Privacy Policy

Applies to: the pingVu app for iPhone, the pingVu app for Android and pingvuapp.com · Contact:support@pingvuapp.com

Contents: Short version · Who we are · On your phone · Permissions · Location · Calendar · What leaves your phone · Sharing coverage data · Deleting your data · Payments · This website · Test builds · How we use information · Who receives information · Security · Your rights · Children · Changes · Contact

The short version

pingVu checks whether your connection actually works, tells you when service comes back and helps you find better coverage. It is designed to keep your data on your phone.

• No accounts, ads, analytics or tracking. pingVu has no sign-up, contains no advertising, analytics or crash-reporting code, and doesn't track you across other companies' apps or websites. We don't sell your information.
• Your history stays on your phone. Signal history, location-tagged measurements, reports, planned calls and queued messages are stored on your device. We can't see them.
• Sharing coverage is optional and off by default. If you turn it on, the app sends connection measurements with a reduced-resolution location (an area about 150 meters across) and a 15-minute time window to help build the public coverage map. Reduced detail doesn't guarantee anonymity, so this policy spells out exactly what is sent, how long it's kept and how to delete it.
• Some requests always go to service providers. Maps, connection tests, integrity checks and our own servers are contacted during normal use. Like any internet request, they receive your IP address. They're all listed under What leaves your phone.
• You stay in control. Change permissions in your phone's settings at any time, and use Settings › Your Data (Android: Settings › Data Management) to delete what's on your phone and ask us to delete what you've shared.

Who we are and what this covers

pingVu is developed and run by Ralph Hewitt, an independent developer in the United States (“pingVu”, “we”, “us”). We are responsible for the information described in this policy. You can reach us at support@pingvuapp.com.

This policy covers the pingVu app for iPhone, the pingVu app for Android and the website pingvuapp.com. The two apps work the same way unless this policy says otherwise; notes marked iPhone or Android explain the differences. The Android app is currently in limited testing on Google Play.

What pingVu stores on your phone

pingVu keeps its records in the app's private storage on your phone, protected by your phone's built-in data protection. We have no access to it. Depending on the features you use, it holds:

• Monitoring history — connection-quality scores while pingVu monitors, and when each monitoring session started and when service came back.
• Location-tagged measurements — where you were (latitude, longitude and altitude), when, and how good your connection was. These are recorded by “Map my results” and the other features described under Location.
• Connection checks and video tests — speed, latency, jitter, packet loss, estimated call quality and video playback results, with the location where each one ran if location access is on.
• Reports — connectivity reports you file: the category, any note you type, the location and, if “Include carrier & device in reports” is on, the carrier you picked and your phone model.
• Queued actions — names, phone numbers and messages you save to send “when signal returns”. pingVu never sends them itself: it opens your Messages or Phone app and you tap send.
• MeetingScout plans — calls you plan, including details of calendar events you choose (see Calendar).
• Settings — your choices in the app, such as the carrier you selected, the calendars you include and whether you share coverage.
• Your contributions summary — if you share coverage, the app keeps a list of the ~150-meter areas you shared from. It uses the list to show how many areas you helped map and, optionally, a “Your areas” map layer. This list stays on your phone and is erased by “Delete all app data”.
• Deletion tokens and an integrity key — created only if you share coverage or use a feature that needs our server (see Sharing coverage data).
• Trial recap data — A tally of what the app did for you (counts only, with no locations or network names), used for your trial recap.

Home-screen widgets and, on iPhone, Live Activities show your current connection status using information already on your phone.

How long it's kept

• Location-tagged measurements, connection checks and video tests are deleted automatically. On iPhone you choose when in Settings: after 7, 30 or 90 days, or only when you clear them (the default is 30 days). On Android they are currently deleted after 30 days at most.
• Reports and monitoring sessions are kept until you delete them; the app keeps only the most recent ones (up to 500 reports).
• Planned calls and queued actions are kept until you delete them or they're used.
• You can delete any category, or everything, at any time — see Deleting your data.

