Your data
The same words the app shows you, kept identical by a test that fails the build if they drift.
Ping never sells, licenses or brokers your location or your messages — not to advertisers, not to data brokers, not to anyone.
There are no advertising, analytics or attribution SDKs in this app. It uses no third-party code at all, which anyone can check against the build.
Nothing here follows you across other apps or websites, so iOS never asks you to allow it.
Your location trail is destroyed after at most 30 days, on every plan. Arrivals you posted to a conversation stay in it, like any other message.
The people in your Spaces have their most recent position kept on your phone for up to a day, so the map is not empty when you are offline. It goes when they pause, when either of you leaves the Space, and when you sign out.
The limit
Ping is not end-to-end encrypted. The server can read your locations and messages, because that is how an arrival at a Place is worked out and how a message reaches the people you sent it to.
Who else touches it
Apple — CLGeocoderTurns a coordinate into a place name, on the device the position belongs to. Ping's server never calls it, and the name a reader sees was made by the sender's own phone.
Google — Sign in with GoogleChecks that you are who you say you are when you sign in. It is told nothing about where you are or what you say.
How long it is kept
Every window is listed on the retention page, and each one is a number that exists in Ping's source rather than a number we hoped for.
What you can do about it
Two of these are an email rather than a button, and they say so. Ping has no export and no way to change your name after sign-up, and describing either as self-serve here would be the kind of claim the rest of this page exists to avoid.
See what Ping holds about youThis page and the retention schedule list every kind of data and every window. In the app, the Ledger on You shows who opened your card and when — that record exists so you can read it.
Delete all of itIn the app: You, then Delete account. It happens immediately, needs no email to anybody, and there is no waiting period. If you signed in with Apple it also tells Apple to withdraw the sign-in, so Ping's access ends at their end too.
Get a copy of itIn the app: You, then Your data, then Export my data. One tap, no email and no queue. Your location history comes out as GPX and GeoJSON, your Places as GeoJSON, and your conversations as plain text beside JSON — formats other software already opens, because an archive only Ping can read is not really a copy of your data. The files are written on your phone and go wherever you send them; nothing is uploaded to make one. Other people's positions are not in it. If the export ever fails you, the address below still reaches a person.
Correct itYour photo you can change yourself, any time: You, then tap your face. Your name is set when you sign up and there is currently no way to change it in the app, so that one is the address below.
Opt out of your data being sold or sharedThere is nothing to opt out of. Ping does not sell, license or broker anything, and has no advertising or analytics partner to share it with, so there is no toggle here and no list to be removed from.
Ask without being treated differently for askingUsing anything on this page changes nothing about your account, what it costs, or what works.
Complain, including to somebody who is not meWrite to the address below first — most things are a misunderstanding and I would rather fix it than be reported for it. If that does not settle it, you can complain to a regulator without asking me: in California, the Attorney General and the California Privacy Protection Agency; elsewhere, your national data protection authority. You do not need my permission and I will not be told you did it.
Who answers
Ping is one person's project, so the address is a person: [email protected]. There is no privacy team behind an alias, and pretending otherwise would only tell you to expect a queue that does not exist.
Ask from the address you signed in with, or tell me enough to match the request to the account — a request nobody can tie to an account is one that would hand your data to whoever asked. Expect a reply within 30 days, which is California's deadline and the longest one Ping is held to. Usually it is far sooner; the number published is the one that can be kept on a bad week rather than a good one.
If you would rather not ask at all, deleting your account is in the app and needs nothing from me.