Privacy Policy

Last updated: November 13, 2026

Who we are

Pebi Studios is a one-person independent studio in Ontario, Canada. It makes the Pebi Content Planner, and it decides how the personal information described here is used. The owner of Pebi Studios is the person responsible for privacy. Questions, requests, and complaints go to [email protected].

This policy covers pebistudios.com: the site and the planner. It also covers what we still hold from Pebi Labs, which is closed for now.

What we collect, and why

• Account details. You need an account to use the planner. Our sign-in provider, Clerk, keeps your email address, your name if you give one, and your password in hashed form. We never receive your password. If you choose "Continue with Google" instead, Google passes Clerk your name, email address, and profile picture. Clerk also records sign-in activity, such as the time, browser, device, and IP address of a session, to keep accounts secure. We keep a copy of your email address and an account ID in our own database, so we can connect your license and workspaces to you. We use your email address to run your account and, rarely, to contact you about your purchase or the service.
• Purchases and licenses. Any purchase is handled by Lemon Squeezy, which acts as the merchant of record. It takes your payment and card details, and we do not receive your card number. When you enter a license key in the planner, we send that key to Lemon Squeezy to check it. Lemon Squeezy tells us whether the key is valid, which product it is for, and the email address it was issued to. We keep the key and its status with your account so the planner stays unlocked.
• Team workspace content. If you use a Team workspace, the content you put in it syncs through our servers (hosted on Cloudflare) so your teammates can see it in real time. That's the entire reason we store it. Inside the planner, only the members of that workspace can open it. It travels over an encrypted connection and Cloudflare encrypts what it stores, but it is not end-to-end encrypted, so as the people who run the service we are technically able to access it. We would only do that to fix a problem you ask us to look into, or if the law requires it.
• What your teammates see. Members of a Team workspace can see each other's name and email address, and can see who else has the workspace open. If you type someone's email address when you invite them, we keep it with the invitation. A copy of each Team workspace you open is also kept in your browser, so it opens quickly and survives a dropped connection.
• Attached files. Files you attach to a drop are kept in your browser on your device. The planner does not upload them, in Solo or in Team. In a Team workspace your teammates may see an attachment's name, but not the file itself.
• Newsletter. If you subscribe on the home page, we keep your email address, which page you signed up on, and the date, in our own database. We use these addresses only to send the newsletter. To stop, use the unsubscribe link in any issue or email us, and we will take you off the list.
• Emails you send us. If you write to us, your message and email address sit in our Gmail inbox so we can answer you.
• Error reports. If something breaks, the planner may offer a "Copy details" report. It is technical information: the error message and where in the code it happened, the time, your browser, which view you were in, and how many drops you have. It is not built to include what is in your drops, you can read it before you send it, and it goes nowhere unless you choose to email it to us.
• Visits to the site. Cloudflare hosts this site. Like any web host, it receives your IP address and basic browser details whenever your browser asks for a page, and it uses them to deliver the site and protect it from attacks. Cloudflare also counts visits and measures how fast pages load. For that it notes the page, the site you came from, your country, and your browser and device type. Cloudflare says it does this without cookies and without building a profile of you. It also runs a check that tells people from bots, which sets a cookie in your browser. We add no analytics of our own.
• Code from another service. When you open a Team workspace, the planner loads its sync code from esm.sh. That service sees your IP address when your browser fetches the file.

Pebi Labs

Pebi Labs is closed for now. The Labs page, Sakura Ink, and Quest Tracker are not on the site while it is closed. This is what is left from when they were open:

• Sakura Ink. The app ran in your browser. Your stories, your settings, and your OpenRouter key were saved in your browser on your device and were not sent to our servers, so we do not have them. Closing Labs did not remove them from your browser. When you asked for a reply, your browser sent your key and the text needed for that reply straight to OpenRouter, which passed the text to the AI model you picked. What OpenRouter and that model's provider do with it is covered by their terms and by your OpenRouter settings, not by this policy.
• Quest Tracker. It worked without an account, and then your quests were saved only in your browser on your device. Closing Labs did not remove them from your browser. If you signed in with your Pebi account, a copy of your save was stored on our servers, and we still keep it with your account. Email us if you want it deleted.
• Newsletter sign-ups. If you subscribed on the Labs page, we keep your email address, the page you signed up on, and the date, in our own database. If you subscribed on the Sakura Ink page, your email address went to Kit, the mailing-list service that form used, and it is kept there. Both are kept until you unsubscribe.
• Fonts and code. While they were open, the Labs pages loaded their fonts from Google Fonts, and Sakura Ink loaded part of its interface code from unpkg. Each of those services saw your IP address when your browser fetched a file.

