Privacy

PingWait is run by one person, not a company. This notice says what the service records about you, why it records it, who else sees it and what you can ask us to do with it. It is written to be read, not to be survived.

If you sign up with an email address, we store that address and a scrambled version of your password. The password itself is never stored and we cannot read it.

If you sign in with Google or Apple instead, we store the address they hand us, the name they send when they send one, and the identifier that lets us recognise the same account next time.

We store the language you read in, the country whose calendar you follow, and whether you have confirmed your email address.

Every sign-in opens a session, and we record the IP address and the browser or app that opened it.

We store the movies and artists you follow, each with the country you follow it for.

We store one row for every notification: which event it was about, whether it went by email, by push or to the inbox in the app, when it was delivered and when you read it.

If you switch on push notifications in the mobile app, we store the push token the device gives us, the platform it runs on and when we last saw it.

Our servers keep ordinary request logs — IP address, path, browser — for a limited time.

To run your account and sign you in, to follow the movies and artists you asked for, to deliver the notifications you asked for by email and push, to confirm the address is yours, and to keep the service working.

We also use it to notice and stop abuse: someone hammering the sign-in form, or signing up in bulk. We do not sell your data, we do not hand it to advertisers, and we send no marketing mail. The only mail you get is the tracking you asked for and the mail your account needs.

Most of it is simply the service you asked for. We cannot tell you a release date moved without an account, a follow and an address to write to.

Push notifications and signing in with Google or Apple rest on your consent: your device asks before push is switched on, and using a sign-in provider is your choice.

Keeping the service secure and free of abuse is our own legitimate interest.

The law where you live may give you more rights than this notice describes. Where it does, that law wins.

Resend delivers our email. It receives the recipient address, the subject, the content of the message and the delivery metadata that comes with sending it.

Expo sends our push notifications and passes them to the Apple and Google push services that reach your device. They receive the push token, the title and the body of the notification.

Google and Apple handle sign-in when you choose it. They tell us your email address and, if you allow it, your name. We send them nothing about you beyond the sign-in itself.

Our hosting provider runs the servers, the database and the backups.

TMDB supplies film information and posters. Ticketmaster supplies concert and artist information and images. Neither receives anything about you from us: we ask them about films and concerts, never about people.

Your browser or the app loads posters from image.tmdb.org, artist images from the Ticketmaster image servers directly; on the web, the page also loads our font from Google Fonts (the app ships its font). Those requests leave your device, so those providers see your IP address and ordinary browser information. The data sources page says more about them.

The companies above operate worldwide, the United States included, so data handled on our behalf may be processed outside the country you live in.

Your account and the backups of it sit on our servers, operated on infrastructure we rent.

Your account and everything attached to it lives for as long as the account does.

You can delete the account yourself, from your profile page on the web or from the app. The account, your follows, your notifications, your sessions, your Google or Apple connection and your push devices go immediately and cannot be brought back.

Database backups held by our hosting provider may still contain a copy for a limited period afterwards, until they roll over. Resend keeps its own record of what it delivered, under its own policy. Server logs are kept for a limited time.

You can see and correct your address, your name, your language and your country on your profile page, and delete the account there or in the app. There is no export button: if you want a copy of what we hold, write to us and we will put it together.

You can object to what we do with your data, and you can complain to the data protection authority where you live. Anything else, write to us and we will answer.

We set only the cookies the site needs to work: one that remembers your language, your country, where to send you back after signing in and a follow you started before you had an account; one signed cookie that keeps you signed in; and the one that protects forms against cross-site submissions. There are no analytics cookies and no advertising pixels, which is why nothing asks you to accept anything.

PingWait is not directed at children under 16.

When this notice changes, the date at the top changes with it, and we write to you before a change that materially affects you.