Privacy & Legal

Who we are. PeePal is made by David Low, an individual based in the United Kingdom, who decides how PeePal handles personal information (the "controller"). Contact: [email protected].

Data Retention Overview

PeePal keeps your diary in the app's storage on your iPhone. If iCloud is turned on for PeePal, the app also copies your diary to your own private iCloud database, which Apple runs. Apple encrypts it; it is not encrypted with a key PeePal holds. PeePal (the maker) cannot read your private iCloud database, has no copy of your diary, and runs no server that holds it. There is no switch inside PeePal to stop this. To stop it, open Settings, tap your name, tap iCloud, tap See All next to Saved to iCloud, then turn PeePal off. If you also want the copy already in iCloud removed, use Delete All My Data before you turn iCloud off. This deletes the diary from your iPhone as well.

Kept only in the app's storage on your iPhone (not synced)

• Settings and preferences, including whether the visit form offers a period option
• Observations worked out from your diary, which the app can recalculate

PeePal keeps a record on your iPhone of the privacy choices you make in the app: what you chose, when, and which version of the wording you saw. This lets it respect your choices and show that you gave or withdrew your OK. The record isn't synced to iCloud or sent to us.

Copied to your private iCloud database, if iCloud is on

• Each drink: when it happened and when it was entered, amount in millilitres, drink type, caffeine, whether it was estimated, any note you add, where it came from (PeePal or Apple Health), and identifiers the app uses to match records (a random record ID, an ID from Apple Health where relevant, and an old user-ID field that is normally empty and is not an account).
• Each toilet visit: when it happened and when it was entered, volume, urgency, urine colour, flow, whether it was a bowel movement and its consistency, whether there was leakage, its type and severity, whether you marked it as a period day, whether it was estimated, any note you add, where it came from, and the same record identifiers.
• Your longer-view choice: whether it is on, whether it was ever on, and when it changed. No health values.

The app's pattern cache is not synced.

Two internal tables are also marked to sync but hold no diary data in this version.

How long the diary is kept. The app keeps today and the four days before it, and deletes older entries from the phone and from your private iCloud database. If you turn on the longer view, it keeps 90 days; turning it off again deletes the days older than five. The browser diary on this website keeps five days in that browser.

iCloud backup

iCloud device backup is separate from CloudKit private database sync. If you have iCloud backup enabled on your device, local app data may also be included in your encrypted device backup where iOS allows it. PeePal cannot read your iCloud backups. PeePal does not access iCloud backup data. Apple's iCloud Privacy Policy governs this storage.

Deleting your data

Settings, then Data, then Delete All My Data attempts to remove its implemented set of local and private CloudKit records. It reports a partial result when a deletion component fails. So that deleted entries cannot come back from Apple Health or a web-diary transfer code, the app then keeps a short record of each deleted entry on your iPhone (for a drink, its time, amount and drink type; for a visit, its time, volume, urgency and whether there was leakage) and deletes it about five days later. Drinks stay in Apple Health if you choose to keep them there, or if another app wrote them. Avoid adding new records while deletion is running. iCloud device backups are separate; remove them through iOS Settings → Apple ID → iCloud → Manage Account Storage if required.

Your rights. You have rights to access, correct, delete and move your information, and to object to or restrict how it is used. Because there is no account, you use most of these in the app itself: you can view and edit any entry, export it (Share or PDF), or use Delete All My Data. We cannot find your diary from an email, because nothing links an email to a phone, and we hold no copy of it. If you write to us about your rights, we will explain what we can and cannot do. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live.

Analytics

The iOS app sends crash reports; see "Crash reporting" below. It does not send weekly usage counts in this version.

Privacy Policy

This Privacy Policy describes how PeePal ("we", "us", "our") handles information in connection with the PeePal mobile application and this website.

The short version

Your diary is kept on your iPhone and, if iCloud is on for PeePal, in your own private iCloud database, which Apple runs. Your diary entries are not stored on any server we operate. The iOS app sends crash reports, from which we remove diary values. We do not sell your data. We do not share your data with third parties for advertising or commercial purposes. We also receive any emails you send us. Details are below.

Information we do not collect

• Account details or passwords (there is no account)
• Your name or email address, unless you email us
• Your diary entries (drinks and visits) on any server we operate
• Your precise location (our providers see your IP address, as explained below)

The visit form offers a period option only if you turn on the "Track periods" preference. That preference is not synced or sent to us. PeePal stores no biological sex or other identity fact, and it is not an account.

Information we may collect

The app sends no usage counts in this version. If a later version adds them, they will be off unless you turn them on.

