Español

Peltra Privacy Policy

Last updated: 25 August 2026

In two lines

Peltra is a list app. With no account you can try the whole thing, and what you write never leaves your phone. With an account, your lists are kept on our server so you have them on any phone and can share them. There are no ads, no profiling, and we never sell or pass your data to anyone.

We measure how many people use the app and the site and how long things take to load, and nothing more: visits and timings, never what you write or what you do inside. No analytics company is involved, and you can turn it off in Settings → Privacy.

1. Who processes your data

Write to hello@peltra.app about anything in this policy, including your rights. We answer within one month (art. 12(3) GDPR).

2. What we process, what for, and on what legal basis

2.1 Using Peltra without an account

We process no personal data at all. No session is opened with our server, nothing is uploaded, and we do not know you exist. Whatever you write lives on your own phone and disappears if you uninstall the app.

Without an account you can use the whole app — add, check off, sort, dictate, group, filter — inside a practice list, which the app labels as such precisely so it is clear that it is not saved anywhere. To have lists of your own, to still have them if you change phones, and to share them, you need an account.

The app reminds you of this permanently while you have no account, because it has one important consequence: if you lose the phone, there is no copy anywhere.

If you were already using Peltra without an account and had created lists, they are still there and you can read all of them: nothing has been deleted. To write in them again you need an account, and as soon as you create one they are uploaded as they are.

When you create an account, the app asks you whether to bring over whatever you added to the practice list. Nothing is uploaded unless you say so.

2.2 If you create an account

Your profile photo never travels: it stays on this phone. People you share lists with see your name, your one-line bio and your colour, not your face. A photo you attach to an item is a different thing and depends on your version of the app: it is set out in §2.4, and the app itself tells you right where you attach it.

We do not ask for your real name, phone number, date of birth, address or payment details. The name we do ask for when you create the account is your display name: it exists so that the people you share lists with recognise you, so it can be a nickname, a first name or anything you like, and we never check it against anything. Payments are handled by Apple and Google using the details already in your store account: we never see your card, your billing name, your address or the amount. All we keep is which plan you have, what state it is in and until when (see §3.1).

We do not process special categories of data (art. 9 GDPR) and never ask you for them. If you write some yourself in a list — a medical appointment, say — it is treated like any other content of yours: we do not read it and do not analyse it.

2.3 How we measure use of the app and the site

What we measure. Which screen or page opens and for how long, how long the visit lasts, what gets tapped — only on the elements we mark ourselves — how far down the page you read, your device type and screen width, and how long things take to load. Nothing else.

Why we do not ask your permission, and why you will not see a cookie notice. Spanish law exempts audience measurement from consent when it meets strict conditions, and we meet all of them: the purpose is limited to measuring the audience of our own site and our own app, the data is not cross-referenced with any other processing, it is not passed to anyone, it cannot follow you across other websites or other apps, and the identifier expires. We keep to that list deliberately: it is what lets us not put a notice in front of you.

What we do NOT measure, and cannot. What you write, which lists you create, what you add, whether you use the camera or dictation, or anything else you do with the app. That data would require your prior consent, so it is simply never collected. Nor your name, your email, your account identifier, or anything you have written: every value that travels has to be a number or a short label from a closed list written into the code, and anything else is discarded before it leaves the device.

We do not store your IP address either, and we do not use it to work out where you are. The server never reads it.

There is no analytics company. No Google Analytics, no Firebase, no Sentry, no PostHog, none: the data goes to our own server — the same one in §3.1 — and is shared with nobody. There are no ads, no profiling and no cross-app tracking either: Peltra never reads any advertising identifier from your device.

You can object at any time (art. 21 GDPR), from Settings → Privacy. Turning it off does not just stop the measuring: it deletes the identifier from your device and asks the server to delete everything that had been sent from it. If your browser sends Global Privacy Control or "Do Not Track", we respect it without you having to do anything.