Backups, new phones and uninstalling

• iPhone: the files holding your history are excluded from iCloud and computer backups. App settings are kept in standard app preferences, which are included in backups; they can include the carrier you picked, your calendar selections and the approximate location of the last automatic cellular check. Deleting the app removes its files, but iOS keeps the app's keychain entries (your integrity key ID and deletion tokens) on that phone, so if you reinstall, pingVu can still ask us to delete what you shared earlier. Keychain entries are not moved to a new phone.
• Android: history, reports, plans, settings and deletion tokens are excluded from Android backup and phone-to-phone transfer. Android's Auto Backup may still copy a few small preference files, including settings files used by the Google Maps component, to your Google account; downloaded map images are kept in temporary storage that isn't backed up. Uninstalling the app removes everything it stored on the phone, including your deletion tokens — so use “Delete all app data” first if you want your shared contributions deleted.

Permissions

pingVu asks for a permission when a feature needs it. Every permission is optional — only the features that need it stop working without it — and you can change your mind at any time in your phone's settings.

• Location — to record where measurements were taken, show your position, find better coverage nearby, plan calls and run background features. See Location.
• Notifications — requested when you first open the app, for back-online alerts, dead-zone alerts, Trip Mode and MeetingScout reminders. Notifications are created on your phone; pingVu doesn't use a push-notification service. MeetingScout reminders can show a meeting's title on your lock screen.
• Calendar — optional and read-only, for MeetingScout. See Calendar.
• Motion & Fitness (iPhone) — used only to detect driving for “Boost coverage while driving”. Motion data is not stored or sent.
• Phone status (Android 12 and earlier) — lets the Cellular Voice indicator check whether your phone is registered for calls. Nothing is stored or sent. Newer Android versions don't ask.
• Wi-Fi network name — iPhone and Android let apps read the name of the Wi-Fi network you're on only when precise location is allowed. pingVu shows it on the Monitor screen and never stores or sends it.
• Alarms & reminders and start-up (Android) — so MeetingScout reminders arrive on time, including after your phone restarts.
• Camera — only for HomeScout in test builds (see Test and beta builds).

pingVu never asks for access to your contacts, photos, microphone, Bluetooth or local network.

Location

Knowing where a connection worked is central to pingVu, so here is exactly how location is used.

Recorded on your phone

• “Map my results” (on by default). While monitoring is running and location access is allowed, pingVu records your location and connection quality every few seconds to build your personal coverage map. This creates a history of where you used the app.
• Checks, reports and video tests are tagged with the location where they happened whenever location access is allowed.
• “Check cellular while on Wi-Fi” (on by default). Up to 24 times a day, pingVu briefly tests your cellular connection while you're on Wi-Fi and, with “Map my results” on, records where it worked.
• Optional features — dead-zone alerts, Trip Mode, background coverage sampling and, on iPhone, “Boost coverage while driving” and “Log coverage at places you stop”.
• SignalScout uses precise location and your compass while you use it, to point you toward better coverage. Its results are never uploaded.

iPhone and Android differences

• iPhone: background features need “Always” location permission, which iOS asks you to confirm. First-run setup suggests turning on dead-zone alerts and driving boost; you can untick them there or turn them off later in Settings. iOS shows its location indicator while Trip Mode or driving boost is recording. If you turn on background checks, graph samples taken in the background include your location.
• Android: pingVu never asks for “Allow all the time” location. It records location while the app is in the background or the screen is off only during a monitoring session or Trip Mode that you start, and Android shows a persistent notification while it runs. On many Android phones the location service itself is provided by Google, under your phone's location settings.

When location leaves your phone

Your location history is never uploaded to us. Location information leaves your phone only in these ways:

• Coverage sharing, if you turn it on: areas about 150 meters across and 15-minute time windows. See Sharing coverage data.
• Coverage map lookups: a short code for a large area (roughly 20 × 40 km) around what you're viewing or planning.
• Maps and directions: the map areas you view (sent to Apple on iPhone and to Google Maps on Android) and, on iPhone, specific points sent to Apple for place names, travel times and parking searches. See What leaves your phone.

Your controls: turn off “Map my results” and the other location features in Settings, or change location access in your phone's settings. Turning a feature off stops future recording; to remove what's already recorded, use “Clear route & graph history” or “Delete all app data”.

Calendar (MeetingScout, optional)

Calendar access is optional and read-only. pingVu asks for it only when you choose to pick meetings from your calendar in MeetingScout or open the calendar settings for planned calls — never at launch. pingVu never adds, changes or deletes calendar events.

