Privacy Policy

Last updated: October 6, 2026

PingKit ("we", "our", or "the app") is committed to protecting your privacy. This Privacy Policy explains how we handle information when you use PingKit for iOS and PingKit Agent for macOS.

                Summary: PingKit does not collect personal data, with two exceptions, both for features you choose. If you use Uptime Watch or Cert Monitor with Guardian or Guardian Plus, the monitoring service keeps Apple's identifier for your subscription, its plan, and when it renews or ends, so your plan's limits end when the subscription does. It never sees payment details. If you subscribe to Guardian Plus and turn on email alerts, we keep the email address you give us so the alerts can reach it. (To stop abuse, the monitoring service also keeps, for 30 days, the IP address a new registration or a refused request came from; see Monitoring below.) All 19 diagnostic tools run entirely on your device. There are no accounts and no tracking. We do count, anonymously and in aggregate, which features people reach, so we know what to improve; those counts carry no identifier and cannot be linked to you or your device. AI answers are produced on your own device or by Apple Private Cloud Compute wherever they can be; when neither can answer, and only after you have given permission, PingKit sends a summary of your network to its own AI service at ai.pingkit.app. Never browsing history or account details. Most Guardian monitoring data (your device inventory, scans, and diagnostics) syncs between your devices via your personal iCloud account, which we never see. Cert Monitor and Uptime Watch additionally store the domains you choose to monitor and their check results on PingKit's own backend (a Cloudflare Worker at monitor.pingkit.app) so alerts and push notifications reach you reliably.
            

Information We Do Not Collect

PingKit does not collect:

Personal identification information (name, phone number, or email address, unless you turn on email alerts yourself)
Device identifiers for tracking purposes (no advertising identifier). The identifiers PingKit does use, to enforce AI usage limits and to deliver monitoring alerts, are described below and are never used for tracking.
Behavioural profiles, or any record of what an individual user did
Advertising data
Your browsing history, the contents of your traffic, or your diagnostic results

We do not operate any third-party analytics or tracking. There is no account system, no sign-up, and no login. PingKit-operated services that do receive data are the anonymous feature counts described immediately below, the AI service at ai.pingkit.app when you have allowed it, Cert Monitor and Uptime Watch monitoring (monitor.pingkit.app), and email or webhook alerts if you turn them on. Some AI answers are produced by Apple Private Cloud Compute instead, which is Apple's infrastructure rather than ours; that flow is described under AI Features below.

Anonymous Feature Counts

To understand which parts of the app people actually reach, PingKit sends aggregate counts of in-app events (for example, that a subscription screen was shown, or that a free trial was started) to our own server at monitor.pingkit.app. This is the only usage measurement we perform, and it is deliberately built so that it cannot describe an individual.

Each report contains only:

The app version
Your device language, without the region (for example "en", never "en-GB")
Whole-number counts per event since the previous report

Each report deliberately excludes:

Any identifier. No device ID, no account, no advertising identifier, no installation ID, no push token. The request is unauthenticated, so two reports from one device are indistinguishable from reports sent by two different devices. From version 3.1.3, each report carries one random number, made fresh for that report and never reused. It lets our server recognise the same report if your device has to send it twice, so it is counted once. It cannot connect one report to another.
Any timestamp from your device. Our server records only when a report arrived.
Any content. No addresses, hostnames, scan results, diagnostics, or purchase details.

Your IP address is used only to rate-limit abuse at the network edge and is never stored alongside these counts. Because there is no identifier, we cannot single you out, build a profile, or link these counts to anything else, and we could not delete "your" data on request because we have no way to tell which rows are yours. These counts are never sold or shared, and are not used for advertising or for tracking you across apps or websites. Reports older than roughly 13 months are deleted.

Local Data Storage

Both the iOS app and macOS Agent store data locally on your device using Apple's SwiftData framework:

Diagnostic history: Results from ping, traceroute, speed tests, and other network tools are saved locally for your reference.
Discovered devices: LAN scan results including IP addresses, MAC addresses, hostnames, and vendor information are stored on-device.
Saved configurations: Wake-on-LAN devices, HTTP analyzer requests, and saved targets are stored locally.
Keys and logins you set up: the SSH key PingKit creates for sleeping, restarting and shutting down your own machines (Guardian Plus), and your router login if you sign in to a FRITZ!Box. Both stay in this device's Keychain and never sync or reach us. The router login is sent only to your router, and the SSH key only proves this device to the machines you add it to.
Purchase status: Your subscription status is managed by Apple's StoreKit and stored securely on your device. If you use Cert Monitor or Uptime Watch, the monitoring backend also keeps the tier it grants you, as described under Monitoring below.

