Privacy Policy
Who we are and what this covers
Piku is made by Ruben Oliveira (“we”, “us”), who is responsible for your personal data in it (its “controller”). This policy covers the Piku app, the servers it uses and our website, piku-app.com. It explains what we collect, why, who else handles it, and the choices and rights you have.
Information we collect
We only collect information when we have a reason to: to run Piku for you and keep it secure. It comes from three places.
What you give us. Your account: your name, your email if you sign in with it, and how you signed in. What you put into Piku: your habits and their history, your companions and the names you give them, your credits, items and settings. And, if you write to us, our emails with you (Contact & suggestions adds the app’s version and your phone’s system and model at the foot, which you can delete before sending).
What we collect automatically. A random id for each device you use Piku on, and the dates your data last changed and was backed up. When the app talks to our servers (to sign in or back up), our hosting provider logs technical details such as your IP address, the app’s version and the time, to keep the service working and secure.
What we get from others. If you sign in with Apple or Google, they share your name and email with us (Apple may give us a private relay address instead of your real one, and Google also shares your profile picture, which we don’t use). If you buy Premium, Apple or Google take the payment and keep your payment details; we only learn what you bought and when, through RevenueCat (below).
We don’t collect your contacts, location, photos, health data from your phone or advertising ids, and the app has no analytics, advertising or tracking tools, and no cookies. Habits you create may say something about your health (a habit to take medication, say); we use them only to run Piku for you.
Our website
Our website, piku-app.com, is hosted by Cloudflare. It sets no cookies and has no advertising or tracking. To see how many people visit and where they come from, it uses Cloudflare Web Analytics, which counts visits without cookies or anything stored on your device: the page you opened, the site that sent you there, your country and the kind of device and browser. Like any host, Cloudflare also briefly logs technical details such as your IP address to deliver the site and protect it from attacks.
Where it’s kept
Everything is saved on your phone. There, your sign-in is encrypted with a key kept in the phone’s secure storage (the Keychain or Keystore), and your reminders and home screen widget are worked out on the phone; nothing about them goes to our servers.
A copy of your Piku data is also kept on our servers, run by Supabase in the EU (Ireland), as part of your account, so you get it back when you sign in on a new phone. It travels over an encrypted connection, and each account can reach only its own copy. Beside it we keep up to three earlier copies (at most one a day), so we can undo a faulty app update; only we can reach them, and they go when your backup goes.
How and why we use it
To run Piku: to show your progress, keep your companion going, schedule the reminders you ask for, and back up and restore your data. Your coach’s notes are worked out on your phone. To keep Piku secure and fix problems: to detect and stop abuse, and to find and fix bugs. To talk to you: about your account, important changes to Piku or these policies, and replies when you write to us. We don’t send marketing.
If you’re in the European Economic Area, Switzerland or the UK, our legal grounds are: what’s needed to provide Piku under our Terms and to run your account, including its backup; your explicit consent, given when you create your account, for keeping habits that may say something about your health (you can withdraw it at any time by deleting your account); our legitimate interest in keeping Piku secure and working; and complying with the law.
We don’t sell your data, share it for advertising, or use it to profile you or make automated decisions about you.
Transferring information
Your data is stored in the EU. Supabase is a US company, and its staff may access it to keep the service running. Resend, which sends our sign-in emails, RevenueCat, which checks purchases, and Cloudflare, which hosts our website, are also US companies, so your email address goes to the US when we email you a code, and your purchases are checked there. Where data leaves the European Economic Area, we make sure it stays protected as the law requires, using the European Commission’s standard contractual clauses. You can ask us for more about these safeguards.
How long we keep it
We keep information only while we need it for the reasons above and aren’t required to keep it longer.
On your phone: until you erase it in Settings or delete the app. On our servers: while your account exists. Deleting your account deletes your account, your backup and its earlier copies straight away.
Copies in our providers’ own backups and logs (Supabase’s, and Resend’s record of the emails it sent), and the encrypted copies of the database we make now and then, are deleted within 30 days. Our emails with you are kept as long as we need them to help you. Records of purchases are kept by Apple or Google and RevenueCat for as long as tax and accounting law requires, even after you delete your account.
Security
No online service is 100% secure, but we work hard to protect your information. Your data travels over encrypted connections, each account can reach only its own backup, our database accepts only encrypted connections, and your sign-in on the phone is encrypted. If a breach puts you at risk, we’ll tell you and the authorities without undue delay, as the law requires.
Your choices
You can use Piku without giving us more than you want: sign in with Apple and hide your email, turn reminders on or off in your phone’s settings. You can export all your data, erase everything on this phone, or delete your account, which removes it everywhere.
Your rights
Depending on where you live, including in the European Economic Area, Switzerland, the UK and some US states, you have the right to: access your data and get a copy you can take elsewhere; correct it; delete it; object to or ask us to limit how we use it; and not be treated differently for using these rights. We don’t sell or share your data for advertising, so there’s nothing to opt out of.
Most of this is in the app: Export my data, renaming yourself or your companion, and Delete account in Settings, Account. For anything else, write to us at piku-app.com">support@piku-app.com from the email on your account (or tell us how you signed in), so we can check it’s you. We’ll reply within a month.
If we turn down a request, we’ll tell you why in writing, and you can appeal by replying to that message; someone who wasn’t involved in the first decision will look at it. You can also complain to your data protection authority, or in some US states, your state attorney general.
Children
Piku isn’t meant for children under 13 (or the higher age of digital consent where they live), and we don’t knowingly collect their data. If you think a child has given us data, write to us and we’ll delete it.
Changes to this policy
We may update this policy as Piku changes or the law requires. We’ll update the date at the top and, if a change matters, tell you in the app before it applies.
Translation
This policy was written in English. If we translate it and the versions differ, the English one applies, unless the law where you live says otherwise.
How to reach us
Ruben Oliveira. Email: piku-app.com">support@piku-app.com.
About this policy
This policy is adapted from Automattic’s Privacy Policy (github.com/Automattic/legalmattic), with changes to fit Piku, under the Creative Commons Attribution-ShareAlike 4.0 licence (creativecommons.org/licenses/by-sa/4.0). You’re welcome to copy and adapt it under the same licence.