Privacy & Legal

Who we are. PeePal is made by David Low, an individual based in the United Kingdom, who decides how PeePal handles personal information (the "controller"). Contact: admin@peepal.info.

Data Retention Overview

PeePal keeps your diary in the app's storage on your iPhone. It saves no new entries until you agree in the app. Syncing to iCloud is a separate choice, and it is off unless you turn it on. If you turn on Sync with iCloud, the app also copies your diary to your own private iCloud database, which Apple runs. This includes drinks PeePal reads from Apple Health. Apple encrypts it; it is not encrypted with a key PeePal holds. PeePal (the maker) cannot read your private iCloud database, has no copy of your diary, and runs no server that holds it. To stop syncing, turn off Sync with iCloud in PeePal's Settings. You then choose whether to delete the copy in your iCloud or keep it. If you delete it, PeePal also deletes the diary on your other devices that sync with the same iCloud account, including devices using an older version of PeePal, when they next connect with Sync with iCloud on. A device that's offline then, or has sync turned off, keeps its diary and may put it back in your iCloud later, so delete it on that device too. To keep a diary on another device, export it there first. If you keep it, it stays in your iCloud until you delete it, which you can do in Settings. If you used an earlier version that synced, syncing is paused until you choose again.

Kept only in the app's storage on your iPhone (not synced)

• Settings and preferences, including whether the visit form offers a period option
• Observations worked out from your diary, which the app can recalculate

PeePal keeps a record on your iPhone of the privacy choices you make in the app: what you chose, when, and which version of the wording you saw. This lets it respect your choices and show that you gave or withdrew your OK. The record isn't synced to iCloud or sent to us.

Copied to your private iCloud database, if you turn on Sync with iCloud

• Each drink: when it happened and when it was entered, amount in millilitres, drink type, caffeine, whether it was estimated, any note you add, where it came from (PeePal or Apple Health), and identifiers the app uses to match records (a random record ID, an ID from Apple Health where relevant, and an old user-ID field that is normally empty and is not an account).
• Each toilet visit: when it happened and when it was entered, volume, urgency, urine colour, flow, whether it was a bowel movement and its consistency, whether there was leakage, its type and severity, whether you marked it as a period day, whether it was estimated, any note you add, where it came from, and the same record identifiers.
• Your longer-view choice: whether it is on, whether it was ever on, and when it changed. No health values.

PeePal doesn't sync the patterns it works out from your diary to iCloud. Older versions did, so a copy may still be in your iCloud. PeePal tries to delete it when you open this version, or a later one, on a device with Sync with iCloud turned on. If that doesn't work, the copy stays until you use Delete All My Data while Sync with iCloud is on.

Two internal tables are also marked to sync but hold no diary data in this version.

How long the diary is kept. The app keeps today and the four days before it, and deletes older entries from the phone and, while Sync with iCloud is on, from your private iCloud database. If you turn on the longer view, it keeps 90 days; turning it off again deletes the days older than five. While your diary is paused, the app deletes nothing. The browser diary on this website keeps five days in that browser.

iCloud backup

iCloud device backup is separate from CloudKit private database sync. If you have iCloud backup enabled on your device, local app data may also be included in your encrypted device backup where iOS allows it. PeePal cannot read your iCloud backups. PeePal does not access iCloud backup data. Apple's iCloud Privacy Policy governs this storage.

Deleting your data

Settings, then Data, then Delete All My Data attempts to remove its implemented set of local and private iCloud records, including a copy you kept in iCloud after turning sync off. This also deletes the diary on your other devices that sync with the same iCloud account, including devices using an older version of PeePal, when they next connect with Sync with iCloud on. A device that's offline then, or has sync turned off, keeps its diary and may put it back in your iCloud later, so delete it on that device too. It is also how you withdraw your consent to the diary: "Stop saving my diary" in Settings leads to it. It reports a partial result when a deletion component fails. So that deleted entries cannot come back from Apple Health or a web-diary transfer code, the app then keeps a short record of each deleted entry on your iPhone (for a drink, its time, amount and drink type; for a visit, its time, volume, urgency and whether there was leakage) and deletes it about five days later. If PeePal can't confirm that your iCloud copy has gone, it also keeps a scrambled code made from your iCloud account on this iPhone, so a later attempt can check it's deleting from the same account. It is never sent anywhere and is removed once the copy is confirmed deleted. It also keeps a note of when you withdrew your consent, with no diary details. Drinks stay in Apple Health if you choose to keep them there, or if another app wrote them. Avoid adding new records while deletion is running. iCloud device backups are separate; remove them through iOS Settings → Apple ID → iCloud → Manage Account Storage if required.

