Last updated: 13 September 2026
Boujee Unicorns, LLC operates PinBack and this website. This policy explains how we handle information when you use the PinBack app, its supporting service, our website or our support channels.
PinBack does not sell personal information or display advertisements. Its app does not contain advertising or analytics trackers. Technical records needed to operate the service are described below.
What we collect and why
Your account
We store your email address, account identifier, name if supplied through sign-in, and account and sign-in timestamps. Clerk handles passwordless sign-in using a code sent to your email. PinBack does not store an account password.
Your pins
We store the content you deliberately share, forward, paste or type: titles, notes, source text snippets, links, source-app labels, categories, priorities, actions, deadlines, reminders, repeat rules, status and any “waiting on” information. This information may include personal information about you or other people. We use it to save, organize and synchronize your pins and provide the features you choose. Your pins are associated with your account and are not published to other users.
Photos and device storage
Attached image files stay in the app’s storage on the device where they were captured; PinBack does not upload those files for cross-device synchronization. A local file-path reference is stored with the pin and can sync even though the image itself does not. The app also keeps local pin data, settings and pending changes for offline use.
Forwarded email and daily summaries
Your private forwarding address and allowed-sender list let the service turn eligible forwarded emails into pins. Resend receives the forwarded message. Our service records message identifiers, sender addresses, subjects, forwarding aliases, processing outcomes and related pin/account identifiers. It retrieves message content to create the pin. Mail from an unapproved sender does not become a pin, but a record of the rejected delivery can still be retained. Rejection does not immediately erase Resend’s copy.
If you enable daily summaries, we use your chosen recipient address, timezone, schedule and relevant pin content to prepare and send them. We retain delivery records, including dates, message identifiers and item counts, to prevent duplicates and investigate delivery problems.
Settings, support and technical records
We store your capture defaults, source visibility, timezone, notification and quiet-hours settings, summary preferences and AI permission settings. We process your correspondence if you contact us. Our hosting, authentication and email providers process network and service information, such as IP addresses, request times, device/browser information, sign-in events and delivery outcomes. Operational logs may contain account identifiers, email metadata, error details or portions of an AI response when parsing fails. We use these records for delivery, security, troubleshooting and abuse prevention.
PinBack does not continuously read your mailbox, messages or social accounts. It receives content you submit through its capture features. Device permissions let you choose particular content or receive reminders; they do not give PinBack unrestricted access to all your conversations.
Optional AI suggestions
AI suggestions are off until you give permission. When enabled, an app capture can send the item’s text, shared link, source-app hint, timezone and current date to OpenAI’s API to suggest a title, category, priority, action and deadline. PinBack does not send your entire pin list for that request. Names, email addresses or other personal information contained in the submitted text or link may be sent. Do not include information you do not want processed by the AI provider.
You can turn this off in Settings → AI suggestions without deleting your account. After the change is saved, new suggestion requests are disabled; it does not recall requests already sent. You can still create and edit pins manually. Suggestions may be wrong, so review them before relying on them.
Who processes information
| Provider | Purpose and information |
|---|---|
| Clerk | Sign-in and account identity; email, supplied profile details and authentication/security records. |
| TiDB Cloud | Database storage of account records, pins, preferences, sender lists and email/delivery records. |
| Railway | Runs the API server; processes requests, pin and account content, and operational logs. |
| Resend | Receives forwarded email and sends daily summaries; processes addresses, message content and delivery records. |
| OpenAI | Processes the per-item information described above when AI suggestions are enabled. |
| Website delivery and Google Fonts | Website delivery involves ordinary network requests. This website requests fonts from Google, which receives network information such as your IP address and browser request headers. |
We use service providers for these functions rather than making your pins public. Information may be processed in the United States and other countries where providers operate. We may disclose information when legally required, to investigate abuse or protect rights and safety, or in connection with a business transfer, subject to applicable law and appropriate protections. A business transfer does not by itself authorize materially different uses of your information.
Retention and deletion
Active pins and account settings are retained while needed to provide your account. Individual deleted pins are initially marked deleted for synchronization and become eligible for permanent removal after 30 days. Email-capture records become eligible for removal after 90 days. Scheduled cleanup performs those removals; they are not promises of deletion at an exact hour.
The in-app account-deletion process permanently removes pins, account preferences, forwarding configuration, associated email-capture and summary-delivery records, and the account record from the active PinBack database. The process also requests removal of your Clerk sign-in identity. If deletion fails or access remains, contact us so we can investigate and complete the request.
Account deletion does not instantly remove provider logs, provider-retained email or backup copies. Support correspondence is handled separately. These records may remain as needed for security, resolving requests or legal obligations and under the providers’ retention arrangements. Copies you exported, emails already delivered, and device or operating-system backups are separate from the active account. See Delete Account for steps and local-device considerations.
Your choices and rights
Use Settings → Privacy & data → Get a copy of my data to copy or share a JSON export of your account, preferences, stored pins (including retained deleted pins), allowed senders and associated email-capture records. This export does not include local image files, provider logs, support correspondence or summary-delivery history. See Your Data for details and additional requests.
Use Settings → Privacy & data → Delete my account to initiate permanent account deletion in the app. You can edit or delete individual pins, disable AI suggestions, turn off daily summaries or change notification permissions separately.
For access, correction, deletion, portability, restriction or objection requests, where available under applicable law, email privacy@boujeeunicorns.com. We may need to verify your identity. We respond within the periods required by applicable law and explain any permitted refusal or extension. You may ask us to review a refusal by replying with “Privacy appeal.” Where applicable, you may also complain to your data-protection authority. Exercising a privacy right will not result in unlawful discrimination.
Security
We use authenticated access and encrypted connections to help protect information in transit. No service can guarantee absolute security. If a security incident requires notification, we will notify affected people and authorities as applicable law requires.
Children
PinBack is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided information, contact us to request investigation and removal. Additional age or parental-permission requirements may apply where you live.
This website
The site’s own code does not use advertising, analytics, contact forms or tracking cookies. Hosting and font requests still involve technical information as described above. Selecting an email link opens your email service; anything you choose to send becomes correspondence. Linked third-party sites handle your visits under their own policies.
Changes and contact
We will update the date when this policy changes and give notice of material changes as required. Where new processing requires consent, we will ask before starting it; continued use alone does not replace that consent.
Boujee Unicorns, LLC
privacy@boujeeunicorns.com