Peekli Legal Information

Legal Notice (Impressum)

Information according to § 5 DDG
Max Skupch
c/o POSTFLEX PFX-620-839
Emsdettener Straße 10
48268 Greven
Germany
Please do not send parcels or packages to this address.

Contact
Phone: +49 151 51957591
E-Mail: support@peekli.app

VAT ID
Sales tax identification number according to § 27 a of the Sales Tax Law (Umsatzsteuergesetz): DE352406028

EU Dispute Resolution
The European Commission provides a platform for online dispute resolution (ODR): https://ec.europa.eu/consumers/odr/. You can find our e-mail address above in the Legal Notice.

Consumer Dispute Resolution / Universal Arbitration Board
We are not willing or obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Responsible for content according to § 18 Abs. 2 MStV (German State Media Treaty)
Max Skupch
c/o POSTFLEX PFX-620-839
Emsdettener Straße 10
48268 Greven
Germany
Please do not send parcels or packages to this address.

Privacy Policy

This Privacy Policy covers both the Peekli iOS app (including its Home Screen widget) and the peekli.app website. The controller responsible for data processing is Max Skupch (contact details in the Legal Notice above).

The short version: Peekli has no accounts, no e-mail login and no Sign in with Apple. Everything you and your person send each other — notes, drawings and photos — is end-to-end encrypted on your phone, so our server only stores sealed data it cannot read. There is no advertising, no advertising identifier and no tracking across apps or websites. The app measures how it is used only if you say yes, once, with nothing pre-selected. Subscriptions are handled by Apple and by RevenueCat. The website uses no cookies and no analytics. Each of these is described below.

The app: what is stored on your device

The app keeps on your device: your first name, the secret that links you with your person (in the iOS Keychain, so the widget can read it), your sign-in token for our server (also in the Keychain), your choices (for example your analytics answer), and the most recent post from your person, still sealed, so that the widget can show it offline. Deleting the app removes most of this; the Keychain items can outlive the app on purpose, so that a reinstall or a restored backup keeps your link. "Delete my data" in Settings is the way to start over.

The app: how Peekli knows you (no account)

On first launch the app asks our server for an identity: a random user ID and a long random token. We store the user ID and only a one-way hash of the token, so we cannot recover it. There is no name, e-mail address, phone number, Apple ID or device identifier in that request. The user ID is the only identifier of your install; it is also the ID used with RevenueCat (see purchases below) and with our usage counts if you agree to them.

If you enter a first name, it is stored on our server and shown to your person. We also store: whether and with whom you are linked (a link is a "couple" of two user IDs), the invite codes you create, your push notification tokens (so that your widget can update and you can be notified), and when your subscription runs until.

The app: linking with your person

When you tap "Link", the app asks our server for a single-use invite code (valid for 7 days) and builds an invite link from it: https://peekli.app/p/<code>#<secret>. The secret is created on your phone and is the key that encrypts everything the two of you send. It sits after the # in the link, which browsers, our website and our server never receive. You send the link yourself, for example through Messages, so that message passes through the service you choose to send it with (Apple's iMessage or SMS, for instance), under that service's own privacy policy; anyone who can read that message could use the link, so send it only to your person. When your person opens the link, their app tells our server the code, and the server links the two of you. The secret is stored on both phones only after that succeeds. Unlinking, or "Delete my data", ends the link and deletes the couple's posts; a new link always gets a new secret.

The app: notes, drawings and photos (end-to-end encrypted)

When you send a note, a drawing or a photo, your phone encrypts it (AES-256-GCM) with the secret you share with your person before it leaves your phone, and sends our server only the sealed result. We cannot read, view or listen to what you send, and we never store the key. What our server can see is technical: who sent it, when, whether it is a note, a drawing or a photo, and how large it is.

We keep only each person's newest post (at most two per couple): when you send a new one, your previous one is deleted. Unlinking or deleting your data deletes the couple's posts. Photos you take or pick are reduced in size on your phone before they are sealed; the app uses the camera only when you choose to take a photo, and it does not read your photo library beyond the picture you pick. Because we cannot read posts, we cannot check what is in them; see the Terms.

The app: widget and notifications

The widget on your Home Screen asks our server for the latest post from your person, downloads the sealed bytes, opens them with the secret on your phone and shows the result. To update it quickly, our server sends Apple a widget update push through the Apple Push Notification service (Apple Inc., USA), using the push token your widget gave us. If you allow notifications, we also send an alert through Apple's service saying that your person sent a note, a drawing or a photo, including the first name you gave (or without it if there is none). The alert never contains the content. Apple handles these pushes under its own privacy policy. If you do not allow notifications, iOS simply drops the alert; the widget still refreshes by itself.

