Privacy Policy

Pebbii Ltd · Last updated: September 2026

1. Introduction

Pebbii Ltd ("we", "us", or "our") operates the Pebbii mobile application (the "App"). This Privacy Policy explains how we collect, use, and safeguard your personal information. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using Pebbii, you agree to this Privacy Policy. If you do not agree, please do not use the App.

2. Data Controller

Email: hello@pebbii.com
Address: 27 Old Gloucester Street, London, WC1N 3AX, UK

3. Information We Collect

3.1 Information You Provide

Account: display name, email address (optional), and profile picture. We do not store passwords — you sign in with Apple or Google through Firebase, and your provider password is never seen by us.
Launch and beta updates (this website): if you enter your email address in the “Notify me” form on our homepage, we collect that address so we can tell you when Pebbii reaches the App Store, and — if you also choose to join the beta — so we can send you a TestFlight invitation. No account is needed and none is created; this is the only thing we collect from you on this website.
Journal entries: the text of your entries, entry date, and any photo you attach.
Location: if you choose to tag an entry with a location, we collect the GPS coordinates and location name from your device. This is optional and requires your permission. We do not collect background location data.
Journaling Suggestions (iOS): if you grant permission, the App can show you suggestions that Apple prepares privately on your device — a place you visited, a song or podcast you played, a photo or video you took, or a workout you completed. Apple does not share these with us, and we receive nothing unless you tap one. When you do, we receive the details attached to that suggestion (for example the place name and date, the song title and artist, or the workout type and duration) and any photo you keep on the entry.

3.2 Information Collected Automatically

Push notification token: if you grant notification permissions, we store a device token (FCM) used solely to deliver notifications to your device.
IP address: logged for security purposes only. Not used for advertising or tracking.
Crash and diagnostic reports: the App includes Firebase Crashlytics. When the App crashes or hits a serious error, a report is sent to Google containing the app version, the device model, the operating system version, the time of the crash, the sequence of events that led to it, and a random installation identifier. We use these only to find and fix faults. They are not linked to your journal content and are never used for advertising.

3.3 What We Do Not Collect

We do not collect your contacts, your advertising identifier, or your biometric data. If you switch on Face ID or passcode locking for the App, the check is performed by iOS on your device and the App is told only whether it passed.

We do not use advertising SDKs, we do not build behavioural profiles, and we do not track you across other companies' apps or websites. The crash reporting described in Section 3.2 is the only information collected automatically for reasons other than running the Service.

3.4 Information Stored on Your Device

The App keeps a copy of your journals, entries, summaries and photos on your device, so that it works without a connection and syncs your changes when you reconnect. That copy is held inside the App's private storage, protected by your device's own encryption, and you can put a Face ID or passcode lock in front of the App in settings. Signing out deletes it from the device.

4. How We Use Your Information

To provide the Service (Contract Performance): storing and syncing journal entries, running shared journals and the reveal mechanic, delivering daily prompts, providing the Premium features you subscribe to, including AI-generated personalised prompts (see Section 5), and processing subscriptions through the Apple App Store. This also covers account emails such as your welcome message and data export links.
Getting-started emails (Contract Performance): during your first 14 days we may send a short series of emails (no more than five) explaining how to use the App — how to write your first entry, what journal types do, and similar guidance. These contain no advertising or promotional content. You can switch them off at any time in App settings → Emails, or via the unsubscribe link in any of them.
To protect and maintain the Service (Legitimate Interests): detecting and preventing fraud or unauthorised access, rate limiting abusive traffic, and diagnosing crashes and faults from the crash reports described in Section 3.2.
With your consent: sending push notifications (opt out any time in device settings), and sending marketing emails about new features and offers (off by default — turn on or off at any time in App settings → Emails).
Launch and beta updates (Consent): if you gave us your address through the form on this website, we use it only to tell you that Pebbii has launched and, if you asked to join the beta, to send you a TestFlight invitation. We do not use it for anything else. Withdraw your consent at any time using the unsubscribe link in any of those emails, or by emailing us.
Legal obligations: complying with legal obligations or responding to lawful requests from authorities.

5. AI-Powered Features

All users receive daily prompts from our curated library. The features below are additional, are available on a Premium subscription, and are powered by Anthropic's Claude API. Each one sends only what is listed for it. We use Anthropic's commercial API, whose terms state that the requests we send are not used to train its models.

Personalised prompts: when a journal's daily prompt is written for a subscriber, we send the journal's name, its type and that type's description, whether it is a shared journal, the age group chosen for it, its prompt categories, the wording of its five most recent prompts, its quick-start template and the description that comes with it if it has one, and how many entries were written in the journal in the last 30 days. The text of your journal entries is not sent for this purpose.

Prompts written around a Journaling Suggestion: if you start an entry from an iOS Journaling Suggestion, we send the details attached to the suggestion you chose so that the prompt can refer to it — for example the place name and the date you were there, the song title, artist and album, the podcast episode and show, the type and duration of a workout, or the date a photo or video was taken, along with the title Apple gave that moment. The photo or video itself is never sent to Anthropic. If you are not subscribed, the App words the prompt itself on your device and nothing is sent.

Writing hints: we send the wording of the prompt you are answering, or the text you asked for hints on, so that suggestions for what to write about can be returned.

