Pestr Privacy Policy

Effective date: July 2, 2026
Last updated: August 31, 2026

Pestr ("Pestr," "we," "us," or "our") provides the Pestr website, iPhone app, Pestr Alarm device and firmware, backend services, mailing list, and support (together, the "Services"). This Privacy Policy explains what information is processed when you use the Services.

1. Scope

This Policy applies to the Pestr website, iPhone app, Pestr Alarm device and firmware, Pestr-operated backend services, mailing list, and communications with us. It does not govern third-party websites, app stores, APIs, or services that we do not control.

The iPhone app lets you sign in with email and password, Google, or Apple. Signing in can enable a Profile, Friends, limited Friend productivity sharing, eligible promotional gifting, and device-benefit activation, but it does not upload full task records or timelapse videos. Before sign-in, a protected online feature may use an internal anonymous service session as described below; this is not a separate user-facing account mode. The website provides product information, an App Store link, and an optional mailing list, but no checkout or user login. Website mailing-list signup is separate from app account creation. During initial Profile setup, you may separately and optionally request the same category of Pestr product updates.

2. Information Processed by the Services

A. Account sign-in and anonymous service sessions

You may sign in with email and password, Google, or Apple.

• Email and password. The app sends your email address and password over an encrypted connection to Supabase Auth. Supabase stores and verifies the account credentials; Pestr does not intentionally store or have access to your plaintext password. New accounts must enter a six-digit code sent to the account email address. If you request a password reset, Supabase and Pestr's transactional email provider process the email address, reset request, code, and related delivery and security records.
• Google or Apple. Google or Apple and Supabase process the sign-in. Pestr and Supabase may receive and store an email address, which may be an Apple private-relay address, a provider-specific identifier, and basic identity details such as a name or profile image if the provider supplies them. Pestr does not receive your Google or Apple password.
• Authentication records. Pestr and Supabase process account-creation, email-confirmation, password-recovery, last-sign-in, provider, authentication, session, and security metadata. The app stores session credentials in the iPhone Keychain.
• Signed-out service sessions. If you use a protected online feature such as Photo validation before signing in, Supabase may automatically assign a random anonymous service identifier and authentication tokens without requiring a name, email address, or password. This internal session supports limited service requests, is not presented as a Profile or guest account, and cannot activate the included device year or send gifts.

B. Profiles, Friends, gifting, and productivity summaries

If you create a Profile, Pestr and Supabase process your unique username, selected profile icon, Friend-sharing settings, Profile creation and update timestamps, and account identifier. Your username and profile icon are not public on the open web, but another signed-in Profile that knows your exact username can use it to send you a Friend request. People involved in a Friend request can see the other person's username and profile icon. Accepted Friends can also see when the friendship began.

Pestr processes incoming and outgoing Friend requests, accepted Friend connections, request and acceptance timestamps, cancellations, removals, and related anti-abuse records. Pestr does not verify that a username represents a person's real-world identity.

If a completed Profile owns this installation's local history, the app syncs a limited productivity summary to Supabase: current and highest streak values and, for each timelapse, a random identifier, start time, and duration. It does not upload task titles, task descriptions, schedules, completion records, QR references, timelapse titles or descriptions, or timelapse video files for this feature. If your Share streak setting is on, accepted Friends can see your current and highest streak. If Share total hours is on, accepted Friends can see daily, weekly, monthly, and all-time timelapse durations and related rankings. Turning a sharing control off hides that category from Friends but does not stop or delete the underlying limited summary sync.

For eligible Pestr Alarm gifting, Pestr and Supabase process the physical alarm identifier, current owner account, giver and recipient account identifiers, recipient username, gift timestamp, benefit expirations, number of gifts used or remaining, and whether that alarm has already gifted a particular recipient. Each successful gift is reflected in the recipient's and giver's Pestr Photo entitlement records. The alarm identifier and gift ledger are used to enforce the physical alarm's lifetime gift limit even if the alarm changes owners or an account is deleted.