Earlier versions of the app may have sent weekly usage counts. These are held only as anonymous totals in Cloudflare Analytics Engine, which deletes them automatically after about three months. We keep no separate copy or raw log. They are not used for tracking, advertising or profiling.

Crash reporting

PeePal uses Sentry for crash and error reporting. Crash reports contain technical diagnostic information (device type, OS version, stack trace). We remove diary values from reports before they are sent. Crash reports go to Sentry's European service in Germany, and Sentry sees your IP address when a report arrives. We keep crash reports only while we need them to find and fix faults, and Sentry deletes them automatically after the period set for our account. Sentry may keep ordinary logs under its own policies.

This website

This website does not run analytics scripts or marketing tags.

The browser diary saves entries in this browser's own storage (IndexedDB). It does not send them to PeePal or anyone else. Our web host, Cloudflare, sees each page request (including your IP address) and may keep ordinary access logs to run the site.

Emails to [email protected]. They are held by our email provider, Fastmail, and read by an AI assistant that works for us on the Cursor platform (Anysphere, Inc.), which we use under a business agreement. The assistant helps us summarise genuine feedback. Under that agreement and with Privacy Mode turned on, neither Cursor nor its model providers use the content of those emails to train AI models. The assistant may keep working copies while it runs; we delete the emails themselves under the rule below. If you send feedback from the app, it includes a screenshot only if you turn that on.

We read each email and decide what it needs. Feedback is summarised without your name, email address or any health details, and the email is then deleted. Emails that need a reply or another action are deleted once that is done. Emails we generate ourselves, and mail from our providers such as receipts, service notices and security alerts, are kept separately for running PeePal and are not covered by this rule.

We keep the summaries, which contain no personal details, in our planning tool for up to 12 months.

After we delete an email, Fastmail keeps it for 7 to 14 days so it can be restored. Fastmail's backups may keep copies for longer, and Fastmail does not commit to a fixed period for this. Fastmail also keeps its system logs, which can include your email address and IP address, for 180 days.

Fastmail is an Australian company. It stores email in the United States, and possibly also in the Netherlands. Its backups and logs are always in the United States. Fastmail's data protection terms include the European Commission's standard contractual clauses for these transfers.

The Cursor platform and its model providers (including SpaceXAI LLC for Grok) process that content in the United States. Transfers from the UK and EU are covered by the standard contractual clauses and the UK Addendum in Cursor's data protection terms. Ask us if you want a copy of those safeguards.

Please don't put health details in an email. If you do, we use them only to reply to you, and we leave them out of any summary. If you choose to attach a screenshot, it may show your diary entries. We use it only to deal with your feedback, and you can ask us to delete it.

Children

PeePal is not intended for children under 13. We do not knowingly collect information from children.

HealthKit

If you grant permission, PeePal may read and write water, caffeine and alcohol through Apple Health. Drinks it reads become diary entries, and are copied to your private iCloud database like any other entry if iCloud is on. Apple Health itself remains subject to Apple's terms and your iOS permissions.

Changes to this policy

If this notice changes, we will update the date at the top and show a summary of the changes in the app and on this page.

Contact

For privacy enquiries, email [email protected].

Terms of Use

By downloading or using PeePal, you agree to these terms. If you do not agree, do not use the app.

Use of the app

PeePal is provided for personal, non-commercial use. You may not reverse engineer, decompile, or attempt to extract source code from the app. You may not use the app for any unlawful purpose.

No warranty

PeePal is provided "as is" without warranty of any kind. We make no guarantees about accuracy, completeness, or fitness for any particular purpose — including medical or clinical use.

Limitation of liability

To the fullest extent permitted by law, PeePal and its developers shall not be liable for any loss or damage arising from your use of, or inability to use, the app.

Intellectual property

All content, design, and code in PeePal are the property of PeePal and its developers. You may not reproduce or redistribute any part without written permission.

Governing law

These terms are governed by the laws of England and Wales.

Changes to terms

We may update these terms. Continued use of PeePal after changes constitutes acceptance.

Medical Disclaimer

PeePal is a wellness tool, not a medical device.

The information and insights provided by PeePal are for general informational and wellness purposes only. They do not constitute medical advice, diagnosis, or treatment.

PeePal is not a substitute for professional medical advice. Always seek the advice of your GP, consultant, or other qualified healthcare professional with any questions you may have regarding a medical condition. Never disregard professional medical advice or delay in seeking it because of something you have read in or exported from this app.

If you think you may have a medical emergency, call 999 (UK) or your local emergency number immediately.

The health guides available in PeePal are educational resources only and have not been reviewed or approved by a regulatory body. They are not a substitute for advice from a qualified healthcare professional.