Privacy

In short

• Pebble stores what a group trip needs: who is on the trip, the schedule, rooms, chats and documents.
• Your location is only sent when you tap to share it in a chat. There is no live tracking.
• We don't sell your data, we don't show ads and we don't build profiles of you.
• This website sets no cookies and runs no analytics or tracking.
• You can delete your account in the app at any time.

Who is responsible

Pebble is run by yvan vander sanden, who is responsible (the "controller") for the personal data described here.

Email: not published yet; a contact address will be published here soon.

Pebble is used by organisers, such as a school or a youth organisation, to run their trips. The organiser decides who is invited to a trip and enters part of the trip information. If you have a question about why you are on a trip, or about what an organiser entered about you, you can also ask that organiser.

What this policy covers

This policy covers:

• Pebble, the mobile app for iOS and Android that travellers and leaders use during a trip;
• Pebble Creator, the web app at creator.pebble.world that organisers use to prepare a trip;
• this website, pebble.world.

The app's demo trip (the London trip you can open without an account) lives on your phone: nothing you do in it is sent to Pebble's database.

What we collect

Your account

You sign in with Google or with Apple. From that sign-in we get your name, your email address and your profile photo (if you have one). If you use Apple's "Hide my email", we only see the relay address Apple gives us. We also store which trip you last opened, your notification settings, and a device token so we can send you push notifications.

Your place on a trip

For each trip you are on, we store your first and last name, your photo, your role (traveller, leader or editor), your group, your room, and your choices where the schedule offers a choice of activities. Before you join, an organiser may enter your name, email address and phone number to invite you; the invitation record is removed once you join with it.

What you add yourself

• Phone number, if you enter one, and whether other travellers may see it.
• Emergency contact, if you enter one: a name and phone number of someone else. Please let that person know.
• Chat messages and photos you send in group chats and private chats, with your name and the time.
• Your location, but only when you tap to share it in a chat. Pebble then sends your current position once, as a message in that chat. The Explore tab and the schedule also read your position to show how far away places are, but that stays on your phone. You can refuse location access in your phone's settings; the rest of the app keeps working.
• A profile photo, if you upload one instead of the one from your sign-in.

What leaders and organisers add

• Notes a leader or organiser writes about a traveller. Notes can hold sensitive information, such as medical or dietary needs, if the organiser enters it. Organisers should only write down what the trip needs.
• Room checks and group checks: who was ticked off as present, and when.
• Documents they upload to the trip, such as tickets, lists or forms.
• The trip itself: schedule, activities, places, hotels and rooms.

Payments (organisers only)

Extra member slots are paid in the Creator through Stripe. You enter your card or payment details on Stripe's page, not ours; we never see your full card number. We store the payment's status and amount. To link payments to your account, our payment setup gives Stripe your email address and account id; this may happen for any account when it is created, not only when it pays.

Crash reports and usage statistics

• When the mobile app crashes or hits an error, it sends a crash report to Firebase Crashlytics: what went wrong, the device model, the operating system version, the app version and an installation id.
• When the Creator hits an error, it sends a similar report to Sentry, including your browser and its version.
• The app and the Creator include Google Analytics for Firebase. We don't log any events of our own with it. Google's standard automatic statistics (for example that the app was opened, and on which kind of device) may still be collected. We use none of it for advertising.

Who on a trip sees what

Everything on a trip stays inside that trip. People on other trips can't see it. Within a trip:

• Everyone on the trip sees your name, photo, role and group, the schedule, the rooms and who is in them, and the messages in the chats they are part of.
• Your phone number is shown to leaders and organisers. Other travellers only see it if you switch it to public.
• Notes and your emergency contact are shown to leaders and organisers only.
• Room checks, group checks and documents are for leaders and organisers.
• A shared location is visible to the people in the chat where you shared it, and only there.

Push notifications for chat messages include the sender's name and the message text, so they can appear on the lock screen of the people in that chat.

