Privacy Policy

Effective October 7, 2026 · Pebbles is in beta, and this policy will be updated as the app changes

The short version: Pebbles collects only what it needs to let you send photos, videos and messages to friends you've chosen. There are no ads, no analytics or tracking SDKs, and we never sell or share your data for advertising. Media is removed from our servers when it expires, but anything a recipient saves stays on their phone.

Who we are

Pebbles is made by Jack Sloop, an independent developer. In this policy, "we" and "us" mean the Pebbles team. Questions go to jacobsloop@gmail.com.

What we collect

Account details: your email address and password (stored only as a secure hash by our authentication provider), plus the username and display name you choose. Your username and display name are visible to people who search for you or are your friends.
Friendships: who you've sent friend requests to, who you've accepted, and when.
Messages and media: the photos, videos, notes and text messages you send, along with who sent them, who received them, and when they were sent, opened and saved.
Push notification tokens: if you allow notifications, a device token from Apple so we can tell you when a friend sends you something.

We don't ask for your phone number or contacts, and we don't collect your location, advertising identifier or browsing activity.

Camera, microphone and photos

Pebbles asks for camera access to take photos and videos, and microphone access to record sound in videos. If you choose a picture from your library, only that picture is used. Nothing is captured or uploaded unless you send it.

How we use it

To create and secure your account, including confirmation and password-reset emails.
To deliver what you send to the friends you choose, and nobody else.
To send push notifications. These show the sender's username and whether it's a photo, video or message, never the content itself.
To respond to support requests and reports of abuse, and to keep Pebbles safe.

How long we keep it

Photos and videos can be opened once by each recipient. They expire and are deleted from our servers 7 days after they're sent, whether or not they've been opened.
Text messages expire and are deleted from our servers 24 hours after they're sent.
Saved pebbles: when a recipient saves a photo or video, the media itself is kept only in a private vault on their device. Our servers keep a small record that it was saved (who sent it, the note, and timestamps), not the photo or video.
Account details and friendships are kept until you delete your account.
Push tokens are removed when you sign out, when Apple reports them invalid, or after 90 days without use.

Copies on devices

Expiry applies to our servers. Once someone receives your pebble, they can save it in the app, screenshot it, or record their screen, and we can't delete those copies. Only send things to people you trust. Pebbles' private vault is stored with iOS data protection and is excluded from iCloud and device backups, so it's removed when the app is deleted.

Messages are encrypted in transit (HTTPS) and stored on access-controlled servers. Pebbles does not currently offer end-to-end encryption.

Who we share it with

We don't sell your personal information or share it for advertising. We use a small number of service providers to run Pebbles, who process data only on our behalf:

Supabase hosts our database, file storage and accounts, and sends account emails.
Apple delivers push notifications and distributes the app (App Store and TestFlight).

We may disclose information if required by law, or if it's necessary to protect someone's safety.

Deleting your account

You can delete your account from the Account screen in the app. This permanently removes your profile, friendships, messages, uploaded media, saved-pebble records and push tokens from our servers. Copies already saved on other people's devices are outside our control. If you can't access the app, email us from your account's email address and we'll delete it for you.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how it's used. Email us and we'll help. You can change your username in the app at any time.

Children

Pebbles is not intended for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has an account, contact us and we'll delete it.

Changes

We'll post any changes on this page and update the effective date. If a change is significant, we'll also let you know in the app.

Contact

Email jacobsloop@gmail.com.