Your rights. You have rights to access, correct, delete and move your information, and to object to or restrict how it is used. Because there is no account, you use most of these in the app itself: you can view and edit any entry, export it (Share or PDF), or use Delete All My Data. If your diary is paused, you can still view and export it. We cannot find your diary from an email, because nothing links an email to a phone, and we hold no copy of it. If you write to us about your rights, we will explain what we can and cannot do. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live.

Analytics

The iOS app sends crash reports; see "Crash reporting" below. It does not send weekly usage counts in this version.

Privacy Policy

This Privacy Policy describes how PeePal ("we", "us", "our") handles information in connection with the PeePal mobile application and this website.

The short version

Your diary is kept on your iPhone and, if you turn on Sync with iCloud, in your own private iCloud database, which Apple runs. Your diary entries are not stored on any server we operate. The iOS app sends crash reports, from which we remove diary values. We do not sell your data. We do not share your data with third parties for advertising or commercial purposes. We also receive any emails you send us. Details are below.

Why we use your information

• Your diary: your explicit consent. You give it in the app before PeePal saves anything (or when you first open this version, if you used PeePal before). The box starts unticked, the screen is separate from the terms, and PeePal records on your iPhone what you agreed to, when, and which version of the wording you saw. If you choose Not now on a new install, nothing is saved. If you used PeePal before and choose Not now, your diary is paused: PeePal won't save new entries or sync without your OK, what's already saved on this iPhone isn't changed, and you can still view and export it. You can withdraw your consent at any time: Stop saving my diary in Settings, or Settings, then Data, then Delete All My Data, which deletes your diary. Withdrawing doesn't affect what happened before.
• Copying your diary to your own private iCloud database, if you turn on Sync with iCloud: your explicit consent. This is a separate choice from your diary, and it is off unless you turn it on. If you synced with an earlier version, syncing is paused until you choose. PeePal records on your iPhone what you chose, when, and which version of the wording you saw. You can withdraw at any time: turn off Sync with iCloud in PeePal's Settings, then choose whether to delete the copy in your iCloud or keep it. Withdrawing doesn't affect what happened before.
• Crash reports: our legitimate interest in keeping PeePal working and fixing faults. We remove diary values first.
• Emails you send us: our legitimate interest in replying to you and improving PeePal. Please don't put health details in an email. If you choose to attach a screenshot, it may show your diary entries. We use it only to deal with your feedback.
• Running this website securely: our legitimate interest in keeping the site available and safe.
• Handling your privacy requests: our legal obligations under data protection law.
• Weekly usage counts: the app sends none in this version. If a later version adds them, they will be off unless you turn them on, and we will rely on your consent.

Information we do not collect

• Account details or passwords (there is no account)
• Your name or email address, unless you email us
• Your diary entries (drinks and visits) on any server we operate
• Your precise location (our providers see your IP address, as explained below)

The visit form offers a period option only if you turn on the "Track periods" preference. That preference is not synced or sent to us. PeePal stores no biological sex or other identity fact, and it is not an account.

Information we may collect

The app sends no usage counts in this version. If a later version adds them, they will be off unless you turn them on.

Earlier versions of the app may have sent weekly usage counts. These are held only as anonymous totals in Cloudflare Analytics Engine, which deletes them automatically after about three months. We keep no separate copy or raw log. They are not used for tracking, advertising or profiling.

Crash reporting

PeePal uses Sentry for crash and error reporting. Crash reports contain technical diagnostic information (device type, OS version, stack trace). We remove diary values from reports before they are sent. Crash reports go to Sentry's European service in Germany, and Sentry sees your IP address when a report arrives. We keep crash reports only while we need them to find and fix faults, and Sentry deletes them automatically after the period set for our account. Sentry may keep ordinary logs under its own policies.

