Privacy Policy

Last updated: August 13, 2026

This "Privacy Policy" describes how Cardinal Blue Software ("Cardinal Blue", "we", "us", or "our") protects your privacy when you use the DearPins mobile app and the dearpins.com website (each, a "DearPins Service" and collectively, the "DearPins Services"). Other mobile and web applications developed by Cardinal Blue Software are governed by their own privacy policies.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE DEARPINS SERVICES, YOU AGREE TO BE BOUND BY THE TERMS AND CONDITIONS DESCRIBED HEREIN AND ALL TERMS AND CONDITIONS INCORPORATED BY REFERENCE. IF YOU DO NOT AGREE TO ALL OF THE TERMS AND CONDITIONS SET FORTH BELOW, YOU MAY NOT USE THE DEARPINS SERVICES.

This Privacy Policy applies to information (including Personal Information) collected through the DearPins Services. For the purpose of this Privacy Policy, "Personal Information" means information that identifies you personally, either alone or in combination with other information available to us, as more fully described in the section "What Data We Collect & How". Personal Information does not include technical, device, or usage information that cannot be used to identify you personally, nor does it include "aggregate" information, which is data we collect about the use of the DearPins Services or about a group or category of services or users, from which individual identities or other Personal Information have been removed. This Privacy Policy in no way restricts or limits our collection and use of aggregate and non-personal information, and we may share such data about our users with third parties for various purposes. This Privacy Policy is part of and incorporated into DearPins' Terms of Service.

Data Privacy

Our Basis to Collect Your Personal Information

Our lawful bases for processing your Personal Information include (a) where you have provided consent for one or more specific purposes, (b) where processing is necessary for the performance of a contract with you, (c) where processing is necessary to comply with a legal obligation, and (d) where processing is necessary in furtherance of our legitimate interests, or those of a third party, provided that the protection of your interests and fundamental rights and freedoms do not conflict with our or such third-party interests.

DearPins Services are not directed at children under the age of 13, and we do not knowingly (i) collect any information that would be deemed personal information under the U.S. Children's Online Privacy Protection Act from children under 13 or (ii) allow children under 13 to use the app without verifiable parental consent. If we become aware that we have inadvertently collected personal information from a child under 13 without proper consent, we will delete that information promptly. We do not knowingly "sell," as that term is defined under the California Consumer Privacy Act (the "CCPA"), the Personal Information of minors under 16 years old who are California residents.

Your Rights as Data Subject

As the data subject, you have the right to grant or decline consent to our terms and policies. The following are the rights you can exercise regarding your information:

• The right of access. You have the right to know how your data is being processed, and you can also request access to your data.
• The right to be informed. You have the right to be informed by Cardinal Blue Software of the changes we make regarding the collection and processing of your information.
• The right to rectification. You can obtain rectification of inaccurate Personal Information from us in a timely manner.
• The right to erasure. You have the right to have your data erased when the Personal Information is no longer necessary, when you withdraw consent to our terms and policies, or when your Personal Information has been unlawfully processed.
• The right to restriction of processing. You have the right to restrict our processing of your data when the accuracy of the data is contested by you.
• The right to portability. You can request that we transfer any of your data held by us to another company.
• The right to object. You have the right to ask us to stop processing your data.
• The right not to be subject to automated individual decision-making, including profiling.
• The right to withdraw your consent at any time — where we rely on your consent as the legal basis for processing your Personal Information.

What Data We Collect & How

Account Information

When you sign in to DearPins with your Apple or Google account, we receive authentication information from Apple or Google such as your name, email address, and an account identifier, and we store your display name and avatar as part of your DearPins profile.

Content You Create

DearPins is a shared pinboard: the content you post — photos, notes, links, and voice recordings — is pinned to a board and stored on our servers so that it can be synced to and viewed by every member of that board. We also store the boards you create or join, board names and backgrounds, the arrangement of posts on a board, and board membership information.

