Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account information: your name, email address, and password (stored as a secure hash via Firebase Authentication)
• Profile information: display name and optional profile photo
• Package submissions: package name, description, version history, README, license text, and associated files you upload to the Peko Packages registry
• Contact form submissions: your name, email address, and message content when you submit a contact request
• Business and support inquiries: name, organization, and contact details you provide when contacting us

1.2 Information Collected Automatically

When you access the Services, our servers automatically record standard log information. We do not use third-party analytics or advertising trackers.

• Server log data: your IP address, the pages or API endpoints you request, your browser type and operating system (from the user-agent string), and referring URLs
• Download activity: package names and versions downloaded through the Peko Packages registry
• Hosting and usage metering: for hosted applications and paid operations, the runtime, bandwidth served, and job durations we measure in order to charge credits (see Payments below)
• Security and anti-abuse signals: when you sign in, we record your IP address and a device or browser fingerprint (a hashed identifier derived from your browser and device characteristics) and associate them with your account. We use these solely to detect and prevent fraud and abuse of free accounts (for example, one person creating many accounts to evade limits) and to keep the Services secure. This is a legitimate business purpose; we do not use these signals for advertising or sell them.

1.3 Cookies and Similar Technologies

We use only strictly necessary cookies: a session cookie that keeps you signed in, and cookies set by Google reCAPTCHA Enterprise, which we use through Firebase App Check to protect the Services from automated abuse. reCAPTCHA Enterprise assesses requests for signs of automated activity and transmits interaction and device signals to Google for that purpose. We do not use advertising or cross-site tracking cookies.

1.4 Information from Third Parties

If you choose to authenticate using Google Sign-In, we receive your name, email address, and profile photo from Google as part of the OAuth flow. We do not receive your Google password.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate the Services, including account management, package hosting, and documentation delivery
• To process and review package submissions, including admin review of upload requests
• To communicate with you, including responding to contact form submissions, sending account-related notifications, and providing support
• To enforce our Terms of Service, including detecting and preventing abuse, fraud, and violations of our policies
• To improve the Services, including analyzing usage patterns and diagnosing technical issues
• To comply with legal obligations, including responding to lawful requests from government authorities
• To send administrative communications, such as password reset emails and sign-in links

We do not use your information for advertising purposes, and we do not sell or share your personal information for cross-context behavioral advertising.

3. How We Share Your Information

3.1 Service Providers

We use the following third-party providers to operate the Services. Most of them process your data only on our behalf and under our instructions. Some of them, including Stripe (payments), the app stores you submit to, and our AI provider, act as independent controllers of the data they receive under their own privacy policies:

Where you submit an application to an app store, the listing, assets, and binaries you approve are transmitted to Apple, Google, or Microsoft, who act as independent controllers of that data under their own policies.

The current list of providers that process personal data on our behalf when we run the hosted platform, and how we notify you of changes, is maintained at pekoui.com/legal/subprocessors.

3.2 Public Information

Package names, descriptions, README files, version histories, author display names, and download counts submitted to the Peko Packages registry are publicly visible. Do not include private or sensitive information in package submissions.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to a valid subpoena, court order, or government request.

3.4 Business Transfers

In the event of a merger, acquisition, incorporation, or sale of substantially all of our assets, your information may be transferred as part of that transaction. We will notify you of any such change by updating this Privacy Policy.

4. Content You Upload for Building and Distribution

When you use peko deploy, you upload a bundle containing your application's build output and, where you include it, your source code. We process it to unpack it, host your server, build your app, capture store screenshots, and prepare store listings. Specifically:

• Source code: if your bundle includes source and you use AI drafting, a condensed extract is sent to our AI provider to generate store listings and legal documents. It is sent for that request and is not used by us to train models. If you do not use AI drafting, your source is not sent to the AI provider.
• Remote builds: macOS and iOS builds run on managed Apple hardware we operate. Your bundle is transferred there over short-lived signed links for the duration of the build.
• Signing material: Apple signing certificates and keys you supply are encrypted on your machine to the build runner's public key before upload. We store only the encrypted blob and cannot decrypt it; only the build machine can.
• Store screenshots: your demo build is installed and run on managed virtual machines and devices to capture screenshots and recordings. Those machines are wiped or destroyed after the run.

You can delete a deploy draft from the dashboard, which removes the uploaded bundle and everything extracted from it.

5. Payments

Payments and subscriptions are processed by Stripe. Stripe collects and processes your payment details directly under its own privacy policy. We do not receive or store your full card number. We receive and store a record of the transaction, the credits granted, and your plan status.

We also record the usage that credits are charged against, including application runtime, bandwidth served, build and screenshot job durations, and AI token counts, so that billing can be explained and audited.

6. Data Retention

• Account data: retained until your account is closed at your request
• Package data: retained until the package is deleted by you or an administrator
• Contact form submissions: retained for up to 24 months
• Usage logs: retained for up to 12 months
• Authentication records: managed by Firebase Authentication and retained for the life of your account; when you close your account they are deleted, subject to routine operational backups and any retention required by law

To close your account, email [email protected] from the address on the account. We will delete or anonymize your personal information within a reasonable period, except where retention is required by law. Hosted applications are stopped and their deploy bundles removed as part of closing the account.

7. Your Rights Under California Law (CCPA)

If you are a California resident, you have the following rights:

7.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

7.2 Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law.

7.3 Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you.

7.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

7.5 Right to Opt Out of Sale or Sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.

7.6 Right to Limit Use of Sensitive Personal Information

The only sensitive personal information we handle is your account credentials, which we use solely to provide and secure the Services. Because we use it only for that purpose and do not use or disclose it to infer characteristics about you, we are not required to offer, and do not offer, an option to limit its use.

7.7 Opt-Out Preference Signals

Because we do not sell or share your personal information for cross-context behavioral advertising, browser signals such as Do Not Track and the Global Privacy Control (GPC) have no effect on our processing; we do not track you across third-party websites.

To exercise any of these rights, contact us at [email protected] with "Privacy Request" in the subject line. We may need to verify your identity before acting on a request, and you may use an authorized agent to submit a request on your behalf. We will respond within 45 days as required by the CCPA.

8. Geographic Scope and Users Outside the United States

The Services are operated from the United States and are intended for users in the United States. We do not target, market, or actively offer the Services to individuals in the European Economic Area (EEA), the United Kingdom, or Switzerland, and we do not monitor the behavior of individuals in those regions. On that basis, we do not maintain a representative in the European Union or United Kingdom under Article 27 of the GDPR.

If you choose to access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with your local laws. By using the Services, you consent to the transfer, storage, and processing of your information in the United States, which may have data-protection rules that differ from those of your home country.

If you nonetheless believe you have data-protection rights that apply to your use of the Services, you may contact us at [email protected] and we will consider your request in good faith.

9. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

• Firebase Authentication for secure credential management
• HTTPS encryption for all data in transit
• Firebase Security Rules to restrict database and storage access
• Admin-only access controls for sensitive platform operations

No method of transmission over the Internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Children's Privacy

The Services are not directed to children. In the United States we do not knowingly collect personal information from children under 13. In the European Economic Area and the United Kingdom, where the minimum age to consent to online services without parental authorization is 16 (or a lower age set by local law, but not below 13), we do not knowingly process the personal data of children below the applicable age without the required parental consent. If you believe we have inadvertently collected information from a child below the applicable age, contact us at [email protected] and we will delete it.

11. Third-Party Links and Services

The Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you use.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last Updated" date, and for material changes we will ask you to accept the updated agreements the next time you sign in. Continuing to use the Services after a change takes effect means you accept the updated Privacy Policy.

13. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at: