This policy explains how Peppli collects, uses and protects information when you use the mobile app or visit peppli.app. We do not sell personal data or use it for behavioral advertising.
1. Who we are
The operator of Peppli, identified as the seller or developer in the applicable App Store or Google Play listing, is the data controller for information handled through the app and this website. Questions and privacy requests can be sent to support@peppli.app.
This policy applies to Peppli's account, habit tracking, reminder, AI coaching, subscription and support features. Apple, Google and other providers also apply their own privacy policies to services they operate.
2. Information we collect
Information you provide
- Account information: email address, display name, preferred language, time zone and email verification status.
- Habit information: habit names, descriptions, icons, colors, schedules, targets, reminder times, completion history and any notes you choose to add.
- Check-ins: optional mood, energy, sleep and reflection details you choose to save, plus your consent choice for personal AI context.
- Coach requests: the goals, constraints and preferences you submit when asking Peppli AI for a habit, routine, plan, reflection, obstacle response or progress review.
- AI safety reports: the displayed response you submit, the reason you choose, report and response identifiers, review status, time of the report and a security digest.
- Support messages: the content of your email and the contact details needed to reply.
Information created when you use Peppli
- Account security data: password hashes, session identifiers, sign-in timestamps, IP address and user agent associated with a session.
- Service data: app version, device and operating system details, request timestamps, error records and limited feature usage events used to keep Peppli reliable.
- Subscription status: plan, product identifier, store platform, purchase and expiry timestamps, and a provider customer identifier. We do not receive your full card number.
The Peppli website does not set advertising cookies. Cloudflare may process IP address, browser information and request logs when it delivers the website and protects it from abuse.
3. How we use information
We use information to:
- create and secure your account, verify your email and help you recover access;
- save, sync and display habits, check-ins, reminders and progress patterns;
- generate a personal habit, routine, plan, reflection or motivational suggestion when you ask Peppli AI;
- verify Peppli Plus access and restore purchases;
- respond to support requests, diagnose errors and prevent fraud or abuse;
- comply with legal obligations and enforce our Terms of Use.
Depending on where you live, our legal bases include performing our contract with you, your consent for optional features such as notifications, our legitimate interests in security and service improvement, and compliance with law.
4. AI suggestions
Personal AI features are available only with Peppli Plus.
Before Peppli sends any Coach request or personal AI nudge to OpenAI, the app identifies OpenAI, explains which data is shared and asks for your explicit permission. If you do not agree, you can keep using Peppli without personal AI. You can withdraw permission later in AI data sharing settings. After withdrawal, no new request is sent to OpenAI unless you agree again.
When you ask Peppli AI for help, Peppli sends your request, language and the minimum habit and progress context needed for that feature to OpenAI. A daily check-in is included only when you explicitly allow it. This context helps avoid duplicate actions and keeps the response relevant.
Peppli sends these requests with OpenAI's store=false setting, so the response is not kept through the Responses API storage feature. OpenAI still processes the request and response and may retain API content for up to 30 days in abuse-monitoring logs, subject to the controls and terms applied to the Peppli project.
Peppli's generation audit record keeps an HMAC digest of the request and limited operational metadata: purpose, model, token counts, provider response identifier, plan and status. It does not keep the raw prompt or generated coaching in that audit record. Habits or routines you review and choose to save are stored separately as your Peppli data.
You can report an AI response inside the app. Peppli keeps the displayed response you submit, the selected reason, report and response identifiers, review status, timestamp and an HMAC digest. Access is restricted to safety triage. We use reports to investigate safety issues and improve filtering and moderation.
Do not enter medical records or highly sensitive personal information. AI output can be incomplete or wrong. Peppli is a habit companion, not a medical, mental health or emergency service.
5. Notifications and reminders
Reminders are optional. Peppli asks for notification permission only when you choose reminder features. Habit reminders are scheduled on your device, and their local identifiers and settings remain on that device.
You can pause reminders in Peppli or change notification permission in device settings. Turning off notifications does not delete your habits.
6. Subscriptions and purchases
Apple App Store or Google Play processes payment information and the purchase. RevenueCat helps Peppli validate entitlement status, restore access and respond to subscription changes.
Peppli receives transaction and entitlement information needed to unlock Plus, such as product, platform, purchase, expiry and revocation status. Apple, Google and RevenueCat handle information under their own privacy policies.
8. Retention and deletion
We keep account and habit information while your account is active. Security sessions expire, and short-lived verification and password reset codes are removed after their validity period. Operational records are kept only as long as reasonably needed for security, reliability and legal obligations.
You can permanently delete your account from the app. This removes your active account, habits, check-ins, AI audit records and sessions from Peppli's primary database. A deletion request is also sent to RevenueCat when that service is enabled. Limited transaction, security or legal records may be retained where required by law, needed to prevent fraud or necessary to resolve a dispute. Residual copies may remain in protected backups until their normal rotation completes.
Read the account deletion guide for the exact steps and subscription reminder.
9. Your choices and rights
You can update your display name and preferences in Peppli, withdraw OpenAI data-sharing permission, pause reminders, archive habits, sign out of sessions and delete your account. Depending on your location, you may also ask to access, correct, delete, restrict or receive a copy of your personal data, or object to certain processing.
Send a request from the email linked to your account to support@peppli.app. We may ask for information needed to verify your identity. You can also complain to your local data protection authority.
10. Children
Peppli is not directed to children under 13, or under a higher minimum age where local law requires it. If you believe a child created an account without valid permission, contact us so we can review and remove it.
11. Security
We use administrative, technical and organizational measures designed to protect personal data. These include password hashing, short-lived access tokens, rotating sessions, rate limits and encrypted network connections. No service can guarantee absolute security.
12. Changes to this policy
We may update this policy as Peppli changes. We will update the effective date and provide additional notice in the app when a change is material and the law requires it.
Questions about your data?
Email support@peppli.app or visit Help and support.