Privacy Policy

Data we handle

• Account identity, email or phone number, username, profile name, settings, public profile photo, and private identity selfie.
• Your age-range attestation, AI-generation consent record, messages, reactions, replies, blocks, reports, device push token, and delivery or seen status.
• Photos, videos, GIFs, captions, thumbnails, filtered captures, generated media, game results, and the people or conversations you choose as recipients.
• Phone numbers from your contacts when you grant Contacts access. Address-book names and other people's photos stay on your device. If you grant Contacts access, phone numbers are sent to our servers over an encrypted connection in international format. We turn them into keyed hashes, coded values used for matching, and store only those hashes. If a contact card matches your number, you can confirm that photo as your public profile photo.
• Account-linked product events, device and app context, approximate region derived from your network address, and diagnostics used to operate and improve the service.

Pine does not store address-book names or photos of other people and does not create accounts for unregistered contacts.

Profile photo and visibility

Your Pine profile photo, display name, and username are public in the app and on web profile and invite pages. Link previews may show a live profile post or a heavily blurred version of your latest live post, including one sent to selected friends. Anyone with the link can view these previews without an account, and other services may cache them. A separate private identity selfie is used to include you in generated media while your consent is active; it is never displayed to another user.

You can replace either identity photo or revoke generation consent in Settings. Revocation removes both identity photos, disables future likeness use, and removes generated media containing you from the service.

Face data: collection, use, sharing, storage, and retention

What we collect. Pine collects the public profile photo you select, capture, or confirm from your own contact card, the private identity selfie you capture, and the facial likeness visible in generated media you create, receive, or appear in. Camera effects may process frames, facial or hand landmarks, face geometry, and depth estimates temporarily on your device. Pine does not upload or retain this live tracking data or use it to recognize your identity.

How we collect and use it. Pine displays your profile photo publicly. AI likeness use is optional. After you tap "Allow Face Data Use," Pine stores your separate identity selfie privately as the identity reference for fictional generated media. Pine operators may start curated generations, and an eligible mutual friend may choose you for a Pine-authored group-generation experience while your consent remains active. Operator-curated generation output is safety-screened before it can be sent. Mini-app generations, user-sent media, avatars, and identity photos are not sent to a moderation provider. Private identity selfies and live face-tracking data are not used for authentication, advertising, marketing, analytics, user profiling, or identifying anonymous people.

Where it is stored and shared. Convex stores identity photos and generated media, enforces mutual-friend and consent checks, and runs product workflows. Vercel AI Gateway and the configured OpenAI or Google Gemini model receive the prompt, request metadata, composition image, and private identity selfies needed for an operator-, self-, or mutual-initiated generation. OpenAI’s moderation endpoint receives operator-curated generation output for safety screening. A mutual friend can select your public profile but never receives your private selfie. PostHog receives your public profile photo URL as described below, but never your private identity selfie or live face-tracking data. These private inputs are not shared with advertisers, data brokers, or information resellers.

How long it is retained. In Convex, a current profile photo and identity selfie remain until you replace them, revoke consent, or delete your account; replaced files are deleted once unreferenced. A post expires for recipients after 24 hours, but expiry does not delete the stored file or your private archive. Generated media remains until a depicted person revokes consent, the sender removes it or deletes their account, or the service removes it. A depicted person deleting their account does not remove it. OpenAI’s moderation endpoint retains no customer content. OpenAI may retain generation customer content in abuse-monitoring logs for up to 30 days, and Google may retain generation prompts, images, and output for abuse monitoring for up to 55 days; either may retain data longer when legally required or necessary to prevent harm.

How data is used

We use this data to authenticate you, find mutual friends, provide private conversations and Pine camera experiences, create requested AI media, deliver photos, videos, messages, games, and notifications, power the widget and profile archive, and operate safety controls.

Before your private identity selfie is uploaded for AI use, Pine obtains explicit, versioned permission. While permission is active, Pine operators may include you in curated media, and mutual friends may select you in Pine-authored experiences that generate group photos or other media. Pine verifies the mutual relationship, active consent, and block status before resolving a private identity selfie on the server; the friend never receives the selfie. Generation sends only the references needed for that request through Vercel AI Gateway to the configured OpenAI or Google Gemini model. You can withdraw permission in Settings; withdrawal stops future use and removes both identity photos and generated media that includes you from the service.

AI-generated or AI-edited Pine photos and videos are fictional and must not be presented as real events.For experiences that use a friend's private identity selfie, AI instructions and templates are fixed by Pine; users choose an offered experience and eligible mutual friends. Pine does not send identity photos, avatars, user-sent artifacts, or mini-app generations to OpenAI’s moderation endpoint. Operator-curated generation sends the base image, prompt, request metadata, and depicted people’s private selfies through Vercel AI Gateway to OpenAI, with Google Gemini available after a safety refusal, and screens that output with OpenAI’s moderation endpoint before sending. Pine-authored group-generation experiences may send the selected mutuals’ private selfies, a fixed composition template, and a fixed prompt through the Gateway to the configured OpenAI or Google Gemini model. The selecting friend never receives the private selfies and cannot supply the generation instructions. Pine configures no-prompt-training and does not opt in to provider model training. OpenAI’s moderation endpoint has no abuse-monitoring retention. OpenAI may retain generation customer content for up to 30 days, and Google may retain Gemini generation content for up to 55 days, or longer when legally required or necessary to prevent harm.