• Choosing events: pingVu reads your upcoming events so you can pick one. The list isn't saved.
• Saved with a plan: the chosen event's title, start time and calendar event ID. When you plan calls between meetings, also each chosen meeting's end time and location (address and map position). A meeting counts as in person when its location names a place, even if it also has a Teams or Zoom link; links, passcodes and other online-meeting details aren't used.
• Your calendar choices: the calendars or accounts you include are saved in the app's settings. On Android an account name can be an email address.
• Address lookups (iPhone): if a meeting you choose has an address but no map position, only the address text is sent to Apple Maps to find it.
• Travel and coverage: MeetingScout sends meeting and call-spot locations to Apple to estimate travel time (iPhone), and looks up the coverage map around them using large-area codes (see What leaves your phone).

Calendar details are never sent to pingVu. Plans stay on your phone until you delete them. You can turn calendar access off in your phone's settings at any time; entering call times by hand works without it.

What leaves your phone

pingVu contacts a short list of services. None of these requests contains your name, contacts, notes or stored history. Like any internet request, each one gives the receiving service your IP address and standard technical details, such as the app and operating-system version (and, on some Android requests, your phone model).

pingVu's servers (Amazon Web Services)

• Coverage map: showing community coverage on the map, using SignalScout or planning a call with MeetingScout asks our server for public coverage statistics for a large area (roughly 20 × 40 km), identified by a short area code. No identifier is sent, and the answer is the same public data everyone sees.
• Coverage sharing, only if you turn it on — see Sharing coverage data.
• Deletion requests, when you use “Delete all app data”.
• Help videos (iPhone): opening the help-video list asks our server for temporary links to all of the videos, so the request doesn't reveal which one you'll watch; the videos you play then stream from our content network. These requests use the integrity check described under Sharing coverage data, so the first time you open the list your phone registers its integrity key with our server, even if you don't share coverage. The app keeps no record of what you watch.
• Video test: streams a short test video (an excerpt from the open movie “Sintel”, © Blender Foundation, CC BY 3.0) from our content network, or Apple's public test stream as a fallback. It runs only when you tap it and can use tens of megabytes.
• Safety switch: at most every 6 hours when you open the app, pingVu downloads a small public settings file from our storage. It lets us turn off a malfunctioning feature remotely, and the request carries no information about you.

Connection tests

• Connectivity probes: to confirm that a connection really works, pingVu makes tiny secure connections (about 1 KB) to Apple's captive.apple.com while monitoring, during background checks if you turn them on, for the cellular check and in every connection check.
• Speed and packet-loss tests: each connection check downloads and uploads meaningless test data from Cloudflare's speed service (speed.cloudflare.com) and sends standard name lookups (DNS queries) for example.com to Cloudflare's public resolver, 1.1.1.1. These lookups aren't encrypted, but they contain no personal data. Checks run when you start one, when you file a report and, if “Auto-test on weak signal” is on (on by default on iPhone, off by default on Android), automatically when your signal is weak.

Apple (iPhone)

• Apple Maps: showing a map sends the area you're viewing. Tapping a point on a graph looks up its place name. MeetingScout looks up meeting addresses, estimates travel time from your current location to a call spot (and keeps that estimate up to date while a plan is active, in the background if “Always” location is allowed), and searches for parking near the spot. “Open in Maps” passes the spot and meeting locations to the Maps app.
• App Attest for the integrity check, and the App Store, which the app asks for subscription options and status.

Apple handles these requests under Apple's privacy policy.

Google (Android)

• Google Maps: the Android app's maps (the coverage map and MeetingScout's maps) are provided by Google Maps. Showing a map sends Google the area you're viewing, together with your IP address, phone and app details (such as phone model, Android version and map-component version), a random identifier the map component uses to count active users, crash reports, and how you move and zoom the map. Your readings, reports, checks and coverage areas are drawn on your phone; pingVu doesn't send them to Google.
• Google Play Integrity for the integrity check. The app may prepare this check with Google Play when you open Settings, before you decide whether to share.
• Google Play Billing for subscriptions.
• Directions: “Navigate” hands the call spot's location to Google Maps or another maps app on your phone.

Google handles these requests under Google's privacy policy.