2.4 What stays on your phone, with or without an account

These are never uploaded to our server:

• Anything the camera reads: OCR of a receipt or a handwritten list is resolved by the operating system's own recogniser, on the device. The image is never sent anywhere.
• Calendar links and reminders, which are local.
• Your phone's address book. If you use «search my address book», Peltra reads

email addresses only — no names, no phone numbers, no photos, no birthdays — turns them into codes on the device, and sends twelve bits of each code: one of 4096 possible buckets. The server returns whole buckets, with people you do not know in them, and the final comparison happens on your phone. So the server knows which buckets you asked about and does not know who is in your address book. No copy of your address book is kept, on the phone or on the server.

• App settings (language, theme, text size) and how you prefer to see your lists — as rows or as a grid, and sorted by which criterion — which belongs to the phone and not to the account: changing it does not reorder anyone else's lists.

The photos you attach to an item are the case that depends on your version of the app, and the app tells you which one it is, in a line right under the button you attach it with:

• If it says «saved on this device only», that is literal: the photo does not leave this device, the people sharing the list cannot see it, and it is not recovered on another device. That is how Peltra has worked from the start.
• If it says «saved to your account», it is uploaded to our server — the same one in §3.1 — so you have it on any device you sign in on. Only the people sharing that list can see it: it is kept in a private store and, each time someone opens it, a one-hour temporary link is requested that the server only hands to people in that list. There is no public address it can be viewed from, not even by guessing one.

That same sentence is in Settings → Privacy, and both come from the same place, so they cannot say different things. What does not change either way: the image is never analysed, by us or by anyone, and it is never sent to the AI (§3.1).

2.5 What you share into Peltra from another app

Peltra appears in the system share sheet, so you can send it text or a link from your browser, from a conversation, or from wherever you are. Three things about that:

• Text only. No photos, no videos and no files come in that way: the system does not even offer Peltra when what you are sharing is one of those.
• Nothing is added on its own. What you share lands on a review screen where you choose which list it goes to and which lines go in. Nothing is saved until you confirm.
• Sharing it does not take it off your phone. What you send is read on your device and turned into things in your lists, which from then on follow exactly the same rules as anything you typed yourself (§2.1 without an account, §2.2 with one). On iPhone the piece that receives it is an extension of Peltra itself, and it hands it over through a shared store inside the same phone.

The only way out is the usual one, and only if what you share is a link: to pull the ingredients out of a recipe or the date out of an event, your phone requests that page. It is the same thing that already happens when you paste a link by hand, and it is described in §3.2.

2.6 When you search for a real place

In a restaurant, places, or trip list you can type a location by hand — that never leaves your phone — or, if you turn it on in that list's settings, let us suggest real places while you type. If you turn it on:

• We ask for permission to use your approximate location, never the exact one, and only while the app is open — never in the background.
• The request goes out as soon as you start typing: every letter you type in the place field, along with your location rounded to a kilometre, is sent to our server, and from there to the services that search for the place (§3.2). Your phone does not talk to them directly, so your identity and address never reach them.
• Nothing about that search is stored: not what you typed, not your location, not the results. The only thing that stays is whatever YOU choose to save, in your own list, like any other data you type.
• What is saved when you pick a place, so you do not have to guess: its name, address, coordinates, identifier and OpenStreetMap link, and — where the map has them — its phone number, website, email, opening hours, cuisine and practical details about the venue (outdoor seating, step-free access, takeout or delivery, card payment, Wi-Fi). These are public details about the business, not about you, and they are stored in your list like anything else you write down: they go with you when you delete the item, the list or your account.
• If you do not turn the suggestion on, or say no to the permission, the place field keeps working exactly the same: typed by hand.
• We offer it before the system asks you. The first time you open a list that can suggest places we show you a card — once, and only once — explaining what it would be for, with a button to turn it on. If you dismiss it, we do not bring it back and you do not lose the ability to do anything.

And with that permission already granted — never asking for it just for this — we use the same location for one more thing: suggesting your country in Settings → Language and region, instead of making you find it in a long list. It goes to the same service with the same location rounded to a kilometre, we only read the country code from the answer — not your street, not your city — and we suggest it, we do not change it: until you tap the button, your country stays whatever it was.

