Privacy Policy

Last updated 12 November 2026

PinStellation helps you keep track of the pins you own, want and trade. This page says what the app keeps about you, why, who else is involved, and how to delete it. We don't sell your data, we don't show ads, and the app has no trackers or analytics.

What we keep

• Your account. Your email address and display name. If you sign in with a password, we keep only a salted hash of it, never the password itself. If you sign in with Apple, we keep the id Apple gives us for you and the email Apple shares. If you chose to hide your email, that's Apple's relay address.
• Your profile. Your bio, your profile photo, whether your profile is private (it is unless you change it), and whether your name shows on pins you add (it doesn't unless you turn it on; otherwise they read "a collector").
• Your collection. The pins you own, want or have for trade, your notes, your grails, and the photos you add of a pin's front, back and condition.
• Your copy. For each pin in your collection, you can note when you got it, where, how (bought, traded, a gift, a mystery pack) and what you paid, in which currency. When you mark a pin as sold, we keep when you did, and what you sold it for if you say. When you record a trade, the pins you got are filled in as traded, on the trade's day, unless you'd already said how or when. Only you see these. No other collector does. Later, prices from at least 5 collectors may be shown combined, as a range, never per person.
• Match credits. When you add a pin someone else put in the catalog, from a scan or because the app found it was already there, we note that their pin helped: your account, the pin, your copy of it and the day. That's what the "helped" counts on pins people add are made of. They never show your name.
• Your collector page, if you turn it on in Profile › Your collector page: whether it's on, which parts it shows, and when its link was made. The link itself is stored so that our database alone can't open your page.
• Your trade journal. What you write about each trade: who it was with, where and when, your notes, a photo, and the pins that changed hands.
• Trade matching, if you turn it on: your answers to the 18+ questions and when you gave them (never your birth date), whether you're open to trades, the area you picked, your trade note, your trade number, the offers you send and get, and the trades you agree. The handle you share on a trade is deleted when that trade is done, called off, closed or blocked. If the other trader reports that trade, the report keeps a copy of your handle for the reviewer until the report is closed.
• What you add to the catalog. Pins and photos you add, corrections you suggest, and the flags and votes you leave on catalog photos. When you add a front photo to a pin that's already in the catalog, the app may also send that pin's cutout twice, set on white and with its background removed, and the fingerprint worked out from it. If they pass our checks, we keep the fingerprint and the cutout with your photo, and every collector who opens that pin can see the cutout.
• Suggested details, with Plus. When you tap Suggest details while adding a pin, the app sends the pin's fingerprint, a short code worked out from its cutout, and what you've typed so far: the name, character, series and year. Once you've said yes to Look this pin up?, it also sends the cutout itself: only the pin, set on plain white, never the rest of your photo. It goes to our server, which puts it at an unlisted address made of random characters for the few seconds of the search. A search service, SearchApi or SerpApi, gives that address to Google Lens, which fetches the cutout from it to search with. The address stops working when the search ends, after 5 minutes at most; then we delete the cutout. We look for the series and year among similar pins already in the catalog, a computer of ours reads the titles of the web pages Google finds to suggest the name, character, series and year, and we use what you typed only to check whether the pin is already there ("Is it this one?"). We don't keep the cutout after the search. We keep a record of each time you ask: that code, what we suggested and where each suggestion came from, whether it worked, and when. We use it only to show you the suggestions, to note which details of a pin you add came from them, to limit how many you can ask for a day, and to give no stardust for a correction that only repeats something we suggested to you. The fingerprint and what you typed aren't kept. Each record is deleted after 7 days, or sooner if you delete your account. When a pin you add keeps a suggested detail, the catalog notes where that detail came from, without your name.
• Scan cutouts for the catalog, while Add my scans to the catalog is on. It's on until you turn it off in Profile › Privacy. When you confirm a scan as a pin that's already in the catalog, the app sends the pin's cutout twice: set on white, and with its background removed. Collectors see the one with its background removed. Only the pin's cutout is used, never the photo you took. We add it to the catalog as a photo you added if the pin has no photos yet, or if it closely matches the pin's photos and either the pin has fewer than two, yours is clearer than its best one, or yours gives the pin its first cutout. If not, it's deleted straight away. A clearer cutout of yours later replaces your earlier one, which is then deleted. We note each cutout the app sends (the pin, whether it was added, and when) to limit how many a day. Each note is deleted after 48 hours, or sooner if you delete your account.
