Privacy Policy

01Our three promises

Before any clauses, our bottom line:

• •We never sell your data. Location, activity, letters — not a single record, not to anyone.
• •We never monetize your data with ads. No data-driven advertising, no data exchanges for marketing, and we never scan your letters for any advertising purpose.
• •We collect only the minimum needed to watch over you. What we don’t need, we don’t touch and don’t store.

However our business evolves, personal data will never become a commodity to be sold, exchanged, or tracked for ads.

02What we collect

Five categories, by purpose:

• •Account data: email and display name (nickname) — to create your account, sign you in, and reach you when necessary.
• •Care signals: step count and activity time (read from your phone’s motion sensing with your permission), app–server heartbeats, device battery level (used only for care logic — never shown to your teammates), and last known location. This small set of signals serves one purpose only: if your lamp stays unlit and all goes quiet for too long, it lets us gently remind the person you chose in advance.
• •Letter Doves content (once the feature launches): the plain-text letters you exchange with pen pals, stored to deliver and keep your correspondence.
• •Settings & relationships: your daily check-in time, check-in mode, the location-sharing switch, and your teammate pairings and invitations.
• •Website waitlist: the email (and optional identity/region) you leave us, stored in our database and used only to notify you at launch. Our website uses no cookies and no trackers.

03About location — said clearly

So the person you chose can come check on you after a long silence, the app quietly notes a "last known location" in the background — using the system’s significant-location-change mechanism, the most battery-friendly way, with no continuous GPS tracking.

"Collecting" and "sharing" are two different things. Your location normally stays in the system and is shown to no one. Only at the moment the system alerts your teammates after a prolonged non-response — and only if your "attach my last location" switch is on — is the last location shared, and only with teammates you chose yourself.

The switch is on by default, but the choice is yours from the very start: you can opt out during initial setup, and change it anytime later in the app’s care settings. When off, the system still records location (needed for care logic) but no longer shares it with teammates.

04How we use data

• •Providing care: gently reminding the person you chose in advance when your lamp stays unlit and all goes quiet for too long, and showing your family your "all is well" status at the time you set.
• •Notifications: reminders to you first; alerts to your chosen teammates only when you remain unresponsive.
• •Delivering letters to the pen pals you choose (once the feature launches).
• •Service records & debugging: keeping care event logs (heartbeats, confirmations, escalations) to trace issues and be accountable to you.
• •Answering your questions and support requests.

We never build advertising profiles or run analysis unrelated to the service.

05Who your data goes to

• •Your chosen teammates — the heart of the service. When the system alerts them, they receive your last activity time and (if the switch is on) last known location; with daily check-ins, your family sees your daily status and step count. That is the full extent, and always only people you picked.
• •Your chosen pen pals: only the recipient of a letter can read it (once the feature launches).
• •Infrastructure providers working under our instructions, strictly as needed: database & backend hosting (Supabase, servers in Tokyo), website hosting (Vercel), push delivery (Apple APNs / Google FCM).
• •Legal requirements: only when the law clearly requires, through due process.

Beyond the above, we provide your data to no third party. No exceptions, no fine print.

06Retention & deletion

• •Your data is kept for as long as your account exists.
• •You can request account deletion by email at any time (see the "Account Deletion" page); a built-in one-tap deletion will ship with the official release.
• •After deletion, data is removed from our systems; backup copies are purged within 30 days at the latest.
• •Care event logs are kept only as long as reasonably needed for the service.
• •Waitlist emails are used only for the launch notice; you can ask us to remove yours anytime.

07Your rights

You may at any time request: access, a copy, correction or supplementation, suspension of collection/processing/use, or deletion of your personal data.

To exercise these rights, email hello@peipao.app. We will respond within a reasonable time and never charge unreasonable fees.

08Security

• •All transmission is encrypted (HTTPS/TLS).
• •Database access follows the principle of least privilege — only programs and people the service strictly requires.
• •We keep improving our safeguards; in the event of a major incident, we will notify you and the authorities as required by law.

09Children and minors

The Service is not directed at children. Minors should use the Service only after a legal guardian has read and agreed to this policy.

10Third-party services

11Changes to this policy

For material changes, we will post prominent notices in the app and on the website, and notify you directly when necessary. Revised policies take effect upon announcement.

12Contact us

Questions about this policy, or exercising your data rights: hello@peipao.app.

Published by PeiPao by OsVian (OsVian Co., Ltd.)