Privacy Policy

The short version

• Your tasks, steps, repeats and thoughts stay on your iPhone. They are not sent to our server.
• Your brain dump (voice or text) leaves your iPhone only after you agree. It goes through our server to Cloudflare, which turns voice into text, and to OpenAI, which sorts it into your plan. If you have projects, their names go to OpenAI with it, so tasks land in the right project. Our server doesn't keep it, and it's never used for ads.
• Pero has no names, emails or passwords. It uses a random account ID for your free daily dump and your subscription. Apple takes the payment; RevenueCat keeps track of the subscription.
• Usage stats and crash reports go to Google Firebase, linked to the random ID. Pero doesn't track you. You can turn this off in Settings → Share usage stats.
• You can delete everything in Settings → Delete all data. This doesn't cancel your App Store subscription.

Who we are

Pero is made and run by Oleh Chausov, an individual developer in Kharkiv, Ukraine. In this policy, "we" and "us" mean Oleh Chausov.

Oleh Chausov is responsible for personal information in Pero. For Quebec, he is the person in charge of the protection of personal information.

Email for privacy questions and support: support@peroday.app

This policy covers the Pero app for iPhone and this website. The website has no analytics and no cookies.

What we collect and why

Pero has no sign-up. In the background, it creates an anonymous account with a random ID. That ID is the only ID we have for you: it is not your name, email, phone number or Apple Account.

This table lists everything that leaves your iPhone, or that our server receives about you.

What stays on your iPhone

These are never sent to our server or to anyone else:

• your tasks, steps, repeats, task details and thoughts, including done tasks and past days, the order you put your tasks in, and which task a thought is about;
• your projects and which project a task is in. Only the names of your projects leave your iPhone, with a brain dump, as the table above says;
• your focus sessions (the timer on the "Now" task);
• your settings, morning plan time, your AI consent and the state of the rating prompt;
• your reminders, your morning notification and the focus timer's "Time's up" notification. They are local notifications: iOS sets and shows them on your iPhone, without our server and without Apple's push service.

Your onboarding answers are also kept on your iPhone. While Share usage stats is on, their codes are sent to Google Firebase, as described above.

A dump that couldn't be sent (for example, while you were offline) waits on your iPhone until you send it again or tap "Discard".

There is no copy of your tasks on our server. If you delete Pero, we can't bring them back. If you back up your iPhone to iCloud or a computer, iOS includes Pero's data in that backup — that is how iOS works by default.

AI processing

Pero uses AI to turn your brain dump into a plan.

What is sent. Your voice recording or typed text, with the date, time and time zone of the dump, today's date and your language and region setting. If you have projects, their names (the 200 newest at most) go with every dump, so the AI can put a task into the project you named. Pero only listens while you are recording.

When. Only after you tap "Continue" on the "How Pero sorts your dump" screen. Until then, nothing goes to the AI, and you can still add tasks by hand.

Who receives it:

• Our server (run on Cloudflare Workers) receives your dump with your account token and the dump ID.
• Cloudflare Workers AI turns your voice into text, using the Whisper large v3 turbo model. It receives only the audio.
• OpenAI sorts the text into tasks, steps, thoughts, dates, times and projects, using the GPT-6 Luna model. It receives the text with the date, time, time zone and language setting, and the names of your projects, through Cloudflare's AI Gateway.

Our server sends your dump to Cloudflare and OpenAI without your account token, account ID or your iPhone's IP address. So their copies are not linked to you — but what you say, or the name of a project, can still name you or other people.

How long it is kept. Our server keeps your dump, and the project names sent with it, only while the dump is being processed. It doesn't save it in its database, storage or logs, and the AI Gateway is told not to log the request. Cloudflare stores Workers AI content only if a storage service is connected to the request — we don't connect one. Cloudflare doesn't publish how long it keeps request logs. OpenAI keeps API data for abuse monitoring for up to 30 days. Because these copies are not linked to you, we can't delete them for you. On your iPhone, the text Pero heard and the sorting notes are kept only while the result card is open.

Training and ads. Cloudflare says it doesn't use this content to train the AI models on Workers AI or to improve any Cloudflare or third-party services. OpenAI says data sent to its API is not used to train or improve its models. Your dumps are never used for ads.

The AI only sorts your own words into your plan. It doesn't make decisions about you.