The app: purchases and subscriptions

Subscriptions (weekly or yearly) are purchased through Apple's App Store. We receive confirmation that a purchase happened, but never your name, card number or billing details; those are handled under Apple's Privacy Policy (https://www.apple.com/legal/privacy/).

To manage your subscription, the app uses RevenueCat (RevenueCat, Inc., USA) as our processor. The RevenueCat software in the app uses your random user ID as your customer ID and sends RevenueCat your purchase and subscription information from Apple, together with technical details such as the app version, operating-system version, App Store country and your IP address. It contains nothing you wrote in the app. RevenueCat tells our server when a subscription starts, renews or ends (by webhook), and our server can ask RevenueCat whether a subscription is active; it keeps the date until which the subscription runs. One subscription covers both people in a couple, so when you are linked, your person's app and our server can tell whether the couple is unlocked, and nothing more about the purchase. Legal basis: Art. 6 para. 1 lit. b GDPR (providing the subscription you bought). Storing the ID on your device needs no consent under Sec. 25 para. 2 no. 2 TDDDG, because it is strictly necessary to provide the subscription you asked for.

The app: feedback and problem reports

The app has a voluntary feedback form. It is a web page on peekli.app that opens inside the app (in a Safari sheet) only when you choose to send feedback. Only if you send it, the following reaches our server: the message you write; optionally your e-mail address, only if you want an answer and used only to reply; and a few pieces of context that the app prefills and shows as chips, so that you can see exactly what is sent — such as the app version and build, your device model and iOS version, your language and the type of feedback. The feedback carries no user ID or other install identifier, and it is stored under a random ID generated for that one message.

Our server stores it and forwards it to a workflow tool (n8n) that we use to notify ourselves; it is used to fix faults, to answer you and to decide what to build next. Legal basis: Art. 6 para. 1 lit. a GDPR (your consent, given by choosing to send; withhold it simply by not sending). Please do not include personal information in the message unless you want us to have it. To limit abuse, our server briefly counts requests per hashed IP address in memory; the address itself is not stored.

The app: analytics — only if you turn them on

The app can measure how it is used, so that we can see where people get stuck. You are asked once, during setup, with "No, Thanks" and "Yes, Share" and nothing pre-selected, and you can change your answer at any time in Settings. Our analytics provider is Mixpanel (Mixpanel, Inc., USA), acting as our processor on its European infrastructure (api-eu.mixpanel.com).

If you say yes, the app starts Mixpanel and sends events from a fixed list — that you agreed, that the subscription screen was shown, that an invite was sent, that you linked, that you sent a note, a drawing or a photo (only which kind), and that you unlinked — together with your random user ID as identifier and ordinary technical details (app version, device model, operating-system version, language). Mixpanel's software stores an identifier on your device for this. Your IP address reaches Mixpanel with the request, as with any network request. We never send anything you wrote, drew or photographed, nor your name. Legal basis: Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TDDDG — your consent, given by choosing "Yes, Share".

If you say no, or have not answered yet, the analytics software is never started: nothing is sent to Mixpanel and nothing is stored on your device for it. Withdrawing your consent in Settings stops the software and removes what it stored; "Delete my data" also withdraws it and asks you again. Nothing in the app stops working. This data is used to improve the app and for nothing else: not for advertising, not combined with data from other apps or websites, not sold. There is no advertising identifier (IDFA) and no App Tracking Transparency prompt, because we do not track you in the sense Apple's rules use the word.

The app: our server (api.peekli.app)

Our server is operated for us by Railway (Railway Corp., USA) as a processor, on Railway's servers in the EU. It stores what is described above (user IDs, hashed tokens, first names, links, invite codes, push tokens, the subscription end date, sealed posts, feedback). Your IP address necessarily reaches it with each request; the server uses it only in memory, hashed, to limit how many requests one address can make, and does not write it to its logs. Railway may briefly record standard technical access data for security and reliability (Art. 6 para. 1 lit. f GDPR — our legitimate interest in a secure, working service).

The website (peekli.app)

The peekli.app website is a small static site. It uses no cookies, no analytics and no third-party scripts or fonts, and it stores nothing in your browser. The invite page (peekli.app/p/…) reads the code from the address and checks, inside your browser, that the part after the # is present, so that it can offer you a "copy link" button; that part is never sent to us or anyone else. The feedback page described above sends data only when you press Send. The domain's DNS is managed at Spaceship (Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA); details in its privacy policy: https://www.spaceship.com/legal/privacy-policy/.

