Privacy Policy

Last updated 20/08/2026

Last updated: August 20, 2026

This policy describes how the Park Pin application (the “App”) processes users’ personal data, wherever they are in the world. It is drafted using Regulation (EU) 2016/679 (“GDPR”) — one of the strictest privacy laws globally — as its baseline standard, supplemented with the additional disclosures required by major non-European laws (including the California Consumer Privacy Act / CPRA for California and the Lei Geral de Proteção de Dados / LGPD for Brazil; see section 9).

1. Data controller

The data controller (under California law: the “business”; under the LGPD: the “controladora”) is:

Sara Nicastro — individual developer Contact email: saranicastro.sn@gmail.com

Given the small, single-person scale of this operation and the absence of large-scale or systematic data processing, no Data Protection Officer is required under Art. 37 GDPR. All requests and questions can be addressed directly to the email above.

2. Core principle: your data stays on your device

Park Pin is designed around the principle of data minimization:

• It does not require any account.
• It does not collect data for advertising or profiling purposes.
• It does not use analytics, tracking, or advertising tools.
• It does not sell or share personal data with third parties for commercial purposes (no “sale” or “sharing” within the meaning of the CCPA/CPRA).
• It does not transmit your parking location to any server operated by the controller: the controller operates no servers and does not — and cannot — receive your location.

All parking-related data is stored exclusively locally on your device.

3. Data processed

3.1 Geographic location (GPS)

To perform its essential function — saving the spot where you parked and guiding you back to your car — the App requires the precise location permission (ACCESS_FINE_LOCATION).

• Your location is captured only when you tap the save button (in the App or in the widget), for a few seconds.
• The App does not track your location in the background and does not record your movements.
• The saved coordinates (latitude, longitude), the derived address, and the parking date/time are stored only on the device and are deleted when you save a new parking spot, cancel the current one, or uninstall the App.

3.2 License and purchase data

To manage the 14-day free trial and the one-time purchase (see the Terms and Conditions), the App processes:

• locally on the device: the date of the first saved parking spot and the license activation status;
• via RevenueCat (see section 4.4): a pseudonymous user identifier generated by the App, the purchase receipt issued by Google Play, and basic technical information (device type, language, App version), solely to verify and restore the purchase.

The controller never receives payment data (card numbers, bank accounts, billing addresses): these are processed exclusively by Google Play.

4. Third-party services

Although it has no servers of its own, the App relies on a few third-party services that are technically necessary for its operation. These parties process data either as independent controllers or as processors/service providers (within the meaning of the CCPA), under their respective privacy policies:

4.1 Google Play Services (location and geocoding)

Location capture uses the Google Play Services location services on your device. In addition, to convert coordinates into a readable address (reverse geocoding), the coordinates are processed by the Android Geocoder service, which on devices with Google services may involve sending the coordinates to Google’s servers. Google privacy policy: https://policies.google.com/privacy

4.2 OpenStreetMap (maps)

When you use the manual location correction screen, the App downloads map images (tiles) from the servers of the OpenStreetMap Foundation. On that occasion your IP address and the map area you are viewing reach OpenStreetMap’s servers, as with any Internet request. OpenStreetMap Foundation privacy policy: https://osmfoundation.org/wiki/Privacy_Policy

4.3 Google Play (distribution and payments)

The App is distributed via Google Play. The one-time purchase at the end of the trial period is processed by Google Play Billing: the controller neither receives nor stores any payment data. Google Play privacy policy: https://policies.google.com/privacy

4.4 RevenueCat (purchase management)

The App uses RevenueCat, Inc. (a US company) as a service provider for validating, managing, and restoring in-app purchases. RevenueCat receives a pseudonymous user identifier, the Google Play purchase receipt, basic technical device information and — as with any Internet communication — the IP address the request originates from; it does not receive your name, email, payment data, or your parking location. RevenueCat processes this data on behalf of the controller as a data processor / service provider. RevenueCat privacy policy: https://www.revenuecat.com/privacy

4.5 External navigation apps

When you tap “Take me to my car”, the App opens the navigation application installed on your device (e.g. Google Maps) and passes it the parking coordinates. From that point, processing is governed by the privacy policy of the navigation app you chose.

4.6 Android system backup

The App allows Android automatic backup (allowBackup). If you have enabled device backup on your Google account, the App’s local data (including the last saved parking location) may be included in the encrypted backup managed by Google. You can disable backup in your device’s Android settings.

5. Purposes and legal bases of processing

You can revoke the location permission at any time in your device settings. Without it the App cannot save your location, but revoking it has no other consequence.

6. Data retention

• Parking location: on the device, until a subsequent parking spot is saved, the current one is manually cancelled, or the App is uninstalled.
• Local license data: for as long as the App is installed.
• Purchase data held by RevenueCat and Google Play: for as long as necessary to guarantee purchase restoration and to comply with legal obligations, under their respective retention policies.

Uninstalling the App deletes all local data (except for any system backups, see section 4.6).

7. Security

Parking data never leaves the device and is protected by the Android system’s sandboxing and encryption mechanisms. Communications with third-party services take place over encrypted connections (HTTPS).