Network and security records on our servers

Our servers don't store your IP address or device details with any of your data. To deliver responses and block abuse, our content network and firewall (Amazon CloudFront and AWS WAF) necessarily see your IP address: the firewall counts requests per IP address to enforce rate limits, and AWS keeps a small sample of recent requests, including IP addresses and request headers, for about three hours for security monitoring. Our service logs record technical events — such as which feature was used and whether it worked — without IP addresses.

When you contact us

“Email Feedback” opens your email app with a message to support@pingvuapp.com that includes the app version, operating-system version and your phone type or model; you can edit it before sending. We use your email only to reply to you. Our email is provided by Google Workspace.

Sharing coverage data (optional)

Coverage sharing builds the public pingVu coverage map shown in the app and on pingvuapp.com. It is off by default and turns on only after you review and accept the consent screen in the app — in Settings (iPhone: “Cell Service Sharing”; Android: “Share coverage data”) or, on iPhone, during setup or when you confirm that a status is accurate. Turning sharing on doesn't change your location permissions or start any background collection.

If sharing is off, the app may occasionally suggest turning it on right after a check, a back-online event or a report: at most twice a day, less often each time you choose “Not now”, and never again if you choose “Don't ask again”. Accepting still takes you to the full consent screen.

You can turn sharing off at any time in Settings. That stops further sharing and clears contributions waiting to upload. It doesn't recall anything already delivered or delete earlier contributions — use “Delete all app data” for that. If we change what is shared, the app pauses sharing until you accept the updated consent screen.

What is sent

For measurements taken after you turn sharing on that have a location — route samples from monitoring, Trip Mode and other location features, back-online events, connection checks, video tests and reports — pingVu sends:

• Where and when, at reduced resolution: an area about 150 meters across (a 7-character geohash) and the start of the 15-minute window the measurement fell in.
• The connection: network type (cellular or Wi-Fi), quality level, radio technology (such as 5G or LTE) and whether the connection was in Low Data Mode or metered.
• Whether you were staying put: if the phone stayed in the same ~150-meter area for about 45 minutes or more, the measurement is marked as taken while stationary. We use this only to keep places like your home or workplace off the public map (see How the public map is built).
• Results, depending on the measurement: how long an outage lasted (rounded to 30 seconds); speed, latency, jitter, packet loss and estimated call quality; video start-up time, interruptions and quality; the report category (never your note); and how the measurement was collected (for example monitoring, Trip Mode or background sampling).
• Carrier and phone model, only if you turn on “Include carrier & device in reports” (off by default). The carrier is the one you pick from a list; the model is a code such as “iPhone16,1” or “SM-G991U”.
• A deletion token, described below.

Never sent: exact coordinates, exact times, report notes, calendar details, queued messages, contacts, Wi-Fi network names or advertising identifiers. Most measurements upload in batches, but some, such as back-online events, are sent soon after they happen, so the time we receive them is close to when they occurred.

Reduced resolution does not guarantee anonymity. For example, measurements from the same 150-meter area at regular times could point to a place you visit often.

Deletion tokens

When you turn on sharing, your phone creates a random code — a deletion token — and attaches it to everything it shares. A new token replaces it about every 30 days, and your phone keeps a list of its tokens for 400 days. Each token is stored on your phone and with your raw contributions on our server. It isn't derived from your phone or anything about you, but it does group up to about 30 days of one phone's contributions together. We use it for two things: to let you delete those contributions later, and to count roughly how many different phones contributed to an area, and to recognize when one phone stayed in one place, so that sparsely shared areas and frequently visited places stay off the public map. We never publish tokens or token counts.

Keeping fake data out (device integrity)

Uploads, deletion requests and (on iPhone) help-video requests are checked to confirm they come from a genuine copy of pingVu on a real device — with Apple App Attest on iPhone and Google Play Integrity on Android. The first time, your phone creates an integrity key and registers it with our server; on Android, Google checks the app and device and gives our server its verdict. After that, each of these requests carries the key's ID, which is unique to that installation of the app.

Our server keeps a record for each key: its ID and public key, Apple's attestation receipt (iPhone) or Google's device and app verdict (Android), when it was created and last used, and counters used for rate limits. This record is kept separately from coverage data and isn't stored with your measurements. We keep it to protect the service, and it isn't removed by “Delete all app data”.

