The public website
The website is generated statically and does not set a consent cookie, advertising cookie, analytics identifier, or account session. Cloudflare can process standard network and security data needed to deliver the site, such as IP address, requested URL, time, and abuse signals, under its role as hosting and security provider.
An optional analytics interface is reserved in documentation but disabled. If privacy-respecting measurement is considered later, it must be documented before activation and must not introduce cross-site advertising tracking.
Desktop data that stays on your Mac
- Favorite and recent test coordinates.
- Approximate address labels returned by the configured geocoding provider.
- Redacted activity events and errors.
- Appearance, onboarding, map, and simulation preferences.
- Short-lived device and tunnel state.
- A one-line recovery marker that says restore is required, without a device identifier or coordinate.
Settings can delete local history, favorites, activity, or all local data independently. The packaged Python runtime belongs to PinShift and does not modify the user's global Python installation.
When the desktop app contacts another provider
| Feature | Default provider | Data sent | Purpose |
|---|---|---|---|
| Map tiles/style | OpenStreetMap tile service, with OpenFreeMap as the interactive fallback. A separately configured build may use Mapbox. | Standard web request, visible tile region, referrer where allowed, IP address, and other network metadata. | Render the visible map and required attribution. |
| Address search | Nominatim / OpenStreetMap Foundation, unless a separately configured build selects Mapbox. | The search text you submit and standard network metadata. | Return matching places. |
| Reverse geocoding | Nominatim / OpenStreetMap Foundation, unless separately configured. | The coordinate you selected when address resolution is requested, plus standard network metadata. | Return an approximate place label. |
| Street routing | FOSSGIS Valhalla service at valhalla1.openstreetmap.de. | The selected route stops, travel profile, and standard network metadata. | Calculate street-following route alternatives. |
| Developer support image | DeveloperDiskImage on GitHub, as selected by the pinned device tooling. | The GitHub repository-tree request and the iOS-version-specific image request needed by the tooling; GitHub also receives standard network metadata. | Obtain a missing compatible Developer Disk Image. No Apple ID or GitHub account is required by PinShift. |
These requests are subject to each provider's policy, including the OpenStreetMap Foundation privacy policy, OpenFreeMap privacy policy, and GitHub Privacy Statement. PinShift does not batch-upload local history. Manual coordinates remain available when search is unavailable, and cached support resources permit more offline use.
Device identifiers and diagnostics
The native adapter must use the connected device identifier while communicating with Apple's local device service. The UI receives a masked form. Technical output redacts UDID-like strings, home-directory paths, usernames, temporary paths, and coordinate-shaped values before normal display or export.
Never include a full identifier, Apple credential, exact private coordinate, pairing record, or personal path in a support report.
Security boundaries
PinShift does not bypass passcodes, Trust, Developer Mode, Activation Lock, MDM, code signing, or Apple restrictions. It does not access other people's locations, install hidden persistence, or request an Apple ID. See the security model for the native/webview and process boundaries.
Retention and deletion
The site itself does not maintain a PinShift user profile. Desktop retention is controlled locally through Settings and by uninstalling the app and removing its documented app-data directory. A recovery marker remains only until a clear operation is confirmed or the user deliberately removes local app data.
Changes to this notice
Material privacy changes must appear in the dated changelog and in this notice before the behavior is enabled. New analytics, accounts, telemetry, providers, or automatic updates require a separate review.