Privacy
Your chats, files and settings stay on your iPhone. With Pro, the backup goes to your own iCloud Drive. The Peji server forwards each request to the model and keeps your account and your token counts. It does not keep the text.
Where your data lives
| Place | What stays there | Who can read it |
|---|---|---|
| Your iPhone | Chats, attachments, routines, settings, tabs, providers without keys | You, and the apps you give access to with iOS |
| Your iCloud Drive | The Pro backup: chats, attachments, settings, tab addresses | You and Apple, inside your private iCloud container |
| The Peji server | Account, sessions, codes, token counters, purchase status | Peji, as described below |
| The model provider | The request, while it produces the answer | Inference.net, under its own terms |
Who we are
Matteo Ricupero, an individual, is the controller of the data the Peji server holds. Write to support@peji.si for any question about this page or your data. The server and its database run on Contabo infrastructure in the European Union.
On your iPhone
- Chats are JSON files in the app folder. Attachments are files next to them. Deleting a chat deletes its folder.
- Session tokens and API keys are in the iOS Keychain, marked this device only. They never enter a chat, a backup or a log.
- The app has no analytics, no advertising identifier and no third party tracking SDK.
In your iCloud Drive
With Peji Pro, the backup copies chats, attachments, settings and tab addresses into a folder in your own iCloud Drive. It stays in your private iCloud container. We hold no key and cannot open it. Cookies, API keys and session tokens are never copied. You delete a backup from the Files app.
On the Peji server
An account is needed only for the built-in provider. With the server we hold:
- Your email address, a hash of your password and the email status.
- One session per device: a hash of the refresh token, the device kind, the user agent and the expiry. We do not store the token itself.
- Verification and reset codes as hashes, with the expiry and the number of attempts.
- Usage per day: number of requests, input, cached and output tokens, and the cost in micros. This is what the budget counts.
- Your plan, the subscription status from the App Store, and any grant that support added by hand.
- The identifiers of the App Store events we already processed, so a renewal is not counted twice.
- That the free trial was claimed from this iPhone. The app sends two bits to Apple DeviceCheck; we keep only the date.
This is also the whole list of what the admin dashboard can show about you: email, plan, trial date, number of active sessions, subscription product, budget and counters. Not your messages, your pages or your files, because they are not there.
What never reaches us
- The text of your messages, and the answers.
- The text of the pages the agent reads, and the results of its tools.
- Your photos and documents, and the text extracted from them.
- Your chats, your routines and your settings.
- Your browsing history and your cookies.
The model provider
To answer, the server sends the messages, the page text and the tool results to inference.net and streams the answer back. The request is not written to our database and not written to our logs. Inference.net processes it to produce the answer and, under the zero data retention setting on our account, does not keep it. Its privacy policy and zero data retention policy describe what that setting covers.
Your own endpoint
With a custom endpoint the app sends requests straight to the address you configured, with the key from the Keychain. The Peji server receives nothing, and no Peji account is needed. The terms of that endpoint apply.
Who else receives data
- Plunk sends the verification and reset emails. It stores data in the European Union and delivers through Amazon SES.
- Apple processes the App Store purchase, the receipt and DeviceCheck. Apple acts under its own terms.
- RevenueCat (United States) keeps the subscription state that the app shows and checks. We send it your user id.
- Contabo hosts the server and the database in the European Union.
Why we are allowed to keep it
- Account, sessions, emails and the provider itself: to perform the contract you accept when you create the account.
- Token counters, the daily cap, the rate limits and the one trial per iPhone: our legitimate interest in keeping the service running and paid for.
- Purchase and billing records: to comply with tax and accounting law.
Transfers outside the European Union
The server and the database stay in the European Union. Inference.net and RevenueCat are in the United States, and Apple processes data worldwide. Those transfers rely on the standard contractual clauses and, where it applies, on the EU United States Data Privacy Framework.
How long we keep it
- Account, plan and token counters: while the account exists.
- Sessions: until they expire, then 7 more days and the database removes them.
- Codes: ten minutes of validity, then one more day and the database removes them.
- Purchase events: while the account exists.
- Backups in iCloud Drive: until you delete them from the Files app.
Deleting the account in the app removes the account, the sessions, the codes, the counters, the purchase events and your RevenueCat subscriber, at once and without a copy kept for later.
Your choices
- Delete the account: Settings, Peji account, Delete account. If you cannot open the app, write to support and we delete it for you.
- Use a custom endpoint: the server receives nothing.
- Ask for a copy, a correction or the deletion of something: write to support@peji.si. We answer within one month.
- Complain to a supervisory authority, in the country where you live, work or where the issue happened. In Italy it is the Garante per la protezione dei dati personali.
Children
Peji is not for anyone under 16. We do not knowingly keep data about a child. Write to us and we delete it.
Changes
A change to this page is dated at the top. A change that affects what we keep is announced in the app before it applies.