How the public map is built

Our server combines contributions from the last 90 days into statistics for areas about 150 meters across, with larger summaries for areas of about 1 km, 5 km and 150 km. A 150-meter or 5-km area is published only after it has at least 3 reports from at least 2 different 15-minute windows. That threshold counts reports, not people, so it can be met by a single phone's contributions.

A 1-km area is published only when, in addition, at least 15 different deletion tokens contributed to it in the last 30 days. Because each phone's token changes every 30 days, that means roughly 10 or more phones.

Places where a phone stays put (for example a home or workplace) are treated more strictly, at every level of detail. A measurement counts as taken at such a place when the app marked it stationary, or when the same phone reported from the same 150-meter area in at least 3 different 15-minute windows on one day. Such a measurement is never used on the public map within 24 hours. After that, it counts only toward areas with at least 15 different contributors in the last 30 days. Otherwise it is left off the public map entirely.

For each published area the map shows the number of reports, the mix of quality levels, a dead-zone score, typical time for service to return, typical speed, latency and call quality, and report counts per carrier (when that carrier has enough reports of its own). Deletion tokens and integrity keys are never published. We don't try to identify the people behind contributions.

How long shared data is kept

• Raw contributions, with their deletion tokens, are kept to build and improve the map. They currently have no fixed deletion date; after a year they move to archive storage. You can have them deleted at any time with your tokens (see Deleting your data).
• Area statistics are kept indefinitely. They contain no deletion tokens or integrity keys. Some cover areas below the publication threshold and are visible only to us.
• Operational records, which don't contain your deletion token: a copy of each contribution kept for 7 days to monitor the service; daily summaries kept for about 400 days (counts per area of roughly 20 × 40 km and per carrier, and which 150-meter areas had contributions that day); and occasional exports of individual reports (area, time window, carrier, phone model and results), with no fixed deletion date, that we use to calibrate pingVu's quality scores.

Only the developer can access raw contributions and operational records. All of this data is stored in the United States (Amazon Web Services, Ohio region).

Deleting your data

• On your phone: in Settings › Your Data (Android: Settings › Data Management) you can clear route and graph history, reports, sessions or planned calls, or choose Delete all app data. That erases your history, reports, plans, queued messages and waiting uploads. Your settings are kept, including your sharing choice — if sharing is on, it stays on with a new token.
• On our server: “Delete all app data” also sends the deletion tokens your phone has kept (up to 400 days' worth) to our server. Contributions with those tokens drop off the public map within about two hours, and the raw records are permanently deleted within 72 hours. This needs an internet connection and a working integrity check; if the request can't be sent, the app lets you try again.
• What deletion can't reach: contributions whose tokens your phone no longer has (older than 400 days, after moving to a new phone, or on Android after uninstalling); area statistics and operational records, which aren't linked to your token (the 7-day copy expires on its own); and the integrity key record. We keep each deletion request (the tokens and when they were received) for 35 days, plus up to 35 days in backups, to complete and confirm the deletion.
• Without the app: email support@pingvuapp.com. Because we don't know who you are, we generally can't find your contributions without your deletion tokens, but we'll help however we can.
• Uninstalling removes the app's data from your phone; see What pingVu stores on your phone for what remains.

Subscriptions and payments

Paid plans are sold through the App Store and Google Play. Apple or Google processes the payment and manages your subscription; we never receive your name, email address or payment details. The app checks your subscription on your phone using Apple's StoreKit or Google Play Billing, and no purchase information is sent to our servers. You can manage or cancel a subscription in your App Store or Google Play account settings.

This website

• No analytics, ad pixels or tracking cookies. pingvuapp.com is hosted by Webflow, which processes standard request data such as your IP address and browser type to serve pages and protect the site. Some page scripts and files are loaded from our storage on Amazon Web Services and from cdnjs (Cloudflare).
• Forms: if you join the Android waitlist (email address) or send a partner inquiry (name, email address and message), Webflow delivers it to us. We use it only to reply or to send the update you asked for, and we'll delete it on request.
• Coverage map: loads the same public coverage statistics from our server as the app, loads map images from OpenStreetMap's tile servers and, if you search for a place, sends your search text to OpenStreetMap's Nominatim service. The page asks your browser for your location to center the map; if you allow it, your location stays in your browser and is used only to choose which area to load (that area's code is sent to our server, like any map view).
• Connection test (pingvuapp.com/test): runs in your browser, exchanging meaningless test data with Cloudflare's speed service and streaming a test video from our content network (or Apple's public test stream). Results stay in your browser: nothing is stored by pingVu, and web results never go into the coverage map.