• Stardust and Plus. A record of the stardust you earn and spend. Pins you add that are merged as duplicates or removed after review lose their stardust. Stardust can't be bought and has no value outside the app. When you spend stardust in the shop, we keep what you bought, the sky you put on, the names you give your stars (only you see them) and any weeks of Plus you bought with it. For Plus, we keep when your account got its founding mark, and when you tapped Join free for the beta, if you did.
• Scan fingerprints. For each scan, we keep a small record so we can measure how well matching works and make it better: the scan's fingerprint (a list of numbers the app works out from the pin's cutout, not the photo), the pins the app showed and how closely each matched, the pin you chose and how you found it (first in the list, lower down, by searching its name, or added as a new pin), and how the scan was made (camera or your photos, the phone model, the iOS and app versions, which chip made the cutout, and whether you drew the cutout yourself). We keep these for every account, whether or not Help improve recognition is on, because matching pins is what the app is for. We use them only to measure and improve matching. They're never shown to other collectors, and they're kept until you delete your account.
• Scan data, while Help improve recognition is on. It's on until you turn it off in Profile › Privacy. It covers the photos and crops from your scans, the camera settings they were taken with, your answers when the app asks whether a match is your pin, and reports from board scans that stopped early. We use them only to make recognition better. Copies used for that carry a scrambled id, not your name or email. Scan fingerprints, above, are kept either way; they hold no photo.
• Where you find pins, while Share where I find pins is on. It's on until you turn it off in Profile › Privacy. When a scan in a theme park shop finds a pin, we keep the pin, the shop (or just the part of the park, when your phone can't tell which shop), whether the pin looked for sale, and when you scanned it. Your phone works out the shop from where you are. Your location itself and your photo never leave it.
• App diagnostics, while Send app diagnostics is on. It's on until you turn it off in Profile › Privacy (or in Profile, while you look around without an account), and it's apart from Help improve recognition. About once a day, again when something about how the app runs changes, and when you tap Send diagnostics now, the app sends a short report on how it runs on your phone: the phone model (like "iPhone14,7") and how much memory it has, the iOS and app versions, which chip each recognition model runs on and why, how long they take to load and run, how much memory is free, how warm the phone is, whether Low Power Mode is on, whether the app closed unexpectedly last time, whether you allowed the camera, your photos, your location and notifications (only whether you did, never a photo or where you are), the kind of network it sends on, and for each day, how many scans you made and how long they took, and how many uploads the app made and how fast they went. It also lists your last 50 scans: for each, when it ran, whether it was one pin or a board, whether the photo came from the camera or your photos and its size, how many pins it found, and how long each step took (never the photo, the pins or where you were). You can turn this list off in Profile › Privacy and keep the daily numbers. It never holds a photo, your location, your phone's name or anything else that identifies your phone. If you're signed in, the report is linked to your account; if not, it's kept without one. Reports are deleted 30 days after they arrive. We use them only to fix problems and make the app work on more phones. When you turn it off, the app stops sending them.
• Reports and blocks. Reports you send, who you've blocked, and messages you send us.
• Feedback. When you send feedback from the app, we keep what you wrote, the screenshot if you added one, the email you gave if you're signed out, and, when Include diagnostics is on, your app and iOS versions, your iPhone model and one app diagnostics report; we use it only to fix the app and to answer you, and delete it when you delete your account, a year after it's closed, or a year after you sent it if it's still open then.
• Notifications. If you allow notifications, the id Apple gives your phone for them and the app version, your notification switches, and your notifications. One that can't go out within 7 days is dropped. Sent and dropped ones are deleted 30 days later. We also note which "helped" milestones we've told you about, so you don't hear about one twice. Signing out removes your phone's id. If your phone is offline then, we remove it once Apple tells us it's no longer in use.
• Sign-in sessions. Each phone you sign in on gets a session that lasts 14 days. We keep only a hash of it. If you reset your password, every session ends.
• Sign-in limits. To slow down password guessing, we briefly count sign-in tries, reset codes, requests for suggested details, scan cutouts sent to the catalog, searches by name from a scan, Still here and Gone answers, the feedback you send, signed-out lookups, scan fingerprints, the pin sightings you send, app diagnostics reports and visits to our public web pages per account and per network address. The counts are stored scrambled, only the last hour of them is used, and older ones are deleted as new ones come in.
• Reset codes. When you ask for one, we keep only a hash of the 6-digit code. It stops working after 15 minutes, after 5 wrong tries, or when you ask for a new one.
• Server logs. Our server records requests, including the network address they came from and your account id, so we can keep the service running and find problems. We keep these logs for no more than 30 days, and then they're deleted automatically.