Cloudflare and Sentry. Our website and our crash reports rely on two US companies. Cloudflare, Inc. runs the website on servers around the world. Functional Software, Inc. (Sentry) stores our crash reports in Germany and may access them from the United States. Neither receives your diary entries or your name, but both see technical details such as your device's internet (IP) address. Where this information leaves the UK or EU, it is protected by the standard contractual clauses and the UK Addendum in their data protection terms. Cloudflare is also certified under the EU–US Data Privacy Framework and its UK extension. Ask us if you want a copy of these safeguards.

This website

This website does not run analytics scripts or marketing tags.

The browser diary saves entries in this browser's own storage (IndexedDB). It does not send them to PeePal or anyone else. Our web host, Cloudflare, sees each page request (including your IP address) and may keep ordinary access logs to run the site.

Emails to admin@peepal.info. They are held by our email provider, Fastmail, and read by an AI assistant that works for us on the Cursor platform (Anysphere, Inc.), which we use under a business agreement. The assistant helps us summarise genuine feedback. Under that agreement and with Privacy Mode turned on, neither Cursor nor its model providers use the content of those emails to train AI models. The assistant may keep working copies while it runs; we delete the emails themselves under the rule below. If you send feedback from the app, it includes a screenshot only if you turn that on.

We read each email and decide what it needs. Feedback is summarised without your name, email address or any health details, and the email is then deleted. Emails that need a reply or another action are deleted once that is done. Emails we generate ourselves, and mail from our providers such as receipts, service notices and security alerts, are kept separately for running PeePal and are not covered by this rule.

We keep the summaries, which contain no personal details, in our planning tool for up to 12 months.

After we delete an email, Fastmail keeps it for 7 to 14 days so it can be restored. Fastmail's backups may keep copies for longer, and Fastmail does not commit to a fixed period for this. Fastmail also keeps its system logs, which can include your email address and IP address, for 180 days.

Fastmail is an Australian company. It stores email in the United States, and possibly also in the Netherlands. Its backups and logs are always in the United States. Fastmail's data protection terms include the European Commission's standard contractual clauses for these transfers.

The Cursor platform and its model providers (including SpaceXAI LLC for Grok) process that content in the United States. Transfers from the UK and EU are covered by the standard contractual clauses and the UK Addendum in Cursor's data protection terms. Ask us if you want a copy of those safeguards.

Please don't put health details in an email. If you do, we use them only to reply to you, and we leave them out of any summary. If you choose to attach a screenshot, it may show your diary entries. We use it only to deal with your feedback, and you can ask us to delete it.

Children

PeePal is not intended for children under 13. We do not knowingly collect information from children.

HealthKit

If you grant permission, PeePal may read and write water, caffeine and alcohol through Apple Health. Drinks it reads become diary entries, and are copied to your private iCloud database like any other entry if iCloud is on. Apple Health itself remains subject to Apple's terms and your iOS permissions.

Changes to this policy

If this notice changes, we will update the date at the top and show a summary of the changes in the app and on this page.

Contact

For privacy enquiries, email admin@peepal.info.

Terms of Use

By downloading or using PeePal, you agree to these terms. If you do not agree, do not use the app.

Use of the app

PeePal is provided for personal, non-commercial use. You may not reverse engineer, decompile, or attempt to extract source code from the app. You may not use the app for any unlawful purpose.

No warranty

PeePal is provided "as is" without warranty of any kind. We make no guarantees about accuracy, completeness, or fitness for any particular purpose — including medical or clinical use.

Limitation of liability

To the fullest extent permitted by law, PeePal and its developers shall not be liable for any loss or damage arising from your use of, or inability to use, the app.

Intellectual property

All content, design, and code in PeePal are the property of PeePal and its developers. You may not reproduce or redistribute any part without written permission.

Governing law

These terms are governed by the laws of England and Wales.

Changes to terms

If we change these terms, we will update the date and show a summary of the changes in the app and on this page.

Medical Disclaimer

PeePal is a wellness tool, not a medical device.

The information and insights provided by PeePal are for general informational and wellness purposes only. They do not constitute medical advice, diagnosis, or treatment.

PeePal is not a substitute for professional medical advice. Always seek the advice of your GP, consultant, or other qualified healthcare professional with any questions you may have regarding a medical condition. Never disregard professional medical advice or delay in seeking it because of something you have read in or exported from this app.

If you think you may have a medical emergency, call 999 (UK) or your local emergency number immediately.

The health guides available in PeePal are educational resources only and have not been reviewed or approved by a regulatory body. They are not a substitute for advice from a qualified healthcare professional.