Effective date: July 25, 2026 · Contact: support@pingvuapp.com
pingVu is built so that your data stays yours. Everything the app records — signal quality history, coverage maps, reports, queued messages — is stored only on your device. The developer does not receive, store, or have any ability to access it, unless you explicitly opt in to sharing anonymous coverage data (below) — and even then, only measurements anonymized on your phone are transmitted. There are no analytics, no advertising SDKs, no tracking, and no accounts.
All of it is stored in the app's protected storage on your device, excluded from device backups where location-bearing, and none of it is transmitted to the developer.
Passive location records (quality samples, route events, connection checks) auto-delete after the period you choose in Settings ▸ Route collection (default 30 days; you can choose "until I clear it"). You can delete any category — or everything — at any time under Settings ▸ Your data. Deleting the app deletes all of it.
Like any app with maps and network testing, pingVu uses a small set of well-known services. None of these requests include your name, identifiers, or stored history:
This website (pingvuapp.com) uses no analytics, no advertising pixels, and no third-party trackers, and it sets no tracking cookies. Our hosting provider (Webflow) processes standard technical request data (such as IP addresses) to serve pages and protect the site, as any web host does.
Forms. If you submit a form here (such as the Android waitlist or a partner inquiry), we receive only what you type, and we use it solely to respond to you or to send the update you asked for. Form submissions are delivered to us by Webflow's form service and are never sold or shared.
Web connection test. The free test at pingvuapp.com/test runs entirely in your browser. It exchanges meaningless, fixed-size test data with Cloudflare's public speed service to measure your connection. Results are shown to you only — nothing is stored by, or sent to, pingVu, and web results never enter the shared cell service map, which is built only from hardware-attested app measurements.
Coverage map on this site. Viewing the map page requests the same aggregated, anonymous statistics described below and loads map imagery from OpenStreetMap under its usage policy. If you allow browser location, it is used only to centre the map on your area and is never stored or sent to pingVu. If you use the map's location search, your search text is sent to OpenStreetMap's Nominatim geocoding service solely to find matching places.
Location is used only for the features you turn on: SignalScout direction-finding, tagging reports and graph samples, dead-zone alerts, and route collection (Trip Mode / ambient sampling). Each background feature is off by default, requires "Always" permission that you grant in the Settings app, and shows the iOS location indicator while active. Your location history never leaves your device.
Feature status: the backend launched to production in July 2026. This section takes effect in the first released build that offers the sharing consent screen; the App Store privacy label is revised in the same release.
pingVu can contribute anonymous coverage measurements to a shared cell service map. This is off by default and only ever turns on after you read and accept an explicit consent screen in the app. You can turn it off at any time in Settings — uploads stop immediately.
What is shared when you opt in. Signal quality tier, network type (cellular or Wi-Fi), radio technology (e.g. 5G/LTE), connection-check measurements (speeds, latency, packet loss, estimated call quality), video streaming test results (startup time, interruptions, sustained quality — measurements only, never any video content), the category of connectivity reports you file (never the note text), an approximate map area of roughly 150 meters (a "geohash-7" cell), and a 15-minute time window. If — and only if — you have also enabled "Include carrier & device in reports", your selected carrier and device model are included.
What is never shared. Your exact coordinates, exact timestamps, name, phone number, contacts, IP-derived location, or any account or device identifier. There are no accounts. Anonymization happens on your phone, before transmission — the server never receives precise data and rejects any submission that isn't already coarse. Shared measurements appear on the shared cell service map only after enough separate reports cover the same area (a k-anonymity threshold), and the developer publicly commits to never attempting to re-identify contributed data.
Keeping fake data out (device integrity). Uploads are verified with Apple's App Attest, which lets Apple confirm to our server that the submission came from a genuine copy of pingVu on a real device. The cryptographic key this uses is stored in a separate trust system and is stripped before any measurement is stored — nothing in the coverage data links back to your device.
The deletion token — deleting what you've shared. When you opt in, your phone invents a random number (a UUID) called a deletion token and attaches it to the measurements you share. The token is stored nowhere but your phone. It is not derived from your device, your location, or anything about you, so knowing it tells the server nothing about who or what device produced it. It rotates every 30 days, which limits how much any single token could ever group together. Its only power is destruction: when you use Settings ▸ Your data ▸ Delete all app data, pingVu sends your tokens and the server permanently deletes every raw measurement they are attached to (completed within 72 hours). Aggregated map statistics — which contain no identifiers and no token — are not affected; they are anonymous by construction.
Retention. Raw anonymous measurements are retained for up to one year to build the coverage map, then archived; aggregated statistics are kept indefinitely. Your deletion right above covers everything the server could ever associate with your phone's tokens.
Availability note. Coverage sharing is currently offered to users in the United States.
Because the developer holds no personal data about you, there is nothing for us to disclose or correct on our side — you hold your data, and the in-app controls (Settings ▸ Your data) let you exercise that directly. If you opted in to sharing, the same "Delete all app data" control also erases your shared raw measurements from the server via your deletion tokens, as described above; the server holds no other data attributable to you. California residents: we do not sell or share personal information. EU residents: coverage sharing is currently offered in the United States; this section will be expanded before EU availability.
pingVu is not directed at children and does not knowingly collect information from anyone under 13.
Material changes to this policy will be posted here with a new effective date, and — for anything affecting what leaves your device — surfaced in the app before taking effect.