Photos and location

The app removes location from every photo before it leaves your phone. If it can't, it doesn't send the photo. Our server also turns away scan photos that still carry a location.

Your photos are stored on our own servers. Photos in your collection, your trade journal and your profile are yours and stay private. A photo you add to the catalog is shown to every collector who opens that pin. Right after you add it, it's checked automatically for explicit content (see OpenAI, below). If the check flags it, only you can see it until a reviewer looks at it.

Where you find pins

Other collectors see these sightings on pin pages and in the Parks tab: the pin, the shop, whether it was for sale, and about when. They never see your name or anything that ties a sighting to you, and a sighting shows up only after a short delay, so it can't tell anyone where you are right now. We keep which account sent each sighting only to stop repeats and floods. Sightings are deleted 30 days after the scan. Deleting your account removes any link to you straight away; the sightings, which never showed your name, expire within 30 days. Turning Share where I find pins off stops new sightings. Earlier ones still carry no name and are deleted on the same 30-day schedule.

If you're in a park shop with Share where I find pins on, you can tap Still here or Gone on a pin seen there. We keep that answer with your account in the same way as a sighting, only to stop repeats and floods. Others see only that the pin was confirmed or marked gone, with no name, after the same delay and with rounded times. Answers are deleted 30 days after you give them.

When you correct where a scan was (the shop, or that a pin wasn't the shop's), we keep that correction privately with your account for up to 30 days to check and improve how the app reads shops and cards. It's never shown to anyone, and deleting your account deletes it.

Adding your scans to the catalog

Add my scans to the catalog is on for every account until you turn it off in Profile › Privacy. While it's on, a clearer cutout of a pin you scanned may be added to the public catalog, where every collector who opens that pin can see it, like a photo you add yourself. Only the pin's cutout is used, never the photo you took. A cutout earns stardust when it's added and again if it becomes the pin's main photo, once per pin. Turning it off stops new cutouts from being sent. Cutouts already added stay in the catalog, and stay without your name if you delete your account. To have one taken down, report it from the pin's page.

Turning off scan sharing

When you turn off Help improve recognition, we stop keeping new scan data from you. Scan data sent while it was on stays until you delete your account. Scan fingerprints are still kept, as they are for every account: they hold no photo, and they go when you delete your account.

Who else is involved

• Resend sends the email with your reset code and our answers to your feedback. It gets your email address and the message.
• Cloudflare sits in front of our server and passes every request on. It sees your network address and each request, including what's in it, on the way through. Cloudflare keeps its own logs under its own policy.
• Apple, if you use Sign in with Apple. When you delete your account, we ask Apple to end PinStellation's access to your Apple ID.
• Apple's notification service delivers notifications to your phone, if you allow them. It gets your phone's notification id, the notification's words, and which page in the app it opens.
• OpenAI checks each photo you add to the catalog for explicit content, right after you add it. It gets the photo, never your name or your email. OpenAI says it doesn't keep photos sent for this check or use them to train its models.
• SearchApi and SerpApi run the searches for Suggested details, if you said yes to them, one when the other can't. Each gets the unlisted address of the pin's cutout (SerpApi sometimes the cutout itself), only the pin on plain white, never your photo, your name or your email. Each has Google Lens search with it, and gives us the titles and links of the pages that match. Google fetches the cutout from that address, or gets it from SerpApi. Each keeps what it receives under its own policy.