OpenStreetMap services are run by the OpenStreetMap Foundation under its privacy policy.

Test and beta builds

Test versions distributed through TestFlight or Google Play testing can include features that aren't in the public app, and unlock paid features without a purchase. The main one is HomeScout, which uses the camera and augmented reality (Apple ARKit and RoomPlan on iPhone; Google Play Services for AR on Android) to map Wi-Fi and cellular quality room by room. HomeScout maps are stored on your phone and leave it only if you export them. Google Play Services for AR is provided by Google and may collect data under Google's privacy policy.

How we use information

We use the information described in this policy only to:

• run the app's features on your phone;
• build and publish the coverage map from contributions you choose to share;
• protect pingVu from fake data and abuse;
• check and improve the accuracy of pingVu's measurements; and
• reply when you contact us.

We don't use it for advertising or to build profiles about you, and we don't combine it with information from other sources.

Legal bases (EEA, UK and Switzerland). We rely on your consent for coverage sharing — you can withdraw it at any time in Settings, which doesn't affect sharing that happened before. We rely on performing our agreement with you to provide the features you use, and on our legitimate interests in keeping the service secure and reliable (integrity checks, rate limits, network and security records), operating and improving the coverage map and pingVu's measurements, and keeping statistics and operational records. Your phone's permission prompts control access to location, calendar and other phone features.

Who receives information

We don't sell personal information and we don't share it for targeted advertising. Information goes only to:

• Our service providers: Amazon Web Services (servers, storage, content delivery and security), Webflow (website and forms) and Google Workspace (email).
• Platform and measurement services, when you use the features that need them: Apple, Google (including Google Maps in the Android app), Cloudflare and the OpenStreetMap Foundation (for the map on our website), as described above, under their own privacy policies.
• Everyone, but only as the aggregated coverage statistics described above.
• Authorities or others, if the law requires it or if it's needed to protect the rights, safety or security of users, the public or pingVu.
• A successor, if pingVu is ever sold or transferred. This policy would continue to apply to information collected under it.

Where information is processed. pingVu is run from the United States, and our servers and service providers process information in the United States. If you use pingVu from another country, your information is processed in the United States, where data protection law may differ from the law where you live.

Security

Connections to our servers are encrypted (TLS 1.2 or later), data on our servers is encrypted at rest, and access is limited to the developer. On your phone, pingVu relies on the operating system's app sandbox and data protection. No method of storing or sending information is completely secure, but we work to protect what we hold.

Your choices and rights

• Permissions: change them at any time in your phone's settings.
• Sharing: turn it off at any time in Settings.
• See and delete your data: almost everything is on your phone, where you can see it in the app and delete it as described above.
• Requests to us: you can ask to access, correct, delete or receive a copy of information we hold, object to or restrict how we use it, or withdraw consent, by emailing support@pingvuapp.com. We'll respond within one month. Because pingVu has no accounts or names, we can usually act only on server data you can point us to — for example, through your deletion tokens in the app.
• US state privacy rights: residents of California and other states with privacy laws have the right to know about, access, correct and delete their personal information, and not to be treated differently for using these rights. We don't sell or share personal information or use it for targeted advertising or profiling. If we decline a request, you can appeal by replying to our decision.
• EEA, UK and Switzerland: you can also complain to your local data protection authority.
• Global Privacy Control and Do Not Track: pingVu doesn't track you or sell data, so there's nothing for these signals to switch off.

Children

pingVu isn't directed at children under 13 (or under 16 in the EEA and UK), and we don't knowingly collect personal information from them. If you think a child has shared information with us, contact us and we'll help delete it.

Changes to this policy

We'll post any changes here with a new version number and effective date. If a change affects what leaves your phone, we'll describe it in the app (for example in What's New), and if it changes what coverage sharing sends, sharing pauses until you accept the updated consent screen.

Contact

Questions or requests about privacy: support@pingvuapp.com. pingVu is run by Ralph Hewitt, United States.

Earlier versions of this policy: 1.1 (October 6, 2026) and 1.0 (July 25, 2026).