If you upload photos that include children under the age of 13, you must obtain permission from a parent or legal guardian before submitting such content.

We do not perform facial recognition on your photos. We do not create numeric encodings, embeddings, or other derived representations of faces that could be used to identify a person, and we do not use your content to identify anyone.

Device Permissions

• Photo library. We access your device's photo library only with your explicit permission, when you choose photos to pin to a board.
• Microphone. We access your microphone only with your explicit permission, when you record a voice post.
• Camera. We access your camera only with your explicit permission, for example to scan a board invite QR code.
• Notifications. With your permission, we store a push notification token for your device so we can notify you about activity on your boards, such as new posts.

Usage Information

The information we collect from you includes the country you set your device to, the language you use on your device, the type and version of the operating system of your device, and your device model. We collect this information to improve our app's overall performance and the service we provide. We analyze this information with tools provided by third-party companies, including Google and Amplitude.

Local Storage on the Website

The dearpins.com website stores a small preference (such as your chosen language) in your browser's local storage. It is not used to identify or track you.

TrueDepth Camera Data

Our app does not collect, store, or utilize TrueDepth camera data or Apple's Face ID-related depth and facial mapping data. We do not use any ARKit or Vision-based facial tracking APIs, nor do we access any system-level facial geometry data derived from Apple's TrueDepth camera.

How We Use Your Personal Information

We use Personal Information collected through the DearPins Services with your permission:

• To provide you with the DearPins Services. This includes signing you in, syncing your boards and posts across devices, and showing board content to the members of each board.
• To notify you and other board members about board activity, such as new posts, where you have granted notification permission.
• To communicate with you. We may use your contact information to send communications about critical elements of the DearPins Services, such as technical issues or security alerts.
• To process your requests and transactions, and to keep your content connected to your account.
• To improve the DearPins Services.
• To customize the services we provide to you.

We do not sell your Personal Information, and we do not use your content or Personal Information to serve you third-party advertising.

With Whom We Share Your Personal Information

Content you pin to a board is shared with the other members of that board, as described above.

Personal Information (and non-personal information) collected through the DearPins Services may be shared with companies and organizations that perform services on our behalf. Our services are operated on Google Cloud Platform and Firebase (Google LLC), which store and process your account information and content. Usage analytics are processed by Google and Amplitude. These providers are contractually obligated to handle user data in accordance with applicable privacy laws and industry standards.

We may also disclose the Personal Information we collect through the DearPins Services to government authorities, industry peers or other third parties when we, in good faith, believe (i) there has been a violation of our terms, policies, or the law or (ii) disclosure is required to:

• comply with a legal obligation;
• protect and defend our rights or property;
• detect, investigate or prevent fraud or other illegal activity;
• protect the safety, security, and integrity of our products, employees, users, or the public;
• protect against legal liability;
• provide you with services in the app.

If we are going to release your information in response to a legal process, our policy is to provide you with reasonable advance notice under the circumstances unless we are prohibited from doing so by law or court order. We may disclose your information without giving you prior notice if we believe it is necessary to prevent imminent and serious bodily harm to a person. Your Personal Information and other data collected by us may be transferred to another company that has acquired our stock or assets, for example, as a result of a sale, merger, reorganization, dissolution or liquidation. If such a transfer occurs, the acquiring company's use of your Personal Information will still be subject to this Privacy Policy.

How To Modify or Delete Your Data

We respect your right to make choices about the ways we collect, use and disclose your Personal Information. You may update or modify your information, change your privacy preferences, or request deletion of your Personal Information at any time by emailing us at support@cardinalblue.com.