7.1 Data breach notification

Although the App’s core parking data never leaves your device, the service providers listed in section 4 do process certain personal data on the controller’s behalf. In the unlikely event of a security incident affecting your personal data, the controller will notify the competent supervisory authority and affected users without undue delay and within the timeframes required by applicable law (for example, within 72 hours to the supervisory authority under Art. 33 GDPR; within 5 days under South Korea’s PIPA; without delay under Art. 57 of China’s PIPL), including the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Our service providers are contractually required to notify the controller promptly of any breach affecting the data they process on our behalf.

8. Your rights (all users)

Wherever you are, we grant every user the rights to:

• access the personal data processed;
• rectification of inaccurate data;
• erasure of data;
• restriction of and objection to processing;
• data portability;
• withdrawal of consent at any time (via device settings, for location);
• non-discrimination for exercising these rights.

Because parking data resides exclusively on your device, you can exercise most of these rights directly and autonomously: by viewing the saved location, cancelling the parking spot, or uninstalling the App. For purchase data managed via RevenueCat (pseudonymous ID and receipts), you can request access or deletion by writing to saranicastro.sn@gmail.com; we will respond within the timeframes required by applicable law (30 days under the GDPR, 45 under the CCPA, 15 under the LGPD).

We use no automated decision-making and no profiling.

9. Additional information for specific jurisdictions

9.1 European Economic Area, United Kingdom and Switzerland (GDPR / UK GDPR / FADP)

All preceding sections apply in full. You also have the right to lodge a complaint with the competent supervisory authority: in Italy the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), in the United Kingdom the ICO (ico.org.uk), in Switzerland the FDPIC (www.edoeb.admin.ch).

9.2 California, USA (CCPA/CPRA)

In the last 12 months the App has processed the following categories of personal information:

• We do not sell or share personal information, including that of consumers under 16.
• Precise geolocation is used solely to provide the service you request and never leaves the device: a “Limit the Use of My Sensitive Personal Information” link is therefore not required.
• Retention periods for each category are set out in section 6.
• You have the right to know, delete, and correct your personal information, and to non-discrimination for exercising these rights. You can exercise them by writing to saranicastro.sn@gmail.com, including through an authorized agent; we will verify identity via the App’s pseudonymous ID.
• Because we do not sell or share personal information and the App contains no tracking technologies, opt-out signals such as the Global Privacy Control (GPC) do not apply.
• The same protections are extended to users in other US states with comparable privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, etc.); where those laws so provide, if we deny a request you have the right to appeal by replying to our communication, and to contact your state’s Attorney General.

9.3 Brazil (LGPD — Lei nº 13.709/2018)

The legal bases for processing are set out in section 5. In addition to the rights in section 8, you have the right to obtain information about the entities with which data is shared (see section 4), to request the anonymization or blocking of data processed in a non-compliant manner, and to lodge a complaint with the ANPD — Autoridade Nacional de Proteção de Dados (www.gov.br/anpd). The “encarregado” (DPO) is the controller herself, reachable at the email in section 1.

9.4 Canada (PIPEDA) and Australia (Privacy Act 1988)

We process personal data in accordance with the principles of consent, minimization, purpose limitation, and transparency required by these laws. Canadian users may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); Australian users may contact the OAIC (www.oaic.gov.au).

9.5 Japan (APPI), South Korea (PIPA), China (PIPL), India (DPDPA 2023)

• Precise location — considered sensitive personal information or subject to separate consent in some of these jurisdictions (e.g. PIPL in China, PIPA in South Korea) — is processed exclusively on the device, subject to explicit, separate consent given through the Android location permission, which can be revoked at any time.
• We do not transfer personal data outside your country, except as technically necessary for the third-party services listed in section 4 (whose cross-border transfers are described in section 11).
• You may exercise the rights of access, correction, deletion, and consent withdrawal provided by your local law as described in section 8, or contact the competent authority of your country (PPC in Japan, PIPC in South Korea, CAC in China, Data Protection Board in India).

9.6 Other jurisdictions

For any jurisdiction not expressly mentioned, we apply as a minimum standard the GDPR protections described in this policy and the rights in section 8, to the extent permitted by local law.

10. Children

The App is not directed at children under 13 (or the different minimum age set by local law, e.g. 14 in Italy, 16 in some EU countries) and does not knowingly collect data from children. As there are no accounts and no server-side data collection, the controller has no way to determine users’ ages; if you believe a child has provided us with personal data, contact us and we will delete it.

11. International data transfers

The controller does not directly transfer any data abroad. The third-party services listed in section 4 (Google, OpenStreetMap Foundation, RevenueCat) have offices or servers outside your country, in particular in the United States. Such transfers take place in compliance with the safeguards required by applicable law: for EEA/UK/Swiss users, adequacy decisions (including the EU-U.S. Data Privacy Framework) or standard contractual clauses; for Brazilian users, the mechanisms provided by Arts. 33 et seq. LGPD.

Itemized detail of each overseas recipient, as required for example by Art. 28-8 of South Korea’s PIPA and Art. 39 of China’s PIPL:

Retention periods for each recipient are as set out in section 6. The rights described in section 8 and, where applicable, section 9.5 may be exercised with respect to these overseas recipients by writing to the email in section 1 or section 13.

12. Changes to this policy

The controller may update this policy, for example in connection with new App features or legal developments. The updated version will be made available on the App’s Google Play listing and/or within the App, with the last-updated date shown. Material changes to processing will be given appropriate prominence.

13. Contact

For any questions about this policy or to exercise your rights: saranicastro.sn@gmail.com