3. Who your data is shared with

We do not sell data. There are no ads. There is no third-party analytics or tracking SDK inside the app: what we measure, if you let us (§2.3), goes to our own server and stays there. The only third parties involved are these, and each one only gets what it needs:

3.1 Processors

There is a data processing agreement (art. 28 GDPR) with each of the ones actually in use.

There are no activity alerts in this version, which is why Expo gets nothing. Peltra can tell you what someone else did in a shared list — "Luísa added 3 things to Groceries" — and to do that the alert would have to travel through Expo's push service, which would receive your device's notification token and the text of the alert, carrying the list title and the display name of whoever had just done something. That feature is off. Your device is not registered, no notification token is stored, and nothing goes out to Expo; the setting that would choose it is not in the app either. If it is ever turned on, it will be stated here first — with exactly what it receives — and this policy will change before the first alert goes out.

And reminders have nothing to do with any of this, and are unchanged. The alert for something with a date, the habit one and the one for what slipped past are scheduled by your own phone and never leave it: no server is involved, neither ours nor anyone else's. That is why they keep working with no connection at all.

There is no AI feature in this version, which is why Anthropic gets nothing. Peltra sends nothing of yours to an AI service: the features that would use one are switched off and do not appear in the app. If they are ever switched on, this policy will say so first — naming the provider and exactly what it would receive — and it will change before the first call ever happens.

When that day comes, these four things are already decided and will hold from the very first call:

• The AI would never receive a photo or a recording. Not even when what you did was take a photo or dictate: your own phone reads the photo and your own phone transcribes the dictation. What would go up is the text that came out of that. The same holds for photos you attach to an item, wherever they are kept (§2.4): they are stored and that is all, no model ever looks at them.
• Your name would not go, nor anyone else's, nor when, nor which list. The titles would go, and nothing else — not who wrote them, not the dates, not who is in the list.
• Most of what Peltra understands would never go through there. Dates, amounts, units, the supermarket aisle and the names it recognises as you type are all worked out by your phone, offline, sending nothing. AI would be the last resort and would only run when you asked.
• And it would only ever happen when you tapped it. No AI feature runs on its own.

Anthropic PBC is based in the United States, so before the first call we need its data processing agreement (art. 28), the transfer covered by the European Commission's standard contractual clauses, and a contractual guarantee that those texts are not used to train its models. Until that is signed, the feature stays off.

Nothing is charged for in this version, which is why RevenueCat gets nothing. There is no purchase screen, no plan to buy, and no cap applied to the free plan. What follows describes how paying would work the day it exists, and this policy will be updated before anything can be paid for.

Peltra would never see, receive or store your card, your billing name or your address: the charge would be handled entirely by Apple or Google using the details already in your store account, and we would take no part in it. All that would reach our server is one row with three things: which plan you have, what state it is in, and until when. Not the receipt, not the amount, not the country, not the transaction identifier.

And tapping "Manage subscription" would take us out of the app to open your browser on the App Store or Google Play page where you cancel. That page is the store's, not ours, and whatever happens there is governed by their own policy.

3.2 Services called only if you use the feature

These calls are made by your phone, only when you ask for that specific thing, and carry neither your identity nor your email:

About dictation, in detail, because it is the one place where something of yours leaves the phone without us asking for it: Peltra uses your phone's own speech recogniser. Apple resolves it on an iPhone and Google on an Android, and they decide whether it is processed on the device or on their servers. We never receive the audio, never store it and never send it anywhere. What reaches Peltra is the recognised text. If you would rather that did not happen, do not use dictation: everything else works the same.

3.3 Other people

When you share a list, whoever is in it sees what is inside and who did what, including your display name. That is not a disclosure to a third party: it is the service you asked for. You can remove someone from a list at any time.

And when you paste a Peltra link into another app —WhatsApp, Telegram, an email— that app opens the address itself to draw the message preview. What it sees is exactly what that page shows: the list's name and icon with its first three pending items, if it is an invitation; your display name, if it is your personal contact link. Nothing else, and only if you share the link.

4. Where your data is

Data is stored on Supabase infrastructure, in the eu-west-3 (Paris, France) region.