C. Information stored locally on your iPhone

Most task information stays on your iPhone, including:

• task titles, descriptions, schedules, reminder methods, completion state, and dismissal history;
• templates, favorites, local streak history, onboarding state, theme choices, alarm settings, entitlement flags, and preferences;
• QR-code or barcode reference payloads and descriptions;
• Photo-mode task descriptions;
• Apple-provided Screen Time application, category, or web-domain tokens and blocking durations;
• timelapse settings, videos, titles, descriptions, timestamps, source-task links, and storage totals;
• imported alarm audio and related local metadata;
• installation and Total Disarm identifiers or counters, some stored in the iPhone Keychain so the safety limit survives an ordinary reinstall;
• the account identifier assigned as the owner of this installation's local productivity history; and
• paired-alarm identifiers, owner secrets, custom-alarm metadata, device schedules, pending stop requests, firmware version, local-network details, and device preferences or status.

This information is stored in the app's private container, UserDefaults, the iPhone Keychain, or the shared app group used by Pestr's Screen Time extensions. Except for the limited productivity summary described above, signing in does not upload or synchronize this local information. Apple and iOS may process local information for backups, notifications, alarms, Screen Time, local networking, Keychain, file and media pickers, and other platform features according to your settings and Apple's terms.

D. Camera, QR, Photo, media, and timelapse features

• QR mode. The app uses a live camera feed to detect a QR code or barcode and compare it with the reference stored on your iPhone. Pestr does not intentionally record or upload that live feed.
• Photo mode. The app resizes and compresses a photo, combines it with the task description you entered, and sends both over an encrypted connection to a Pestr endpoint hosted on Supabase using your current Pestr service session. The endpoint uses Google's Gemini API to return an automated match or no-match result. The request and related technical records may be associated with your Pestr account or anonymous service identifier while the request is processed. Pestr does not intentionally save the image to the photo library, its application database, or persistent backend file storage after validation.
• Google Gemini processing. Google may process and retain the image, description, response, safety signals, and technical information under the Gemini API terms, abuse-monitoring rules, and Pestr's API plan and configuration. Authorized review may occur where permitted by those rules. Pestr does not use Photo-mode content to train its own model. Do not include sensitive, confidential, or third-party personal information in a Photo-mode image.
• Timelapse capture. Timelapse files remain on your iPhone until you delete them or delete the app. They are not automatically uploaded to Pestr. The iOS share sheet sends a file only to the person or service you select.
• Imported media. Selected audio or a video's audio track is processed on your iPhone. The app may retain a local copy or transfer converted audio over an authenticated local connection to your paired Pestr Alarm.

Photo mode is not facial recognition and is not intended to identify a person. Photo mode is intended only for users who are at least 18 years old.

E. Pestr Alarm, local Wi-Fi, and firmware

The iPhone app and Pestr Alarm may exchange pairing identifiers and owner secrets, alarm schedules and identifiers, settings, custom audio, device status, diagnostics, battery information, firmware information, and dismissal events over authenticated local Wi-Fi connections.

During a temporary setup window, the alarm creates a setup Wi-Fi network that the iPhone can join. If you pair while signed in to a completed Profile, the app may use part of your Profile username in the alarm's display name and setup-network name, such as "username's Pestr Alarm." A setup-network name can be visible to nearby devices while that network is active. Signing out can cause the app to restore the generic alarm name when it next has an authenticated connection to the alarm.

Nearby Wi-Fi scanning is performed by the alarm. The alarm sends network names, signal strength, and security type to the paired iPhone for display. When you choose a network, the app sends its name and password to the alarm over its authenticated setup connection. The app clears the password after sending it and does not intentionally save it. The alarm encrypts and stores the credentials locally for reconnection. Pestr does not intentionally upload your Wi-Fi password to its backend.

A firmware check sends the alarm's device identifier, hardware model, and installed firmware version and build to a Pestr endpoint hosted on Supabase. The service also receives standard connection information such as IP address and may create a short-lived download token and limited anti-abuse records.

If a device-benefit activation succeeds or encounters certain errors, the app may send attempt and challenge identifiers, the alarm identifier, activation phase and result, app and firmware versions and builds, network frame or message byte counts, response type, and identifier-match results to Pestr. These activation diagnostics are associated with the current account and alarm but are designed to exclude authentication tokens, Wi-Fi credentials, cryptographic nonces and proofs, and raw command or response bodies.