Why we use it

We use your data only to run Pebble. In the terms of the GDPR:

• To provide the service (performance of a contract): your account, your trips, the schedule, chats, rooms, checks, documents, invitations and push notifications.
• With your consent: sharing your location in a chat, push notifications (your phone asks you), and the optional phone number and emergency contact. You can withdraw it by not sharing, switching notifications off, or removing the number.
• Our legitimate interest in a working, secure app: crash reports and basic usage statistics.
• Legal obligations: keeping payment records as accounting law requires.

We don't sell personal data, don't use it for advertising, and make no automated decisions about you.

Services we use

Pebble runs on the services below. They process data for us, only to provide their service. Their own privacy policies apply to what they do.

When you tap for directions in the app, Pebble opens Google Maps with that destination. From then on, Google Maps' own privacy policy applies.

Where your data is stored

• Pebble's database (Cloud Firestore) is stored in the European Union, in Google's multi-region locationeur3 (Belgium and the Netherlands).
• Pebble's server code (Cloud Functions), which for example sends push notifications and invitation emails, runs in Google's us-central1 region in the United States. Data it handles passes through there.
• Firebase Authentication, Cloud Messaging, Crashlytics and Analytics, and Stripe, may process data in the United States. Sentry receives Creator crash reports in its EU region (Germany). Mailgun is used through its EU endpoint.

Where data leaves the European Economic Area, these providers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

This website

pebble.world sets no cookies, runs no analytics, tracking pixels or chat widgets, and loads no third-party scripts. Fonts and icons are served from the site itself. Like any web host, Firebase Hosting handles your IP address and the pages you request in order to deliver them; we add nothing on top.

The account-deletion page (/account-delete.html) lets you delete your account from the browser. It asks you to sign in with Google or Apple solely to confirm that the account is yours and delete it. Signing in there connects to Google or Apple and to Firebase Authentication.

Pebble Creator is a separate web app, covered by the rest of this policy.

How long we keep it

• Your account stays until you delete it.
• Trip data (members, schedule, chats, checks, notes) stays until an organiser deletes the trip. Trips are currently not deleted automatically when they end. Deleting a trip removes its records from the database. Photos and documents uploaded to the trip are stored separately and are currently not removed with it; ask us and we will delete them.
• An invitation is removed once it is used, or when the trip is deleted.
• Crash reports and usage statistics are kept for a limited period set in those services, and then deleted.
• Payment records are kept as long as accounting and tax law require.

Deleting your account

In the Pebble app, open the Me tab and tap Delete Account. No app any more? Use the account-deletion page.

This deletes your sign-in and your account record (email address, photo, settings, push token) straight away.

Be aware: your place on the trips you were part of is a separate record that is currently not deleted with your account. Your name, phone number, emergency contact, notes, and the messages and photos you sent stay in those trips until the trip is deleted. To have them removed now, ask the trip's organiser to remove you from the trip, or contact us.

Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you and get a copy of it;
• have wrong data corrected (you can change most of it yourself in the app);
• have your data deleted;
• have its use restricted, or object to it;
• get the data you gave us in a machine-readable format;
• withdraw consent you gave, at any time.

To use these rights, email us: not published yet; a contact address will be published here soon. We answer within one month. If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or to the authority in the country where you live.

Children and school trips

Pebble is made for school and youth trips, so many travellers are under 16. Children don't sign up for a trip on their own: an organiser invites them.

• The organiser (the school or youth organisation) is responsible for telling travellers and their parents or guardians that the trip uses Pebble, and for getting permission where that is needed before inviting a child.
• Travellers under 16 should only use Pebble with permission from a parent or guardian, or as arranged by their school.
• We don't use children's data for anything other than running the trip, and never for advertising.
• Parents and guardians can ask us to see, correct or delete their child's data: not published yet; a contact address will be published here soon.

Security

All traffic between the apps and our servers is encrypted. Database rules limit trip data to the members of that trip. Sign-in is handled by Google or Apple; we never see or store a password. No system is perfectly secure, but if something goes wrong that affects your data, we will tell you and the authorities as the law requires.

Changes to this policy

When Pebble changes how it handles data, we update this page and the "last updated" date at the top. The version on this page is the one that applies.

Contact

Questions about this policy or your data? Contact yvan vander sanden.

Email: not published yet; a contact address will be published here soon.