Privacy Policy

If you create or manage a Pebble, Pebbles collects the email address used for your account. If you sign in with Google, Google and Supabase process the information needed to authenticate you.

Organizers may restrict a Pebble to a list of approved email addresses. Pebbles stores those addresses to decide whether a signed-in person may open that Pebble. It does not connect an approved email address to the anonymous alias shown in the discussion.

When you participate, Pebbles stores an internal account or session identifier, your membership in that Pebble, a generated alias, and when you joined. It also stores the content and activity you choose to create, including prompts, submissions, comments, replies, votes, comment reactions, timestamps, and moderation status.

Discussion pages use temporary Supabase Realtime presence data to count active viewers. Pebbles does not display viewer identities, and presence is not stored as discussion history.

Pebbles uses browser storage to maintain sessions and remember temporary product state, such as drafts and reading position. The application does not currently set its own analytics cookies.

Pebbles does not store IP addresses or device identifiers in its primary application database. Infrastructure and authentication providers may process routine technical information, including IP addresses, browser information, and request data, when delivering and securing their services.

Information is used to authenticate organizers, keep participants in the correct Pebbles, generate stable aliases, save contributions, show voting and discussion activity, support moderation, and operate and secure the service.

Pebbles does not currently use advertising or third-party analytics, and it does not sell personal information.

Participant-facing pages use a generated adjective-and-animal alias, such as “Curious Otter.” Other participants are not shown your real name, email address, or Google account.

This is pseudonymous participation, not complete anonymity. Your alias and activity are connected internally to an account or session identifier. Pebbles’ service operator may access internal identifiers when necessary to operate, secure, or troubleshoot the service. Organizers can see participant aliases, contributions, and moderation information available through the product. Technical service providers may also process connection information.

Avoid sharing identifying, confidential, or sensitive information in submissions or discussions if you do not want other people with access to the Pebble to see it.

Organizers can make a Pebble available to anyone with its link or restrict it to approved email addresses. For link-accessible Pebbles, anyone who receives a valid link may be able to join. Links can be forwarded, so treat public links as invitations rather than private passwords. Restricted Pebbles require sign-in with an approved, verified email address.

Temporary Discussions accept contributions only until their scheduled closing time. Existing participants may review them for 24 hours after closing, then participant access ends. The organizer retains access to the archived Discussion.

Organizers can see submissions, discussion content, voting results, participant aliases, and moderation information for Pebbles they created. Organizers can moderate content, and may continue to view content they have hidden.

Organizers can see and edit the approved email list for a restricted Pebble. Pebbles does not show organizers which participant alias, contribution, vote, or reaction belongs to an approved email address.

Pebbles currently relies on:

• Supabase for the database, authentication, anonymous accounts, realtime updates, and email-code sign-in.
• Google when you choose Google sign-in.
• Vercel to host and deliver the web application.
• The email provider configured through Supabase to deliver sign-in codes.

These providers process information under their own terms and privacy practices. Pebbles does not currently include a separate advertising, product-analytics, or error-monitoring service.

Pebbles does not currently apply an automatic deletion schedule. Information remains stored until content, a Pebble, or an account is deleted, or until it is removed in response to a valid deletion request.

Participants can delete supported submissions, comments, and replies they authored. Organizers can moderate content and delete Pebbles they created. Deleting an account may also delete Pebbles and content associated with that account. Some content may remain after an account is deleted when necessary to preserve the context of a discussion, but it may no longer be associated with the deleted account.

Provider logs or backups may remain according to the service provider’s own retention practices. To request deletion or ask about your data, email pebblesdev@proton.me.

Pebbles uses authentication and database access controls to limit access, but it is an early beta and no online service can guarantee perfect security. A person with a valid Pebble link may be able to join while the Pebble is open, and participants can copy or share content they can see. Temporary participant access does not mean that screenshots, copies, or previously viewed content can be technically retracted.

Do not use Pebbles for passwords, financial information, health records, government identifiers, or other highly sensitive information.

Pebbles is intended only for people who are at least 18 years old. Do not use Pebbles if you are under 18.

This policy may change as the beta evolves. The updated version will be posted on this page with a new “Last updated” date.

Questions, privacy concerns, and deletion requests can be sent to pebblesdev@proton.me.