You can delete all local data at any time by uninstalling the app.

iCloud Sync (PingKit Guardian)

If you subscribe to PingKit Guardian, PingKit Agent for macOS syncs monitoring data to PingKit on your iPhone via Apple's CloudKit framework. This data is stored in your private iCloud database - only devices signed into your Apple Account can access it.

Data synced via iCloud includes:

Discovered devices: MAC addresses, IP addresses, hostnames, vendor names, custom names, device categories, and online/offline status
Alerts: New device notifications, outage alerts, latency warnings, and speed drop alerts (retained for 30 days, or 90 with Guardian Plus)
Agent status: Whether monitoring is active, device counts, gateway and internet reachability, and latency readings
Latency history: Timestamped latency measurements (retained for 7 days)
Speed test results: Download and upload speeds with timestamps (retained for 90 days)
Network timeline: Event logs such as devices joining or leaving and outage events (retained for 30 days, or 90 with Guardian Plus)
Requests from your iPhone to your Mac: waking a saved device (with its hardware address and the address to watch), running a scan or a speed test, or changing a device's alert settings, and the result the Mac reports back. Each request is deleted a day after it has run
Subscription status: Used to verify Guardian access across your devices

This data is encrypted in transit and at rest by Apple. It never passes through any server we operate. We cannot see, access, or retrieve your iCloud data. For details on how Apple handles CloudKit data, see Apple's Privacy Policy.

Monitoring (Cert Monitor and Uptime Watch)

Uptime Watch is available to everyone (one URL at no cost, up to ten targets with Guardian), and so is Cert Monitor (one domain at no cost, more with Guardian and Guardian Plus). Both are optional and neither sends anything until you add a target yourself. To deliver reliable alerts and push notifications even while your devices are asleep, they use a PingKit-operated backend (a Cloudflare Worker at monitor.pingkit.app). When you add a domain or endpoint, that target and its check results are uploaded to and stored on this backend.

The backend holds only:

The domains, URLs and host-and-port targets you choose to monitor and the names you give them, with the TLS port for certificate checks and any keyword or expected status code you set for an uptime check
Your subscription tier (free, Guardian or Guardian Plus), which sets how many targets you may add and how often they are checked. For Guardian or Guardian Plus, the app sends Apple's signed record of your subscription, and the backend keeps from it the plan, when it renews or ends, whether it was a test purchase, and Apple's identifier for the subscription, so that the tier ends when the subscription does. It holds no payment details
Their certificate and uptime check results (issuer, expiry, TLS version, status codes, response times, and availability)
A random per-device identifier and your Apple Push Notification token, used solely to send you alerts
If you turn on email alerts (Guardian Plus), the email address you give, whether you have confirmed it, and when the last weekly summary was sent; and, for seven days, a one-way hash of each address a confirmation link was sent to, used only to limit how many links one address can receive
If you add a webhook (Guardian Plus), the web address you give for it, and, for email or webhook alerts, the language their messages are written in
To stop abuse, and for 30 days: the IP address each new registration came from, with a count per day, and the IP address of any request refused for a missing or unknown key. Neither is linked to your targets, your device's identifier or your email address

Uptime check results are kept for 30 days. Removing a target or a domain in the app deletes it with all of its results. A device that has made no request for 120 days and that Apple will no longer deliver notifications to is deleted with everything stored for it.

This data is limited to what is needed to run the monitor and notify you. It is never sold or shared, and it is not used for advertising or tracking. Your device inventory, scans, and general diagnostics are not sent to this backend: they stay on-device and sync only through your private iCloud as described above.

Email Alerts (Guardian Plus)

Guardian Plus can also send your Uptime Watch and Cert Monitor alerts, and a summary every Monday, by email. This is off until you enter an address in the app, and nothing but a confirmation link is sent to that address until you open the link and press the button on the page it shows. Anyone who never turns email alerts on gives us no email address at all.