Camera, microphone, speech-recognition, photo-library, motion, Contacts, and notification access is requested only when a feature needs it and depends on your device permission. Live camera effects may process frames, face or hand landmarks, and motion on the device. Ordinary captures are uploaded when you send them or set a profile photo. An AI experience may upload a photo for the requested transformation before you send the result.

Details: AI & likeness.

Messages, media, sharing, and providers

Inside Pine, posts are available to their intended friend recipients for 24 hours. Your archive is visible only to you. Comments and reactions on a post are visible to people who can access it; direct messages and private replies stay in the conversation. Public profile and link previews remain visible outside these in-app audience controls. Recipients or depicted people may save or share media outside Pine. Blocking either direction removes in-app shared-post access. Copies shared outside the service are controlled by the person who shared them, not by Pine.

Convex provides authentication, product data, realtime chats, file storage, and workflows; Twilio receives the phone number and verification metadata needed to deliver and validate one-time codes; Vercel provides hosting and AI Gateway; OpenAI generates some images and reaction suggestions and screens operator-curated generation output; Google Gemini generates media for configured experiences and may provide operator-generation fallback; Expo provides push delivery; PostHog provides analytics and diagnostics; Superwall supports optional Pine Plus purchase flows when enabled for an eligible account. Identity photos, avatars, user-sent media, mini-app generations, and private chat text are not sent to an automated moderation provider.

Pine requires its service providers to protect personal data consistently with this policy and applicable law. AI providers are not authorized to use the content we send for advertising or model training. Advertising measurement is described separately below. Review the Twilio privacy notice, Vercel privacy notice, OpenAI privacy policy, Google privacy policy, and PostHog privacy policy.

PostHog receives account-linked, allowlisted product activity and diagnostics, plus person profile fields needed for support (name, username, email, and public profile photo URL). It does not receive private identity selfies, generated or user-captured media, prompts, message text, contacts, address-book names, or private media URLs. Session replay is disabled and PostHog does not record screen, touch, or text capture.

Pine may ask for App Tracking Transparency permission on iOS. With or without that permission, Meta, TikTok, and Google/Firebase receive standard app install and conversion events (for example app open, completed registration, and onboarding completion) so Pine can measure advertising performance. Meta receives your account ID. TikTok receives your account ID, username, and hashed phone number or email for matching. Google/Firebase uses your phone number or email for on-device conversion measurement. Device advertising identifiers are used only when you allow tracking. Identity photos and live face-tracking data are never used for advertising. Review the Meta privacy policy, TikTok privacy policy, and Google privacy policy.

Retention and your choices

Contact hashes remain until your next sync, Contacts permission revocation, or account deletion. Current identity photos remain until replacement, consent revocation, or account deletion. Posts expire for recipients after 24 hours; your private archive and stored media remain until you delete them or another removal rule applies. Expiry is not deletion from our servers, saved copies, or third-party caches. Sent messages, media, results, and delivery metadata remain until sender removal, deletion of the sender account, service removal, or the applicable chat is deleted. A reported profile or media copy remains only while its report is open or under review, then is deleted when the report closes. Generated media containing you is removed after consent revocation.

Settings lets you revoke generation consent, change notification choices, block users, and permanently delete your account. Deletion immediately locks the account and begins durable removal of authentication, profile, contacts, relationships, devices, reactions, comments, replies, messages you sent, reports, identity photos, media you created, and linked PostHog people and events. Posts and generated media that other people created stay with them, even when they show or tag you. Deletion removes the link from that media to your account; the image itself does not change. Processor deletion may complete asynchronously. Limited records may remain when required by law, safety, fraud prevention, or backup rotation.

Age and safety

Pine is not intended for children under 13. Users aged 13–17 must attest that a parent or legal guardian permits their use and AI-likeness processing. Operator-curated AI generation output is screened before sending. Mini-app generations, user-sent images and videos, profile photos, private identity selfies, and private chat text are not sent to an automated moderation provider. Operators review reported content and can remove it or restrict accounts. Operators can inspect reported media, remove media or a profile photo, and suspend or restore an account with an audit history. Blocking remains available to every user.

Website visits

Vercel hosts this website and processes request information such as your network address, browser details, requested page, and request time to serve pages and protect the service. Public profile and invite pages load profile information from Convex. These pages do not embed the app's PostHog, Meta, TikTok, or Firebase analytics tools.

Contact

Pine is a product of Undefined Software, Inc.. Email alon@undefinedinc.io for privacy, deletion, safety, or support questions. Also review our safety policy.