F. Purchases, support, mailing list, and technical information

• App Store purchases. Apple processes monthly or yearly Pestr Photo payments. The app reads product and entitlement status through StoreKit but does not receive full payment-card details or upload App Store purchase history to Pestr's backend.
• Support. If you contact us, we receive your address and the information and attachments you provide. Diagnostic reports remain on your device unless you copy and send one.
• Transactional account email. Supabase and Resend process the account email address, confirmation or recovery message, delivery status, and related security and operational records to deliver account confirmation and password-reset codes. These messages are not marketing consent.
• Mailing list. If you request product updates on the website or through the optional Profile-setup checkbox, Pestr and Supabase process your email address, subscription status, consent source, source-specific opt-in timestamps, and limited anti-abuse records. Both choices subscribe you to the same Pestr product-updates list. Website subscribers complete a separate confirmation step, and Cloudflare Turnstile processes browser, network, and security-check information to help prevent automated signups. App subscribers have already verified the account email and are added only after affirmatively enabling the optional checkbox. Resend processes subscriber email addresses, subscription preferences, and delivery and engagement information so Pestr can send the updates requested.
• Service-use and technical records. Hosting, Supabase, Google, Apple, Cloudflare, Resend, and other infrastructure providers may process IP address or a one-way representation of it, account or anonymous service-session identifier, authentication provider and related metadata, alarm identifier, app or browser type, device and operating-system information, firmware information, requested feature or endpoint, timestamps, response status, latency, safety signals, and security, performance, or diagnostic logs.
• Anti-abuse records. Pestr and its providers process request counts, account or anonymous service-session identifiers, alarm and network identifiers where needed, failed-verification records, and timestamps to enforce limits, prevent fraud, control AI usage, protect account and social features, and secure firmware delivery.

The current app does not include a general advertising or analytics SDK. Pestr does not sell personal information, share it with data brokers, combine app data with third-party data for advertising, or use it to track you across other companies' apps or websites.

G. Permissions and Apple services

Depending on the features you choose, the app may request camera, notification, alarm, Screen Time / Family Controls, local-network, and setup Wi-Fi access. System file and media pickers let you choose specific files. You can change permissions in iOS Settings; disabling a permission may disable the related feature.

3. How We Use Information

We use information to:

• create, confirm, authenticate, recover, and secure accounts and internal anonymous service sessions;
• create Profiles and operate Friend requests and connections;
• sync limited productivity summaries and show the metrics you choose to accepted Friends;
• validate Photo-mode tasks and enforce usage limits;
• verify eligible devices, provide or transfer the included Pestr Photo year, and administer device-bound gifts and promotional access;
• operate reminders, alarms, QR checks, timelapses, Screen Time shielding, templates, favorites, and Total Disarm;
• pair, configure, diagnose, and update Pestr Alarm devices;
• process and restore App Store entitlements;
• remember preferences and preserve local task history;
• deliver transactional account email and requested mailing-list messages;
• answer support requests, prevent fraud or abuse, troubleshoot, and secure the Services; and
• comply with law and enforce our Terms.

4. How We Disclose Information

We disclose information only as needed to operate the Services, at your direction, for legal or safety reasons, or as part of a business transfer subject to appropriate protections.

Supabase provides account authentication, anonymous service sessions, database, Edge Function, firmware-storage, and mailing-list record services. Google provides Google Sign-In, Gemini image validation, and website fonts. Apple provides Sign in with Apple, app distribution, purchases, operating-system services, notifications, alarms, Screen Time, local networking and setup Wi-Fi configuration, Keychain, and media pickers. Cloudflare provides the Turnstile anti-abuse check. Resend provides transactional account email, mailing-list confirmation, contact management, delivery, and broadcasts.

We require providers processing information for Pestr to use it only for permitted purposes and to protect it consistently with this Policy, subject to their applicable terms and our agreements. We do not sell personal information, share it for cross-context behavioral advertising, or knowingly disclose it to data brokers.

