Legal

Privacy policy

Last updated 11 November 2026

What this policy covers

Our websites (pecklist.com, selfhosted.pecklist.com, docs.pecklist.com and demo.pecklist.com) and the purchase of supporter keys.

It doesn't cover a PeckList server someone else runs: whoever runs that server is responsible for it. What the PeckList app and server send to the project, and how to turn it off, is listed on the app's privacy page.

PeckList Plus

PeckList Plus, our hosted subscription, is not on sale yet. Before it is, we'll add to this policy what a hosted account stores and how we look after it.

Account information and tasks in PeckList Plus are not end-to-end encrypted, so they are readable on our servers. Please don't store private or sensitive personal information in a subscription account; see our terms.

Visiting the websites

Visit counts. We count visits with Umami, which we run ourselves. It uses no cookies. It records the page, the page you came from, your browser, operating system, device type and screen size, and your country, worked out from your IP address. It doesn't keep the IP address itself.
Session recordings. On some pages Umami also records how a visit moves around the page (scrolling, clicks and page changes), with anything typed into a field masked. It doesn't run on the pricing, support and legal pages.
Server logs. Like every website, the servers and network providers that deliver our pages see your IP address and the page requested, to send the page and to keep out attacks.
Fonts. The pages load their fonts from Google Fonts, so Google sees your IP address when a page loads. See Google's privacy policy.
Ko-fi. The support page shows a panel from Ko-fi, and Ko-fi's own privacy policy applies to it. No other page loads anything from Ko-fi.
The demo. Anything you type into demo.pecklist.com, accounts included, is deleted when the demo resets, every hour.

Buying a supporter key

Paddle.com is our reseller and Merchant of Record. Paddle collects what it needs to take the payment, such as your name, email address, billing country and payment details, and handles it under Paddle's privacy policy. We never see your full card number.

Paddle shares with us your name, email address, country, what you bought and the order details. We use them to send your key, to answer you, and to keep the records that tax and accounting law require.

Writing to us

If you email us, we keep the conversation so we can answer you and follow up.

Why we use it

To sell and deliver your key and give support: to carry out our agreement with you.
To keep order records: because the law requires it.
To count visits, keep the websites working and keep out attacks: our legitimate interest in running and improving the websites.

Who receives it

Paddle, as Merchant of Record, and the providers that host and deliver our websites and email, only for those purposes. We don't sell your personal data, we don't share it for advertising, and the websites show no ads. Some of these providers are in other countries, including the United States; where the law requires it, the transfer is covered by safeguards such as standard contractual clauses.

How long we keep it

Order records: as long as tax and accounting law requires.
Emails: as long as we need them to help you.
Visit statistics: only as long as they're useful for understanding how the websites are used.

Your rights

You can ask us for a copy of your personal data, and ask us to correct it, delete it, limit how we use it, object to how we use it, or hand it to you in a portable form. Write to [email protected]. You can also complain to the data protection authority where you live.

Security

The websites are served over HTTPS only, and access to order records and visit statistics is limited to us.

Children

The websites and supporter keys aren't meant for children under 13.

Contact

For anything about privacy, write to [email protected]. Who we are is in our terms.

Changes

If this policy changes, the date at the top changes with it, and we'll say what changed for anything important.