Nobody else gets your data, except where the law requires it.

Who can see what

Your collection, notes, trade journal, stardust and scan data are yours. Other collectors see pins and photos you add to the catalog, and your name on them only if you turn that on. No other collector ever sees your scan fingerprints.

Your collector page is off until you turn it on. Then anyone you give its link to sees your name, your bio and the parts you chose: your shelf, your pins for trade and, if you turn it on, your wish list. If your account is from the beta, a founding mark shows beside your name. It never shows your notes, what you paid or sold pins for, where you got pins, your own photos or your email. Search engines are asked not to list it. Making a new link stops the old one working at once, and turning the page off hides it.

Trade matching is off until you turn it on in Profile › Trade matching. Then other traders whose lists match yours see what leaves your account: your first name and your trade number (like "Maya #4821"), an area if you picked one, a trade note if you wrote one, your pins for trade, the pins of theirs you want (or your whole wish list, if you switch that on), the month you started and how many people you've completed trades with. They never see your notes, prices, photos, places, your trade journal or your email, and your collector page link never appears in trading. The one handle you share on an agreed trade is seen only by the other trader, and is deleted when the trade ends; a report about that trade keeps a copy for the reviewer until it's closed. Turning matching off hides you at once.

When you block someone, you stop seeing their name and photos in credit and pin history. In trading a block works both ways, whoever made it: you leave each other's matches, open offers between you close, and any handle you shared is deleted.

Every catalog pin has its own public web page with its catalog picture, name and facts. It never says who owns it.

A reviewer, one of the people who run PinStellation, can see reports, photos the automatic check flags and what was reported, to act on them.

Getting a copy of your collection

Go to Profile › Privacy › Export my collection. It makes a spreadsheet of every pin in My Pins, with your notes and your copy's details. You can leave out what you paid. The app makes the file on your phone, and it goes only where you send it. Photos aren't in it. For anything else we keep about you, write to us and we'll send it.

Deleting your account

Tap Delete account at the bottom of Profile, under Account. It removes, from our server:

• your collection, notes and photos, including condition and back photos
• your trade journal
• your profile, bio and profile photo
• your collector page and its link
• your trade profile, and the offers and trades you're part of (the other trader loses them too). Your trade number is never given to anyone else.
• your scan data, match answers and match credits
• your scan fingerprints
• the notes of the scan cutouts your phone sent to the catalog
• your requests for suggested details
• any link between you and the pin sightings you sent (the sightings, which never showed your name, expire within 30 days)
• any link between you and the Still here and Gone answers you gave (the answers, which never showed your name, expire within 30 days)
• the corrections you made to where a scan was
• the app diagnostics reports your phone sent while you were signed in
• reports you sent, blocks, messages to us, and corrections you suggested
• your password, your Apple sign-in, any reset codes and every session
• your notification switches, your phones' notification ids, your notifications (sent or not) and the milestones we've told you about
• your stardust record, including what you bought in the shop, your sky and your star names, and your Plus record and founding mark

Pins and photos you added to the catalog stay in the catalog, without your name, including cutouts added by Add my scans to the catalog. Reports other collectors sent about you are closed, except a report about a photo that stays in the catalog, which a reviewer still reads. Older backup copies can hold your data until they're replaced.

Children

PinStellation isn't meant for children under 13, and we don't knowingly keep data about them. If you think a child has an account, write to us and we'll delete it.

Changes

If this page changes, the date at the top changes too.

Contact

Write to support@pinstellation.com.