Hosting. The website is hosted by Railway (Railway Corp., USA) on servers in the EU. Personal data that may arise when you visit the site can be processed on the hoster's servers — in particular IP addresses and technical access data in server log files. The hoster is used in the interest of a secure, fast, and efficient provision of our online offer (Art. 6 para. 1 lit. f GDPR).

Launch notification sign-up (peekli.app)

Until the app is on the App Store, the website offers an optional form to be notified when it launches. Submitting it is voluntary and works only if you enter an e-mail address. If you submit it, we process the e-mail address you enter, together with the date, for the sole purpose of sending you a notification when Peekli becomes available. (The form also contains a hidden anti-spam field that people never see; it is not personal data.)

Your address is sent to and stored on our server (api.peekli.app, operated for us by Railway, see above), and our server tells a workflow tool (n8n) that we use to notify ourselves that a new address has arrived. We do not share it with advertisers or other third parties and do not use it for any other purpose. To limit abuse, our server briefly counts requests per hashed IP address in memory; the address itself is not stored. Legal basis: Art. 6 para. 1 lit. a GDPR (your consent, given by submitting the form). You can withdraw your consent and ask us to delete your address at any time by e-mailing support@peekli.app; we also delete it once the launch notification has been sent and it is no longer needed.

Server log files

The hoster automatically collects and stores information in so-called server log files, which your browser transmits when you access the site. These may include: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request, and IP address. We do not merge this data with other data sources. The collection is based on Art. 6 para. 1 lit. f GDPR (legitimate interest in the technically error-free presentation and optimization of the website).

Contact by e-mail

If you contact us by e-mail, your inquiry including all personal data resulting from it (e.g. e-mail address, content of your message) will be processed by us for the purpose of answering your request. We will not pass on this data without your consent. The processing is based on Art. 6 para. 1 lit. f GDPR (our legitimate interest in the effective processing of inquiries) or, where applicable, Art. 6 para. 1 lit. b GDPR. Please note that e-mails to us are business correspondence and are subject to statutory retention obligations under German commercial and tax law (Sec. 257 German Commercial Code (HGB), Sec. 147 German Fiscal Code (AO)). We retain e-mail correspondence uniformly for ten years — the longest of these statutory periods — and delete it after that. Legal basis: Art. 6 para. 1 lit. c GDPR and, insofar as retention goes beyond an individual statutory obligation, Art. 6 para. 1 lit. f GDPR (our legitimate interest in a uniform retention practice and in establishing and defending legal claims).

How long we keep things

• Your identity on our server (user ID, hashed token, first name, push tokens, invite codes, subscription end date) — until you use "Delete my data" in the app, which deletes it.
• Posts — only each person's newest one; deleted when replaced, when you unlink and when you delete your data.
• Everything on your device — until you delete it or the app (the Keychain items may remain, as described above).
• Launch sign-up e-mail addresses — until the launch notification has been sent, then deleted; deleted on request.
• Feedback messages (message, optional e-mail, context) — kept for as long as they are useful for answering you and improving the app, and deleted on request.
• Analytics events (only if you agreed) — held in our Mixpanel project for as long as they are useful for improving the app.
• Subscription information at RevenueCat — for as long as it is needed to provide your subscription and to meet legal record-keeping obligations.
• E-mail correspondence — as described above.
• Server log files — kept only briefly, for security and reliability.

Note on data transfer to the USA

Our providers (Apple, RevenueCat, Mixpanel, Railway, Spaceship and the provider of our workflow tool) are based in the USA or process data there, so personal data may be transferred to and processed in the USA. No level of data protection comparable to that of the EU can be guaranteed there; US companies may be obliged to surrender personal data to authorities. Railway and Mixpanel process our data on servers in the EU, but as US companies they may still be subject to US laws obliging them to disclose data. Where required, such transfers are based on appropriate safeguards such as the EU Standard Contractual Clauses.

Your data protection rights (GDPR)

Under the General Data Protection Regulation (GDPR), if you are a resident of the European Economic Area (EEA), you have the following rights:

• The right to access, update or delete the information we have on you.
• The right of rectification if information is inaccurate or incomplete.
• The right to object to our processing of your personal data.
• The right of restriction of processing.
• The right to data portability.
• The right to withdraw consent at any time where we relied on your consent.

