right. This does not apply to a claim arising from your breach of these Terms, or from using the Service combined with anything we did not supply.

By you. You will defend Pingolin and our members, officers, agents, employees, licensors, and suppliers against any third-party claim arising out of or related to Your Data under the Privacy Policy, your breach of these Terms, your violation of any law, or your violation of a third party’s rights. You will indemnify us for damages, attorneys’ fees, and costs finally awarded against us on such a claim, or paid under a settlement you approve in writing.

Procedure. The indemnified party must promptly notify the indemnifying party of any claim for which it seeks indemnification and cooperate in the defense. The indemnifying party controls the defense, but the indemnified party may participate at its own expense with its own counsel, and no settlement requiring the indemnified party to admit fault or pay any amount may be made without its consent, which will not be unreasonably withheld.

Termination by you. You may stop using the Service and delete your Account at any time, from your Account settings, the website, or either application. Deleting your Account immediately and irreversibly destroys your encryption keys in the live Service, and all encrypted data is marked for deletion. Before deleting, note three consequences: deleting a Circle you own — or deleting your Account while you own one — destroys everything that Circle holds, including what other members contributed, and no one but the owner can prevent it; deleting a note you shared removes it from everyone you shared it with; and deletion ends any paid period immediately, not at its end.

Suspension and termination by us. We may suspend or terminate your Account if: (a) you breach these Terms; (b) in our reasonable judgment, the Service faces a threat to security or functionality, or suspension prevents harm to Pingolin or other users; or (c) for convenience.

Effect of termination. On termination, your access to the Service ends and we may delete Your Data. After a termination for cause, you have 30 days to export Your Data. Residual copies may persist in encrypted backups for up to 31 days, and a pseudonymized security audit record may persist for up to 90 days, or as long as law requires us to hold Your Data.

Death and incapacity. Without the password or Recovery Key, no one — including us — can open an Account or read what it held. There is no exception for a bereaved family, a will, or a court order. Incapacity is treated the same way; a power of attorney, deputyship, or conservatorship does not change this.

Discontinuation of the Service. If we decide to stop operating, we will give at least 15 days’ notice by email or prominently on our website, and keep the Service read-only during that period so you can export.

Government requests. Because we do not hold your encryption keys, we cannot access, decrypt, or produce your encrypted data in response to a subpoena, court order, or government request. We may produce unencrypted information we hold, in accordance with the Privacy Policy. We will notify you of any legal request for your data unless legally prohibited, and will tell you as soon as that prohibition lifts.

Security incidents. If a security breach affects personal data, we will notify affected users by email without undue delay, describing the nature of the breach, the categories of data affected, the likely consequences, and the measures taken — so far as we know at the time — and update you as we learn more rather than delay the first notice.

Governing Law. These Terms are governed by California law, without regard to conflict-of-law principles. For disputes not subject to arbitration, venue is the state and federal courts in Sacramento County, California.

Informal resolution. Before starting arbitration, you agree to contact us at [email protected] and try in good faith to resolve the dispute informally for at least 30 days. This is a condition to arbitration.

Binding arbitration. Any dispute, claim, or controversy arising out of or relating to these Terms or the Service — whether based in contract, warranty, tort, statute, regulation, or any other legal or equitable basis — will be resolved exclusively by final, binding, individual arbitration administered by JAMS under its Streamlined Arbitration Rules and Consumer Arbitration Minimum Standards of Procedural Fairness (the “Minimum Standards”). Where this Section conflicts with the Minimum Standards, the Minimum Standards govern. This arbitration agreement is governed by the Federal Arbitration Act.

Delegation. The arbitrator — not any court or agency — has exclusive authority to resolve any dispute over this Section’s formation, existence, scope, validity, interpretation, applicability, or enforceability, except that a court (not the arbitrator) will decide the validity and enforceability of the class action waiver in Section 16.6.

Conduct. Arbitration may be conducted virtually, by videoconference or telephone, or in person in Sacramento County, California, at the claimant’s election.

Class action waiver. Other than a claim for public injunctive relief, you agree to resolve disputes individually and waive any right to participate in a class, collective, consolidated, or representative action. Class and collective claims are never arbitrated — if such a claim must proceed, it proceeds in court. This waiver does not apply to, or prevent, a representative action brought on your behalf by a qualified entity under EU or UK collective redress law.

Entire agreement. These Terms, with the Privacy Policy, are the entire agreement between you and Pingolin about the Service, superseding all prior and contemporaneous agreements, proposals, and representations — other than a prior version of these Terms still governing your Account under Section 1.4.

Assignment. You may not transfer your Account or your rights under these Terms; any attempted assignment in breach of this Section is void. We may transfer these Terms, and the data described in the Privacy Policy, in connection with a merger, acquisition, or sale of the assets behind the Service.

Notices. By providing an email address, you consent to our using it to send any legally required notice in place of postal mail. Send notices to us at [email protected] or by post to Pingolin LLC, 1401 21st St, Ste R, Sacramento, CA 95811, United States.

Third-party beneficiaries. Other than Apple — a third-party beneficiary of these Terms as they concern our iOS application, and who may enforce them against you in that respect — there are no third-party beneficiaries to these Terms. Apple is not a party to these Terms and has no responsibility for the Service. The parties are independent contractors; nothing here creates an agency, partnership, or joint venture.

Waivers and severability. If we do not exercise or enforce any right or remedy under these Terms, that is not a waiver and it remains available to us. If any provision of these Terms is held invalid, illegal or unenforceable, the remaining provisions continue in full force and effect.

Force majeure. Neither party is liable for failure or delay caused by circumstances beyond its reasonable control, including natural disasters, government acts, internet or infrastructure outages, cyberattacks, pandemics, or utility failures (“Force Majeure”), provided the affected party gives prompt notice and uses reasonable efforts to mitigate the effects.

Survival. The following sections survive termination of these Terms:

Section 2.4 (Restrictions), 6 (Encryption, Credentials and Recovery), 7 (Intellectual Property Rights), 10 (Fees and Taxes, solely with respect to amounts accrued before termination), 11.2 (Disclaimers), 12 (Limitation of Liability), 13 (Indemnification), 14.4 (Effect of Termination), 14.5 (Death and Incapacity), 15 (Government Requests and Security Incidents), 16 (Governing Law; Dispute Resolution), 17 (Export Controls and Sanctions), 18 (General) and any other provisions that, by their nature, are intended to survive termination.