Privacy policy

Who we are

PinPoint is civic technology built for Azerbaijan. Contact support@pinpoint.az for any privacy request.

Information we collect

We do not collect your contacts, SMS messages or call history. PinPoint uses live camera capture and does not read your photo gallery.

• Email and authentication data to create and secure your account. Passwords are hashed by our authentication provider and are never visible to PinPoint.
• Display name and profile settings to connect reports to your account. A display name is required to finish sign-up.
• Photos captured in the app to document a civic issue. The camera is used only when you begin a report.
• Precise GPS location at capture time to establish where the issue is. Exact coordinates are not published; they may be used for institutional routing only when email delivery is enabled.
• Photo metadata, capture time, file size and mock-location indicators to verify authenticity and prevent abuse.
• Language, app settings and redacted technical diagnostics. A push-notification device token is collected only while push delivery is enabled.

How a report is processed

• The photo is stored privately and can be accessed only by you and authorised PinPoint staff.
• It may be sent to OpenAI for automatic classification of the issue and its severity.
• The report, category and location are stored for tracking, moderation and routing to the appropriate institution.
• Safety checks are applied before public sharing; protecting personal identifiers is a mandatory product principle.

Who can see reports

You and authorised PinPoint staff can see the private report record. On the public map your identity is hidden and the coordinate is shifted by approximately 100–250 metres. The precise location is stored inside PinPoint. When institutional email delivery is enabled, the responsible institution may receive the precise location and necessary report details only to act on an issue within its responsibility.

Service providers

We do not sell your information, use it for behavioural advertising or share it with advertising networks.

• Supabase for database, authentication and private photo storage.
• Firebase for push notifications and website hosting.
• OpenAI for automatic recognition and classification. When a formal letter to an institution is drafted, your note and the exact coordinate are sent to OpenAI as well.
• OpenStreetMap (Nominatim) for address and place search on the map; only the text you type is sent. Your coordinates are not — the search is bounded by a fixed Azerbaijan box.
• Sentry for privacy-scrubbed application fault diagnostics and release health.
• Cloudflare Turnstile for bot protection; it processes IP address, browser/device signals and challenge outcome, but not form fields or what you type.
• Resend for institutional email delivery and delivery-status tracking.

Retention

• Account and profile data is retained until you delete the account.
• Report photos may remain while an issue is open and be deleted or anonymised approximately 12 months after resolution.
• Security and audit records are retained at minimum scope for legal and operational need.

Your rights

You may request access, correction, export or deletion. Account deletion removes your profile, reports, photos and related personal data; records that must remain are anonymised so they can no longer be linked to you. You may withdraw consent where processing relies on consent.

Children and changes

PinPoint is not directed to children under 13 and we do not knowingly collect their information. We update the date on this page when the policy changes and provide in-app notice for significant changes.