You can delete your account directly in the app: open the menu and select "Delete Account." If you're unable to use the in-app option, contact us at support@cardinalblue.com from the email address associated with your account and we will delete it for you. Note that we cannot delete your Personal Information except by also deleting your account, and that content other members have posted to shared boards is not part of your account and will not be deleted. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

Data Retention and Deletion

The content you create is retained on our servers only as long as we require in order to provide the DearPins Services to you, or to fulfill other legitimate business purposes such as resolving disputes, ensuring safety and security of our products, employees, users, or the public, or complying with our legal obligations. How long we retain Personal Information depends on a number of factors, including:

• our purpose for processing the Personal Information;
• the amount, nature, and sensitivity of the Personal Information;
• the potential risk of harm from unauthorized use or disclosure of the Personal Information;
• any related legal requirements to which we are subject.

You can delete individual posts you have created within the app at any time. When you request deletion of your account, we will delete your profile, push tokens, activity logs, and other account-associated data we store for you on our systems (including data stored on Google Cloud Platform / Firebase). Any board that only you belong to is deleted along with its content. Posts and comments you left on boards you share with others are kept for those members to see, with your name and profile removed from them, unless we are required to retain certain data for legal reasons or for any of the other reasons listed in "With Whom We Share Your Personal Information" above. We also retain moderation records after account deletion — including any content reports filed against or by you, the text of the reported content, and a reference to any reported photo or voice recording (which may no longer be accessible once the underlying file is deleted) — for safety and abuse-prevention purposes.

Data Storage and Transfer

Your information as outlined in this Privacy Policy is stored, processed and transferred to the United States, Taiwan and any other country or jurisdiction where Cardinal Blue Software, its subsidiaries, service providers and affiliates maintain facilities or employ staff. By agreeing to the terms in this Privacy Policy and by using DearPins Services, you agree to these transfers of data taking place.

If you reside in the European Economic Area (the "EEA"), the United Kingdom, or Switzerland, your Personal Information may be processed on servers located outside these regions for the purposes set out in this Privacy Policy. Although data protection laws vary by country and may not provide the same level of protection as in your home country, we apply the safeguards described in this Policy to your information regardless of where it is processed. When transferring information outside the EEA, the UK, or Switzerland, we rely on the following transfer mechanisms to comply with applicable data protection laws:

• We rely on the European Commission's adequacy decisions pursuant to Article 45(1) GDPR when transferring your information to any country that has been considered to provide an adequate level of protection.
• For other jurisdictions, we rely on the Standard Contractual Clauses as approved by the European Commission pursuant to Article 46(2)(c) of the GDPR and on the UK Data Transfer Addendum.

For more information or to obtain a copy of the appropriate safeguards we have in place when transferring your information, please contact us using the information at the bottom of this document.

Security of Your Personal Information

We take reasonable security and organizational measures to protect your Personal Information (including preventing the loss, misuse, unauthorized access, disclosure, alteration and destruction of your Personal Information) in accordance with the laws that govern the jurisdiction in which you are located. For example, we use industry standard encryption when transferring your data in and out of the DearPins Services, and access to board content is restricted to that board's members by server-side security rules. However, we cannot guarantee that unauthorized third parties will not be able to defeat our security measures. If you believe your account has been compromised, please advise us immediately.

A Note to California Residents

If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your Personal Information (if any) by Cardinal Blue Software to third parties for the third parties' direct marketing purposes. To make this request, please email support@cardinalblue.com or contact us at: Cardinal Blue Software, P.O. Box 390677, Mountain View, CA 94039. If you are a California resident under the age of 18, and a registered user of any site where this Privacy Policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to support@cardinalblue.com. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

A Note for EU Residents

If you are in the EU and have concerns about our data practices, you have the right to lodge a complaint with your local supervisory authority.

Changes to This Privacy Policy

We may change this Privacy Policy from time to time. If we make any changes to this Privacy Policy that we think materially alter your rights, then we will post the latest policy to this site and change the "Last updated" date above. We encourage you to review this Privacy Policy whenever you visit the DearPins Services to understand how your personal information is used.

Questions

If you have any questions about this Privacy Policy, please contact us:

By email: support@cardinalblue.com
By mail: P.O. Box 390677, Mountain View, CA 94039, USA