Who we are
PingCrood — the Android app, PingCrood Web and this site — is operated by Fawad Iqbal ("PingCrood", "we"). For anything about your data, write to contact@fawadiqbal.dev.
What PingCrood stores
Only what the features need. Here it is, feature by feature.
| Area | What | Why |
|---|---|---|
| Account | Email address, password (stored as a bcrypt hash — we can't see it), username, display name, the date you joined. | To create your account, sign you in and send verification and password-reset codes. |
| Profile | Photo, cover photo, about, status line, birth date, and — if you add them — gender, city and country, languages, interests, what you're here for, prompts, occupation, phone number. | Your birth date confirms you're 18 or over and shows your age. The rest is shown to others according to your settings; in Random Match you choose whether age, gender and city appear. |
| Messages and media | Text, photos, files, voice notes, locations, reactions, stars and pins, in one-to-one chats and groups. | Stored on PingCrood's servers so messages reach devices that are offline, sync to PingCrood Web and can be searched. View-once and disappearing messages are removed as designed. |
| Calls | Who called whom, when, how long, and how it ended. Call audio and video are not recorded. | Call history and ringing. Media travels encrypted between devices; when a direct path isn't possible it passes through our relay server, still encrypted. |
| Random Match | Your filters, and a record of each match: who, when, how long, how it ended (Next, disconnect, normal). | To pair you, to never match you with someone you've blocked, and to act on reports. |
| Status | Your text or photo status and who has viewed it. | Stories that expire after 24 hours; seen rings. |
| Friends and blocks | Friend requests, your friends list, people you've blocked. | To connect you and to keep blocked people away from you — including in Random Match. |
| Devices and sessions | For each sign-in: device name, IP address, when it signed in and was last active; linked web browsers. | Shown to you in Active sessions and Linked devices, so you can spot and sign out anything you don't recognise. |
| Notifications | A push token for each phone. | To deliver messages and ring calls when the app is closed, through Firebase Cloud Messaging. |
| Reports | The reason you chose, your note, and a snapshot of what was reported. | So admins can judge fairly. Deleted automatically after 30 days. |
PingCrood never reads your phone's contacts — you find people by username, QR code or Random Match.
What we don't do
- No ads, and no advertising identifiers.
- No analytics or tracking SDKs — in the app, in PingCrood Web or on this site. This site sets no cookies at all.
- We don't sell your data, share it with data brokers, or use it to build advertising profiles.
- We don't send marketing email. The only email you'll get is about your account: verification codes, password resets, email-change confirmations and account deletion.
How we use it
To run PingCrood: deliver your messages and calls, pair you in Random Match, show your status to the people you chose, keep your account secure (sessions, two-step verification, spotting abuse), review reports, and answer you when you write to us. Nothing else.
Who sees what
Other people
What others see is set by you: Everyone, My contacts or Nobody for last seen and online, profile photo, about and status; who can add you to groups; who can call you. Photo and status are visible to contacts only by default. In a Random Match the other person sees your display name and, if you allow it, your age, gender and city, plus your languages, interests and prompts.
PingCrood's admins
Your messages are encrypted in transit and stored on our servers so we can deliver them. They are not end-to-end encrypted. We don't read them in the normal course of things; a message, status or call becomes visible to an admin only when someone reports it, and that snapshot is deleted after 30 days.
Service providers
Each gets only what its job needs: Oracle Cloud hosts the servers and stored media; Google Firebase Cloud Messaging delivers push notifications (it sees a device token, not your messages); our email provider delivers account emails; Google Play distributes the app.
Legal requests
We'd disclose data only if required by a valid legal process, and we'd tell you unless the law prevents it.
How long we keep it
| Data | Kept until |
|---|---|
| Messages and media | You delete them (for you or for everyone), the chat's disappearing timer runs out, or a view-once item has been viewed. |
| Status | 24 hours after you post it, or when you delete it. |
| Reports and their evidence | 30 days, then deleted automatically. |
| Sessions and linked devices | Until you sign them out (a changed password signs out every other device). |
| Your account | When you delete it, there's a 14-day grace period in which signing in undoes the deletion. After that your personal data — email, name, photo, phone, two-step secret — is permanently removed. Messages you sent stay in your friends' conversations, without your profile. |
| Sign-ups that never verified | Removed after 7 days. |
Security
- Every connection uses HTTPS or secure WebSockets; call media is encrypted in transit (WebRTC).
- Passwords are hashed with bcrypt. Two-step verification with any authenticator app is available, with printable recovery codes.
- You can see every signed-in device and sign any of them out instantly, and a new password signs out everything else.
- Admin actions are logged. Accounts that break the Community Guidelines can be suspended, which signs them out everywhere.
Your controls
- See and edit your profile, privacy settings and read receipts in the app under You.
- Block and report from any profile, chat, status, call or match.
- Sessions and devices: You → Active sessions, and You → Linked devices.
- Change your email (confirmed by a code sent to the new address) and password; turn two-step verification on or off.
- Delete your account from the app. Signing in within 14 days undoes it; after that it's permanent.
- Ask us for a copy of your data, a correction, or anything this page doesn't answer: contact@fawadiqbal.dev. Write from the email on your account so we can be sure it's you.
Children
PingCrood is for people aged 18 and over. We don't knowingly keep accounts for anyone younger; when we learn of one — from a report or otherwise — it's removed. If you believe a minor is using PingCrood, report the account or write to us.
Where your data lives
On servers PingCrood runs on Oracle Cloud infrastructure. Media you send is stored there too, and served only to the people in the conversation.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change matters — a new kind of data, a new provider — we'll tell you in the app before it takes effect.