5. Retention and Deletion

• Local iPhone data remains until you delete an item, use an available reset control, or delete the app. Some Keychain items may survive an ordinary reinstall unless removed through device or system controls.
• Account and anonymous-session records remain while the account or service session is active and as needed to provide protected features, enforce limits, and secure the Services. After deletion, limited records may remain in backups or as reasonably needed for security, fraud prevention, disputes, or legal obligations.
• Profile, Friend, and productivity records generally remain until you remove a request or connection, delete the account, or the records are no longer needed to provide and secure the feature. Turning off a sharing control hides that metric from Friends but does not delete the underlying productivity summary.
• Device-benefit and gift records may be kept for the life of the benefit or physical alarm and afterward as needed to prevent duplicate activation, transfer the remaining fixed device benefit, honor promotional time, resolve disputes, or prevent fraud. To preserve an alarm's permanent three-gift limit, a gift ledger may remain after account deletion and retain the alarm identifier, recipient username, gift time, and benefit expirations even when giver or recipient account identifiers are removed.
• Photo-mode images and descriptions are not intentionally persisted in Pestr's application database or backend file storage after validation. Google and infrastructure providers may retain inputs, outputs, or related safety and technical records under their terms and Pestr's service configuration.
• Operational logs, activation diagnostics, and anti-abuse records remain for the periods selected or provided by Pestr's infrastructure providers and as reasonably needed for security, troubleshooting, fraud prevention, and legal obligations.
• Device records remain on the alarm until replaced, removed, unpaired where applicable, or reset. Custom audio, Wi-Fi credentials, device names, and schedules must be removed from the alarm separately when applicable.
• Support and mailing-list records remain as needed to answer the request or until you unsubscribe, subject to legal, security, suppression-list, and backup needs. Deleting a Pestr account does not by itself unsubscribe an email address from product updates.
• App Store records are retained by Apple under its policies. Deleting the app or your Pestr account does not cancel a subscription.

Use the in-app Delete account control to initiate deletion of your signed-in Pestr account. While signed out, use Reset signed-out service data to delete the current internal anonymous service identifier and its associated server data; Pestr creates a new identifier if a protected signed-out feature is used later. You may also email app.pestr@gmail.com for another privacy request.

Deleting a Pestr account does not delete local tasks or media, cancel an App Store subscription, unsubscribe from product updates, delete data stored on a Pestr Alarm, or delete your Google or Apple account; those actions must be handled separately. We may need information sufficient to locate and verify a requested record. Because an anonymous service session contains no contact information, some records may not be identifiable as yours without the relevant alarm or session details.

6. Your Choices and Privacy Rights

You can choose email-and-password, Google, or Apple sign-in; use core local features without signing in; sign out; delete your Pestr account; reset signed-out service data; manage provider permissions through Google or Apple; manage iOS permissions; control which productivity metrics accepted Friends can see; cancel or remove Friend connections and requests; delete local tasks and media using available controls; reset or unpair a Pestr Alarm; cancel App Store subscriptions through Apple; leave the optional mailing-list checkbox off; unsubscribe from any mailing-list email; and contact us about privacy requests.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of personal information, or to object to or restrict certain processing. We may need to verify your request, and exceptions may apply. Pestr will not discriminate against you for exercising an applicable privacy right. Because Pestr does not sell personal information or share it for cross-context behavioral advertising, it does not offer a sale or sharing opt-out.

7. Security

We use measures designed to protect information, including encrypted network transport, backend access controls, Keychain storage for session tokens and device owner secrets, authenticated local pairing sessions, encrypted local Wi-Fi credential storage on supported firmware, cryptographic device verification, firmware integrity controls, and rate limits. No method is completely secure.

8. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Photo mode is intended only for users who are at least 18 years old. If you believe a child has provided personal information, contact us so we can review and delete it where appropriate.

9. International Processing

Providers may process information in the United States and other countries where privacy laws differ. Where required, we use legally recognized safeguards for transfers.

10. Changes

We may update this Policy as the Services or law changes. We will revise the date above and provide additional notice when required.

11. Contact

Email: app.pestr@gmail.com