Because Peekli has no accounts, we usually cannot tell who a user ID belongs to. You can delete everything linked to your install yourself: in the app, open Settings and choose "Delete my data". That unlinks you, deletes the couple's posts, your invite codes and your identity on our server, and withdraws your analytics consent. What remains outside this is your subscription record at RevenueCat and Apple (to have it deleted, write to support@peekli.app and include the order ID from Apple's purchase receipt) and any feedback or e-mail you sent us (write to us from the same address, or quote the message, and we will delete it). Apple keeps its own purchase records under its privacy policy. You also have the right to lodge a complaint with a Data Protection Authority in the EEA (in Germany, the competent authority for the controller).

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Terms

By downloading or using the Peekli app you agree to these Terms. If you do not agree, please do not use the app.

What Peekli is — and is not

Peekli is a small app for two people who want to leave each other notes, drawings and photos on their Home Screen widgets. It links one person with one other person, and it is meant for friendly, personal communication between people who know each other. It is not a messenger for groups, a public network or a way to contact strangers.

Your content and acceptable use

You are responsible for what you send. Do not send anything unlawful, threatening, harassing or abusive, anything that infringes the rights of others, or anything that you do not have the right to send. Because everything is end-to-end encrypted, we cannot see what you send and cannot check or moderate it. If someone sends you something you do not want, you can unlink in Settings at any time, which ends the link and deletes the couple's posts; you can also report problems to support@peekli.app. We may block an installation or end a link that is used to abuse our service or other people, or to circumvent the app's limits, to the extent we can tell from information we hold (for example reports or the volume of requests).

Your licence to use the app

We grant you a personal, limited, non-exclusive, non-transferable, revocable licence to use the app for your own personal, non-commercial purposes, in line with these Terms and the applicable App Store rules. You may not copy, resell or redistribute the app or its content, try to get around its purchase requirements, or misuse our server (for example by sending automated requests).

Subscriptions

The app's features require a subscription, offered weekly or yearly as auto-renewable subscriptions through Apple's App Store. The weekly subscription may start with a reduced price for the first week (this is not a free trial); after that the regular weekly price applies. Prices and terms are shown in the app and in the App Store before you buy, in your local currency.

• One subscription covers both of you. If either of you has an active subscription, the app is unlocked for you both while you are linked. If the person who pays cancels or stops, access ends for both of you when the paid period ends, unless the other person has their own subscription. If you unlink, each of you needs a subscription of your own.
• Payment is charged to your Apple Account when you confirm the purchase.
• The subscription renews automatically at the end of each period unless you turn off auto-renew at least 24 hours before the period ends. Your account is charged for renewal within the 24 hours before the period ends.
• You can manage or cancel your subscription at any time in your Apple Account settings (Settings → your name → Subscriptions). Cancelling stops the next renewal; the current period stays active until it ends.
• An introductory offer can be used once per Apple Account.
• Refunds are handled by Apple — we do not process payments and cannot issue App Store refunds directly. Your statutory consumer rights remain unaffected.

Intellectual property

The app and its content are owned by Peekli (Max Skupch) or our licensors and are protected by law. These Terms do not transfer any ownership to you. What you create and send stays yours; we do not need, and cannot get, any rights to it beyond what is technically necessary to deliver it to your person.

Availability

We try to keep Peekli running, but widget updates depend on Apple's services and on your connection, and the system decides how often a widget may refresh. We do not promise that a post appears at a given moment, or that the service is free of interruptions.

Disclaimer and liability

To the fullest extent permitted by law, the app is provided "as is" and "as available", without warranties of any kind, and we are not liable for indirect, incidental, or consequential damages. Nothing in these Terms limits liability that cannot be limited by law (such as for death or personal injury caused by negligence, or for intent and gross negligence), and your mandatory statutory consumer rights remain.

Apple App Store terms

The app is licensed, not sold, and its use is also subject to Apple's Licensed Application End User License Agreement (LEULA); if these Terms conflict with the LEULA, the LEULA governs for App Store matters. These Terms are between you and Peekli (Max Skupch), not Apple; Apple has no obligation to provide support or maintenance for the app; and Apple and its subsidiaries are third-party beneficiaries of these Terms and may enforce them.

Governing law

These Terms are governed by the law of the Federal Republic of Germany, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods, and without prejudice to the mandatory consumer-protection rights you have in your country of residence.

Changes and contact

We may update these Terms and this Privacy Policy; the current version is the one published here. Questions: support@peekli.app.