How we process personal data when you sign in to Pinpoint Review and collaborate on shared projects.
The data controller for this service is: Christian Pucci.
Contact for privacy, access, correction or deletion requests: minimante.info@gmail.com.
Pinpoint Review is a collaboration application hosted on a server managed by the controller and available at pinpoint.fans.
When you sign in with Google, we receive the information needed for authentication from your verified Google identity: account identifier, name, email address and profile picture, if available.
Collaboration data may include invitees’ email addresses, invitation status and expiry, project memberships and roles, page URLs, screenshots of pages under review, annotation coordinates and content, task priorities and status, assignments, comments and dates.
We also manage session identifiers, temporary authentication tokens and technical connection information that the web server may log, such as IP address, time and requested URL.
Screenshots may contain personal information visible on external pages. Project creators should avoid including confidential or unauthorized content.
The optional Pinpoint Capture extension browses and captures pages in the user’s local Chrome browser. It temporarily applies the selected desktop, tablet or mobile resolution and sends a JPEG screenshot only after an explicit capture command. The screenshot passes through the Pinpoint server’s memory and is saved in the uploader’s Google Drive, in the Pinpoint folder, using that account’s storage. The server retains file identifiers and metadata, without saving new persistent image copies. Website cookies, credentials and browsing sessions normally stay in the user’s Chrome profile and are not uploaded to Pinpoint. Screenshots themselves may contain personal information visible on screen.
A temporary, single-use code valid for 5 minutes pairs the extension with the account. The extension stores a revocable access token locally, valid for up to 90 days, to list authorized projects and upload screenshots. The connection can be revoked in the app or disconnected in the extension. Earlier versions may have retained Chromium profiles on the server; administrators must remove any unneeded legacy profiles separately.
We use these data to verify identity, provide invitation-based project access, collect feedback, assign work, manage permissions and protect the service against unauthorized access.
Depending on the relationship with the user, processing supports the requested service and pre-contractual or contractual activities (Article 6(1)(b), GDPR), and/or the legitimate interest in securely managing collaboration (Article 6(1)(f)). Legal obligations are addressed under Article 6(1)(c).
The application does not carry out automated decisions with legal effects or advertising profiling.
Pinpoint uses data received from Google APIs only for authentication, storing screenshots in the user’s own Drive and collaboration in authorized projects. This use complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data are not sold or used for personalized advertising, creditworthiness assessments or lending.
Project data are available to authorized participants according to their role. Google authenticates users and receives information relevant to authentication under its own terms and policies.
Pinpoint Capture loads websites in the user’s local browser. Those websites receive the browser’s usual connection information, which does not necessarily include the VPS IP address. Screenshots pass through Pinpoint over HTTPS and are stored in the uploader’s Drive. Pinpoint requests the Google drive.file permission to manage app-created files, without making images public. Authorized members view files through Pinpoint’s project access controls and do not gain access to the rest of the Drive. Required Google tokens are stored encrypted on the server. Revoking Google access may make screenshots unavailable until the account owner reconnects. When email invitations are configured, messages pass through the controller’s SMTP provider. The VPS provider and any DNS/proxy service may process technical data needed to provide the service.
Transfers outside the EEA by external providers depend on the configured services and their safeguards. Contact the controller for information about applicable safeguards.
Web sessions last up to 7 days. Extension tokens last up to 90 days and are revocable. Invitations expire after 7 days, although their metadata may remain until the project is deleted or an administrative cleanup occurs.
Account data, projects, annotations, screenshots and any legacy session information are retained as needed for collaboration, until project deletion or a legitimate removal request is fulfilled, subject to applicable retention obligations. Archiving makes a project read only without deleting data. Permanent deletion removes project data from the app; backups may retain copies until expiry or scheduled removal. Nginx log and backup retention depend on the server’s administrative configuration.
New screenshots are retained in the uploader’s Google Drive. Removing a screenshot or permanently deleting its project also deletes the associated Drive files managed by Pinpoint, provided the connection remains authorized. Files from earlier versions may stay on the server until transferred. The transfer function uploads them to the project owner’s Drive and removes each local file after a successful upload. Existing backups may still contain local copies until they expire.
The application uses HTTPS, protected session cookies and server-side permission checks. No online system can guarantee absolute security.
Where provided by the GDPR, you may request access, correction, erasure, restriction, portability or object to processing. You may also complain to the Italian data protection authority or the competent supervisory authority.
Send requests to: minimante.info@gmail.com. The controller will assess them under the applicable legal deadlines and retention obligations.