Privacy Policy

Last Updated: July 19, 2026

PingTrix ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App") and our website.

1. Information We Collect

We collect information that you provide directly to us when you register for an account, such as:

  • User Profile: Name, email address, phone number, and password.
  • Safety Partner: The name, email address, and physical postal address of the one person you nominate. “Safety Partner” is the product term for your selected recipient.
  • Release Package: The note and supported documents you select for release. Sensitive vault payloads are encrypted before storage.

2. How We Use Your Information

We use the information we collect to operate and maintain our automated safety alerts:

  • To record your Pings and identify missed Ping schedules.
  • To send your Safety Partner a secure release invitation after the 7-day Ping window and 3-day grace period expire.
  • To optionally arrange a manually reviewed postal notice asking that contact to check their email; it never contains vault content.

3. Advanced Cryptographic Data Protection

We implement a strict cryptographic security system to ensure your highly sensitive data remains confidential, even in the event of database access:

  • Envelope Encryption: Vault payloads use unique data-encryption keys and authenticated encryption. Production vault keys are designed to be managed through a cloud key-management service.
  • Tamper Prevention: A server-side HMAC-SHA256 signature is calculated over the note's ciphertext. During decryption, this signature is verified. If the database row is tampered with by any unauthorized party, the signature fails validation and key release is blocked.
  • Field-Level Address Encryption: To protect your Safety Partner's privacy, postal addresses are encrypted at rest with a dedicated address key using AES-256-GCM.
  • Policy-Gated Release: Release workflows require the configured deadline and grace period to expire, then invite the selected contact through a verification step.
  • Verification Controls: One-time email codes and short-lived access sessions help protect sensitive actions and release access.