The address is stored on the monitoring backend described above, beside your targets, and is used for nothing but these emails: no newsletters, no marketing, and no sharing. The emails are delivered by Resend, which receives the address and the text of each email only in order to deliver it; see Resend's Privacy Policy. Every email has a link to stop them, which works without signing in. Using that link, or removing the address in the app, deletes it from our backend straight away. If your Guardian Plus subscription ends, the emails stop.

Webhook Alerts (Guardian Plus)

Guardian Plus can also send your alerts to a webhook: a web address you enter, such as a Slack or Discord incoming webhook. Each alert is posted to that address as a short message with its title, its text and what it concerns: a site or domain you monitor or, from the Mac Agent, the name and local IP address of a device on your network, with any description PingKit has for it. The address is stored on the monitoring backend described above and on the device where you entered it. The Mac Agent posts the Mac's own alerts to it directly, so the service at that address receives those from your own internet connection and can see its IP address, as any website can. Whoever runs that service receives the messages under its own terms, so choose one you trust. Removing the address in the app stops the messages and deletes it from our backend, and if your Guardian Plus subscription ends, they stop.

Push Notifications

PingKit uses Apple Push Notification service (APNs) in two ways. Alerts from the macOS Agent reach your iPhone through CloudKit: when the Agent writes an alert to your private iCloud database, Apple's infrastructure delivers the notification, and none of it passes through our servers. Uptime Watch and Cert Monitor alerts are sent by the monitoring backend described above, which gives Apple the alert, including the name or address of the site or domain it concerns, to deliver to your device.

External Services Used by Diagnostic Tools

When you use certain diagnostic tools, the app connects directly to third-party services to perform the requested operation. These connections are made from your device, not through our servers:

Speed Test

Speed tests use Cloudflare's public speed test infrastructure (speed.cloudflare.com). Only bandwidth measurement data is exchanged - no personal information is sent.

IP Geolocation

When you use the IP Geolocation or "Locate My IP" feature, the app asks PingKit's own lookup service at geo.pingkit.app, a Cloudflare Worker, for geographic and ISP information about the IP address. For your own address it answers from Cloudflare's connection data; for any other address it asks MaxMind's GeoLite service, then ipwho.is. If geo.pingkit.app does not answer, the app asks ipwho.is directly. These services receive the IP address you are looking up, and geo.pingkit.app does not store it.

DNS Lookup and Security Scan

DNS lookups may query Google Public DNS (dns.google) or Cloudflare DNS (cloudflare-dns.com) to resolve domain names and check DNS security. The domain name being queried is sent to these services.

Whois Lookup

Domain and IP ownership lookups query public RDAP servers operated by domain registries (such as Verisign, Public Interest Registry, and others), found from IANA's public list at data.iana.org. For a domain whose registry has no RDAP server, the app asks that registry's WHOIS server directly over port 43, and if IANA's list cannot be read it asks rdap.org. The domain or IP being queried is sent to these services.

Security Scan

The external exposure check queries Shodan's InternetDB (internetdb.shodan.io), a public and free API that returns the open ports and published CVE records already known for a given IP address. Your public IP address is sent to this service during this check. In PingKit Agent for macOS this check is off unless you turn it on; on iPhone and iPad it runs as part of a security scan. The security scan also connects to captive.apple.com (Apple's captive portal detection endpoint) and may inspect TLS certificates on google.com to detect MITM interception.

Session Watch

Session Watch measures against a host on the internet: Cloudflare's 1.1.1.1 by default or, with PingKit Guardian, an Amazon Web Services endpoint in the region you choose. It opens a connection to that host and closes it again without sending anything, so the host sees your IP address, as any connection does. The list of regions is fetched from monitor.pingkit.app in a request that carries no identifier.

AI Features

PingKit's AI features include the assistant, security explanations, remediation guides, scan summaries and device identification. An answer can be produced in three different places, and which one produces it decides what leaves your device. PingKit tries them in order and stops at the first that succeeds.