What we don't collect or do

• Your Solo planner content. In Solo, your drops, captions, hashtags, and attached files are kept in your browser and on your computer. The planner does not send them to us.
• Ads and selling data. We don't show ads, we don't use ad networks or tracking pixels, and we don't sell or rent personal information.
• Watching what you do. We don't use analytics or session-recording tools inside the planner.

Cookies and browser storage

• Sign-in (Clerk). Clerk sets cookies (__session, __client, __client_uat) and a little browser storage to sign you in and keep you signed in. They are set on the pages that include sign-in, which are the home page and the planner, and some of them are set before you sign in.
• Security (Cloudflare). Cloudflare's bot check sets a cookie (cf_clearance) that can last up to a year. Cloudflare also sets short-lived security cookies (__cf_bm, _cfuvid) on the sign-in service's address.
• Your own work. The planner saves your work and your settings in your browser's storage on your device.

Pebi Studios sets no cookies of its own, and nothing listed here is used for advertising.

Who else is involved

These companies handle information for us, or receive it because of how the site is built. We give each only what it needs for its job. What they collect themselves is covered by their own privacy policies, linked here.

• Clerk (sign-in and accounts)
• Cloudflare (hosting, the database that holds accounts and Team workspaces, visit counts, and bot protection)
• Lemon Squeezy (checkout and payments, as merchant of record)
• Google (our Gmail inbox, and Google sign-in if you choose it)
• Kit (keeps the newsletter sign-ups made on the Sakura Ink page while it was open)
• esm.sh (delivers a code file, as described above)

Where your information is kept

Pebi Studios is in Canada, but the companies above store and process information on servers in other countries, mainly the United States. While it is there, it is subject to the laws of that country, and its courts and authorities may be able to access it.

Keeping and deleting data

• Account and license records are kept for as long as you have an account.
• Team workspaces are kept until their owner deletes them or asks us to.
• Newsletter addresses are kept until you unsubscribe.
• Emails are kept for as long as we need them to help you, and deleted on request.
• Purchase records are held by Lemon Squeezy for as long as tax law requires.

Want your account deleted? Email [email protected] from your account address. Within 30 days we will delete your account, your license records, and the workspaces you own. Things you added to someone else's Team workspace stay with that workspace. Deleted data can remain in our provider's database backups for up to 30 days more before it is gone for good. Solo content is already in your hands: it is kept on your device, and clearing it there removes it.

Your choices and rights

Wherever you live, you can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. You can also withdraw your consent, for example by unsubscribing or by closing your account, though the planner can't run an account or sync a Team workspace without the information described above. Email [email protected] from your account address. It costs nothing, and we will answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.

Where the law fits

Canada's federal privacy law (PIPEDA) applies to Pebi Studios. If you are in the EU or the UK, these are our reasons under the law there for using your information: we use account, license, and workspace information because we need it to provide the service you asked for; we send the newsletter because you agreed to it; and we rely on our legitimate interest in keeping the site secure and knowing roughly how many people visit it. For payment data, Lemon Squeezy is responsible and handles requests about it.

Children

Pebi Studios tools are not aimed at children under 13, and you need to be at least 13 to have an account. If you believe a child has given us personal information, email us and we will delete it.

Security

Connections to the site are encrypted, Cloudflare encrypts the database it stores for us, and on our side only the owner of Pebi Studios can access that database. No system is perfectly secure, so we can't promise that nothing will ever go wrong. If a breach of our systems puts you at real risk of harm, we will tell you and report it as the law requires.

Changes

If this policy changes in a way that matters, we'll say so in the planner's "What's new" notes and update the date at the top of this page.