AI rewrite: if you choose to rewrite an entry in a different tone, the entry text you select is sent to Anthropic to produce the rewritten version. No other entry text is included.

Summary narrative (weekly, monthly and yearly): summary figures are free and are calculated by us. If you are subscribed, a short narrative is also written automatically when each week, month and year ends. For it we send Anthropic your display name, the first 200 characters of up to five of your entries from that period, the names of places you tagged, and the totals for the period. Those excerpts are decrypted in memory solely for this purpose.

Turning off Weekly Summary in App settings stops weekly, monthly and yearly summaries from being produced, so no narrative is written and nothing is sent for one. AI rewrite sends only the entry text you select, and only when you ask for it.

6. How We Share Your Information

We do not sell your personal information.

Other users: in a shared journal, your answers to a daily prompt become visible to other members once every member has answered or skipped that prompt, and only to members who answered it (the reveal mechanic). If a journal's reveal mechanic is switched off, a member sees your answer once they have answered too. Entries not written for a prompt are visible to members straight away, and members who join later can see the journal's earlier entries. Your display name is visible to members of journals you join.
Firebase (Google): authentication and identity verification when you sign in with Apple or Google.
Firebase Cloud Messaging: push notification delivery (your device token only).
Backblaze B2: storage of the photos you upload and of your data exports.
Cloudflare: network and storage provider. Requests to our API and website pass through Cloudflare's network, which ends the encrypted connection, filters malicious traffic, and therefore processes your IP address and the request on its way to us. Cloudflare also stores data on our behalf.
Google (Firebase Crashlytics): crash and diagnostic reports, as described in Section 3.2.
Apple: subscription billing through the App Store, and confirming the status of your subscription with Apple's server API. We do not receive your payment card details.
Brevo: email delivery. We store your email address and display name with Brevo as a contact record, so that the emails we send can be addressed to you. You are added to a marketing list only if you opt in (App settings → Emails); your contact record is deleted when you delete your account. If you signed up for launch or beta updates on this website rather than in the App, your address is stored with Brevo in the same way, on a list used only for that purpose.
Anthropic: the AI features described in Section 5, for subscribers who use them.
Legal requirements: we may disclose your information when required by law or a valid court order.
Business transfers: if Pebbii Ltd is acquired or merges, your data may transfer to the successor entity. We will notify you before this happens.

All service providers are bound by confidentiality obligations and may only use your data for the purposes for which it was disclosed.

7. Data Security

We protect your data with encryption in transit (TLS 1.2+) and encryption at rest. Journal entry text, display names, email addresses, and location data are encrypted in our database using AES-256-GCM before being stored. Decryption occurs only within our application servers when your data is served to you — raw database access does not expose readable content.

We use OAuth-based authentication (no passwords are stored by us), strict access controls on all API endpoints, and rate limiting to reduce abuse. Photos are held in a private bucket and delivered through our own image service over signed links. No internet transmission is 100% secure, but we apply commercially reasonable measures to protect your information.

8. Data Retention

Account and journal data: retained while your account is active; deleted within 90 days of account deletion.
Device tokens: deleted when you remove the device or delete your account.
Email contact record (Brevo): deleted when you delete your account.
Launch and beta update subscribers (Brevo): kept until you unsubscribe, or until the launch and beta programme ends, whichever comes first. There is no account to delete in this case, so unsubscribing is what removes you.
Data exports: the download link expires, and the archive is deleted, 14 days after we prepare them. Any export of your data is also deleted when you delete your account.
Crash reports: held by Firebase Crashlytics under Google's retention schedule for that product.
Failed deletions: if an account deletion cannot be completed automatically, we keep a record of the request, including your email address, until an administrator has finished it by hand.
Subscription records: deleted when you delete your account. Apple keeps its own record of your App Store purchases.

9. Your Rights Under UK GDPR

You have the right to access, correct, delete, restrict, or export your personal data, and to object to or withdraw consent for certain processing. Use the in-app account settings or contact us at hello@pebbii.com. We will respond within one month.

You may also lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.

10. Children's Privacy

The App is for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has registered, contact us and we will delete their data. We recommend parental guidance for users aged 13–17, particularly for shared journals.

11. International Data Transfers

Some service providers (Firebase, Anthropic, Backblaze, Cloudflare) process data in the United States. Brevo, our transactional email provider, processes data within the EU. We ensure appropriate safeguards, such as Standard Contractual Clauses approved by the UK ICO, are in place for all international transfers.

12. Tracking Technologies

We do not use advertising cookies or third-party tracking SDKs, and this website sets no cookies and runs no analytics. Authentication session tokens are used solely to keep you signed in.

The signup form on our homepage is protected by Cloudflare Turnstile, a check that tells a person apart from an automated script. It runs invisibly: there is nothing for you to click and no indication on the page that the check is taking place. It processes your IP address and basic details of your browser for that purpose alone, does not set a cookie, and does not track you across websites. Cloudflare's handling of that information is described in the Cloudflare Turnstile Privacy Addendum.

13. Changes to This Policy

We will notify you of material changes by updating the "Last Updated" date in the App and, for significant changes, by email. Continued use of the App constitutes acceptance.

14. Contact

Email: hello@pebbii.com
Address: 27 Old Gloucester Street, London, WC1N 3AX, UK