Last updated: October 19, 2026
When you text Ping AI, we process your phone number and message content to generate and deliver a reply, maintain useful conversation context, prevent abuse, and troubleshoot delivery problems.
Message content and the associated phone number may be retained for up to 30 days, then automatically deleted. We do not use your conversations to target advertising.
We do not sell, rent, or license your phone number or message content. We share data only with service providers needed to operate Ping AI, such as our AI, messaging, payment, hosting, and flight-data providers, or when legally required. We do not share it for third-party advertising.
To provide the SMS service, we receive:
- Your phone number (required by the carrier to send a reply)
- The text of your message (required to generate the AI response)
These records are subject to the retention periods described below.
If you connect your Google Calendar for flight tracking, we access only the minimum calendar data needed to detect flight events. Specifically:
- We request read-only access to your Google Calendar events.
- We scan calendar entries solely to identify flight-related events (e.g., airline reservations, flight numbers).
- We store your OAuth refresh token using AES-256 encryption at rest, protected by environment-level secrets that are never committed to source code.
- Calendar event data (flight details extracted from events) is stored only as long as the associated flight is actively being tracked. Once a flight lands or tracking expires, the extracted data is automatically deleted.
- Your OAuth tokens are stored only while your calendar connection is active. When you disconnect (by texting CALENDAR OFF or via the web interface), your tokens are immediately and permanently deleted from our database.
- We do not access, store, or process any non-flight calendar data (personal appointments, meetings, etc.).
We implement the following measures to protect your data, including any Google user data:
- Encryption in transit: All communications between your device, our servers, and third-party APIs (including Google) use TLS/HTTPS encryption.
- Encryption at rest: Sensitive credentials (OAuth tokens, API keys) are encrypted using AES-256 before storage in our database.
- Access controls: Database access is restricted to authenticated application processes and authorized operators who need access for security, support, or maintenance.
- Minimal data collection: We collect only the minimum data necessary to provide the requested service functionality.
- Secure infrastructure: Our application runs on managed cloud infrastructure with automatic security patching and isolated execution environments.
We retain your data only as long as necessary to provide our services:
- SMS conversation records: Message content and the associated phone number may be retained for up to 30 days for conversation context, service reliability, abuse prevention, and support, then automatically deleted.
- Google Calendar tokens: Retained only while your calendar connection is active. Deleted immediately upon disconnection.
- Flight tracking data: Retained only while flights are actively tracked. Automatically deleted after tracking concludes.
- Subscription data: Phone number and subscription status are retained while you have an active subscription. Deleted upon request.
- Alert preferences: Your alert configuration is retained while active. Deleted when you remove your alerts or upon request.
Your right to deletion: You may request complete deletion of all your data at any time by emailing hello@textping.ai or by texting DELETE MY DATA to Ping AI. We will process deletion requests within 7 business days and confirm completion.
U.S. carriers require us to keep standard delivery metadata (date/time, delivery status) for 30-90 days for billing and compliance. This metadata contains no message content and is automatically deleted afterward.
Ping AI uses xAI's Grok model (a third-party AI service) to generate conversational responses in the SMS chatbot. When you send a text message, your message text is sent to xAI's API for processing. xAI processes the data according to their own privacy policy. No personally identifiable information (such as your phone number) is sent to xAI - only the message content needed to generate a response.
Ping AI maintains complete, auditable segregation between Google user data and third-party AI services. The Google Calendar integration operates on an entirely separate data pipeline from the AI chatbot and is never connected to xAI or any other AI provider.
How Google Calendar data is processed:
1. Ping AI requests read-only access to your Google Calendar via the Google Calendar API (scope: calendar.readonly).
2. Calendar events are retrieved and processed locally on our server using deterministic pattern matching (regular expressions) to identify flight-related entries (e.g., "AA 1234 DFW-LAX").
3. Only the extracted flight identifier (e.g., "AAL1234"), origin airport code, destination airport code, and departure time are stored in our database. No other calendar event data (titles, descriptions, attendees, locations, notes, or any non-flight content) is retained.
4. The extracted flight identifier is sent to FlightAware's AeroAPI to retrieve real-time flight status. FlightAware receives only the flight number — no Google user data.
5. Flight status updates are delivered to the user via SMS through SignalWire.
What is never sent to xAI (Grok) or any AI service:
- Google OAuth tokens or credentials
- Google Calendar event data (titles, descriptions, locations, attendees, or any event metadata)
- Google user profile information (email, name, or account identifiers)
- Any data obtained via any Google API
Architectural enforcement:
- The calendar sync functions (sync_calendar_events, parse_flight_from_event, activate_upcoming_calendar_flights) operate in a completely separate code path from the xAI chat functions.
- Calendar processing uses only local regex parsing and the FlightAware API — no AI API calls are made at any point in the calendar data pipeline.
- The xAI chat pipeline receives only user-typed SMS message text. It has no access to Google OAuth tokens, calendar event data, or any Google API responses.
- These two pipelines share no data structures, API clients, or function calls.
Ping AI is not intended for children under 13. We do not knowingly collect data from children under 13.
If we ever change this policy, we will post the new version here and update the "Last updated" date.
Chat: Your messages and the conversation context needed to answer are sent to xAI (Grok) to generate replies. Conversations are stored on Ping AI servers until you delete the conversation or your app account. xAI processes content under its own privacy policy; we do not promise zero provider retention.
Voice: Voice audio is processed live over the internet by xAI to provide spoken responses. Voice audio is not recorded or stored by Ping AI. We retain session timing and credit-usage records, not audio recordings.
Private profile and Memory: The app creates a private profile without requiring an email address or phone number. Its profile credential is stored on your device using secure device storage. We store the profile and a protected representation of credentials needed to authenticate it. If you enter optional Memory text, we store it and may send it to xAI as context for replies. You can edit or delete Memory in the app.
Notifications: If you enable push notifications, we store the device push token and notification preferences to deliver the alerts you request. You can change notification permission in iPhone Settings and alert preferences inside the app.
Purchases: Apple processes payments and RevenueCat verifies subscription and purchase status. We receive purchase identifiers, entitlement status and Voice credit records needed to deliver what you bought. We do not receive your payment-card details.
Support reports: We store reports you submit, including the report text, category and profile information needed to investigate and respond. Please do not include passwords, verification codes or other sensitive information in reports.
Deletion: In the app, choose You > Delete account. Deletion removes your conversations, Memory, lists, reminders, alert preferences and sign-ins, and revokes the app profile's credentials. Limited financial, fraud-prevention, support and deletion-request records may be retained where needed for security, legal obligations or dispute handling. Deleting the app account does not cancel an Apple subscription; cancel in Settings > Apple ID > Subscriptions. A separately linked SMS or web account is not automatically deleted.
No advertising or data sale: The iPhone app does not show advertising, track you across other companies' apps or websites for advertising, or sell your data.
App privacy questions: Email hello@textping.ai. See Support for restoration, cancellation and deletion help.
Questions? Email: hello@textping.ai
We collect only the information needed to provide, secure, support, and bill for the services you choose.