On your own device. Apple Intelligence's on-device model writes the answer on your iPhone, iPad or Mac. Nothing leaves your device, and neither PingKit nor Apple receives anything. This is free and needs no subscription. It requires hardware that supports Apple Intelligence (iPhone 15 Pro or later) and one of the languages Apple's on-device model covers, so it is not available on every device or in every language.
Apple Private Cloud Compute. When a question is more than the on-device model can handle, PingKit can send it to Apple Private Cloud Compute. This is Apple's infrastructure, not ours: the data goes to Apple, PingKit never sees it, and Apple's own privacy terms govern it rather than this policy. Apple states that data sent to Private Cloud Compute is used only to fulfil the request, is not retained, and is not accessible to Apple. This step requires a PingKit Guardian subscription.
PingKit's own AI service. If neither of the above can answer, PingKit can send a summary of your network to its own service at ai.pingkit.app, running on Cloudflare Workers AI. PingKit asks your permission before its own service ever receives anything, and it does not ask once and remember forever: you can withdraw that permission at any time, on iPhone and iPad under Info > AI (the gear at the top of Home) and on a Mac under Settings > General > AI in PingKit Agent, and the next request will ask again.

What is sent to PingKit's own service, when you have allowed it: your connection type, speed and local network settings (on a Mac, also the name of your internet provider), how many devices are on your network and what kind each one is, what a security scan found, the hostname a device announces for itself, recent network events, and the websites, servers and certificates you monitor, by the name you gave them or by address, with their status and last error. On iPhone and iPad with PingKit Guardian, the cameras on your network and the ports your router forwards, with the description your router holds for each, are sent too. When you use the assistant, your question and the last few turns of that conversation are sent. Your preferred language is sent so the answer comes back in it. If a later version of PingKit sends more than this list, it asks your permission again before sending it.

What is not sent: the names you have given your devices in PingKit, hardware (MAC) addresses, your Wi-Fi network name, your public IP address, your browsing history, the contents of your traffic, or any name, email or account detail.

Device identification works slightly differently, and it is worth stating plainly. When PingKit's on-device classifier cannot confidently identify a device on your network, it can ask the AI service at ai.pingkit.app to help. That request carries the signals the device broadcasts about itself, which includes the hostname it announces, its reverse DNS name and its NetBIOS name. This uses the same permission as everything above and is refused outright if you have not given it, but unlike the assistant it does not require a subscription.

What is stored:

AI response cache: Responses are cached temporarily (24 hours to 7 days) to improve performance and reduce cost. Cache keys are hashes of the request, not personal data.
Usage counters: Per-device request counts, to enforce daily and monthly limits. These use Apple's vendor identifier, which is not linked to your identity and resets if you reinstall the app.
Feedback ratings: If you rate an answer with a thumbs up or down, the rating is stored anonymously by feature. No user identifier and no response content is stored with it.

What is not stored: your questions, your conversations, your scan results, your device names, your network configuration, or anything else that could identify you. Answers produced on your device or by Apple Private Cloud Compute are not recorded by PingKit at all, because they never reach us.

A change made on 19 September 2026, stated here because the previous version of this policy described something different. Until that date, device identification requests were written to a retained corpus intended for future model training, and that corpus included the hostnames devices announce. Hostnames frequently contain people's names. That collection has been stopped, the stored data has been deleted, and the code that wrote it has been removed from the service. No device identification data is retained today.

All Other Tools

Ping, traceroute, MTR, port scanning, LAN discovery, Bonjour browsing, SSL inspection, HTTP analysis, Router mode, the SSH power controls and Wake-on-LAN operate entirely on your local network or connect directly to hosts you specify. No third-party services are involved.

Location Permission

PingKit for iOS does not request location permission and cannot access your location. Reading Wi-Fi details such as your network name would require it, so the iPhone app does without those details rather than ask.

PingKit Agent for macOS asks for location permission once, because macOS shows the name of the Wi-Fi network you are joined to only to apps that have it. The Agent uses the permission for that name and nothing else: it never reads, stores or sends your location. If you decline, the Agent still shows your Wi-Fi signal, channel and security, just without the network name.

Third-Party Services

In-App Purchases

Subscriptions are processed entirely by Apple through StoreKit. We do not have access to your payment information. See Apple's Privacy Policy for details.

Email Delivery

Email alerts, for Guardian Plus subscribers who turn them on, are sent through Resend, as described under Email Alerts above. No other PingKit feature uses email.

Crash Reporting

PingKit uses only Apple's built-in crash reporting (available through Xcode). Crash reports contain technical diagnostic data (stack traces, device model, OS version) and are collected by Apple for App Store builds. No personal information or network diagnostic results are included. We do not use any third-party crash reporting services.

Children's Privacy

PingKit is not directed at children under 13. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

support@pingkit.app