That is inside the European Economic Area, so there is no international transfer of data and no Chapter V safeguards are required.

The services in §3.2 handle what they receive under their own policies, which we do not control.

5. How long we keep things

Your phone's own backup also takes your lists, and that part is not ours to control. Peltra keeps your lists on the device itself, so the system's automatic backup — Google One on Android, iCloud on iOS — includes them, encrypted and inside your own Google or Apple account. We have no access to that copy and cannot delete it: you turn it off in your phone's settings, not here. We mention it because it is one more place your lists end up, even if it is yours. Your session is not in that backup: it lives in the system keychain and is deliberately excluded.

When you delete your account, all of the above goes immediately, with two exceptions that exist so that other people's things are not destroyed:

• Shared lists where someone else remains change owner: they are not deleted, because they belong to whoever stays too.
• What you wrote in other people's lists stays there, but without your name: authorship is cleared and the history stops identifying you.

6. Your rights

You can exercise these at any time, free of charge:

We answer within one month. If you think we got it wrong, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es) or to your own country's supervisory authority.

We make no automated decisions producing legal effects on you or similarly significantly affecting you (art. 22 GDPR). What the app "guesses" — the supermarket aisle for a product, the date inside a sentence — are writing aids you can always change, and they never leave your phone.

6 bis. If you are in the United States

This section is for people in the US, and it does not replace anything above: the rights in §6 are available to everyone, wherever you live, because we run one product and not a different one per country.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Not now and not for money, not for anything else. There is no advertising in Peltra, no ad identifier is read from your device, no advertising or analytics SDK is embedded in the app, and no data broker receives anything. So there is nothing to opt out of — but if you send a Global Privacy Control signal, we honour it anyway, and the measurement described in §2.3 can be switched off in Settings → Privacy, which also erases what was already sent from that device.

What we collect, in the categories California uses. Identifiers (your email address, your account identifier, the random device identifier used for measurement); your own content (your lists and what you write in them); commercial information (which plan you have, if there is ever a plan); internet activity (which screens open and how long things take, §2.3); and approximate geolocation, only if you turn on place suggestions in a list and grant the permission (§2.6). We do not collect precise geolocation, biometric information, or any sensitive personal information as California defines it, and we do not use anything we collect to infer characteristics about you.

Your rights, and how to use them. To know, to get a copy, to correct and to delete — they are the same ones listed in §6, at the same routes: from inside the app, or by writing to hello@peltra.app. We will never treat you differently for exercising them; Peltra is the same app and the same price, whatever you ask us. If you want an authorised agent to act for you, write from your own address once to say so.

We keep things for the periods in §5, and those are the retention periods for every category above.

7. Children

Peltra is not directed at children and they may not use it. The floor is 14 in the European Union (art. 7 of the Spanish LOPDGDD) and 13 in the United States (COPPA); we apply the stricter one everywhere, so the answer is 14 wherever you are. We do not ask for age, do not profile by age and do not knowingly collect anything from anyone below it. If we find an account belonging to someone younger, we delete it. If you are a parent or guardian and believe a child has an account, write to hello@peltra.app and we will remove it.

8. Security

Concretely:

• Access to data is decided on the server, not in the app: every row has a policy saying who may read it and who may write it, so someone who can only view a list cannot change it even by tampering with the app.
• The session is kept in the system keychain (Keychain on iOS, Keystore on Android), never in ordinary storage. Browsers have no keychain: if you use Peltra at peltra.app, the session is kept in the browser's local storage (localStorage), which is all that exists there. That is why the web only ever holds a session once you have signed in with a real account: simply opening the page creates none, and signing out deletes it. If you suspect someone has used your browser, change your password — that ends open sessions.
• All traffic is encrypted (HTTPS/TLS).
• The key that bypasses permissions is not in the app: it lives only on the server.

No system is infallible. If a breach happens that poses a risk to your rights, we will notify the supervisory authority within 72 hours and you without undue delay, as arts. 33 and 34 GDPR require.

9. Changes to this policy

If something relevant changes we will update this page and say so inside the app before the change affects you. The date at the top says when it was last touched.