How to turn it off. Go to Settings → AI processing (this row is there only after you have agreed). After you turn it off, nothing more is sent. A dump that was already sent still finishes. Your next dump will ask for your permission again.

Analytics and crash reports

Pero uses Google Firebase Analytics to understand how the app is used and to improve it, and Google Firebase Crashlytics to find and fix crashes. From your first launch, Pero sends app usage events and your onboarding answers (as answer codes, never free text) linked to a random account ID — not your name or email; our server adds subscription events (trial converted, renewed, cancelled, refunded) under the same ID. Crash reports carry device and app details, never your account ID or what you record. None of this is shared with advertisers or used for tracking.

When you start a trial or subscribe, Pero only gives Apple's ad attribution (AdAttributionKit) a conversion code; Apple may report it to the ad network that showed you an ad for Pero, without any user or device identifier. Apple and the ad network don't publish how long they keep this report; because it carries no identifier, it can't be linked to you or deleted for you.

You can turn all of this off at any time in Settings → Share usage stats: the app stops sending usage events and crash reports and deletes unsent ones from your device; our server stops adding subscription events once your iPhone is next online; a conversion code already given to Apple stays, and Apple may still report it. Usage data already sent is kept for up to 14 months and crash reports for 90 days; Delete all data removes usage data from Google Analytics reports within 24 hours and from Google's servers within the next 63 days.

More detail

Before sign-in. Until the anonymous sign-in finishes, usage events are linked only to the analytics app instance ID of this install.

What Google collects on its own. The Firebase Analytics SDK also sends some automatic events (for example, the first time you open the app) and uses device identifiers — the app instance ID and Apple's identifier for vendors (IDFV). Google doesn't publish a full list of what the SDK collects. To be safe, we treat it as also collecting other usage data and an approximate location, and we list these in Apple's privacy labels.

What a crash report contains: the stack trace, function names, the type and text of the error, the crash time, device model, processor, memory and disk, iOS and app versions, whether the device is jailbroken, and whether the app was in the foreground or background; install IDs (the Crashlytics installation UUID, the Firebase installation ID and a session ID); and the usage events from just before the crash with their details, including onboarding answer codes ("breadcrumbs"). Pero doesn't add your account ID or its own notes to crash reports, and the words of your dumps and the names of your tasks, projects and thoughts never go into them.

The ad conversion code is one number: 0 when you install Pero, 1 when you start a trial, 2 when you pay without a trial (or a rough low, medium or high). Apple's report to the ad network (for example, TikTok or Meta) comes 24–48 hours later. It contains the conversion type, the app's ID, the IDs of the ad source and where the ad was shown, whether you clicked or viewed the ad, and the code. Pero sends nothing to ad networks itself.

No tracking. Pero doesn't ask to track you (there is no App Tracking Transparency prompt) and doesn't collect your advertising identifier (IDFA). There are no ad network SDKs in Pero, and usage events never go to ad networks. In our Google Analytics, Google signals, ad personalization and data sharing with Google are off, and it isn't linked to Google Ads.

What the switch does.

• Off: new events and onboarding answers are not recorded or sent. Unsent events and unsent crash reports are deleted from your iPhone. The analytics app instance ID is reset, and our server erases its copy the next time your iPhone is online, so no more subscription events are sent after that. New ad conversion codes are not set; a code already given to Apple stays, and Apple may still report it. What was already sent stays until the end of its retention period, or until you use Delete all data.
• On again: sending starts from that moment. Nothing from the time it was off is recorded. Your current onboarding answers are sent again.
• After a reinstall or Delete all data, the switch is on again, and the notice on the welcome screen is shown again.

The switch doesn't affect brain dumps, purchases, the free limit or request checks: Pero can't work without them, and they are not analytics.

Purchases

Apple takes the payment for Pero Pro. We never see your card or payment details.

RevenueCat manages subscriptions for us. It receives the purchase data listed in the table above, under your random account ID. Pero doesn't turn on RevenueCat's collection of device identifiers (your advertising identifier, IDFV and IP address). Under its data processing agreement with us, RevenueCat uses this data only to provide its services to us, including improving them and preventing fraud, and doesn't sell it, share it or mix it with other data.

Our server keeps a copy of your subscription status, so that subscribers never hit the free limit.

When you tap Restore purchases on a new iPhone, or when a new account starts while your subscription is active, RevenueCat moves your purchases to that account.

Service providers

These providers handle your data only for the purposes in this policy, under their own terms with us. They protect it at least as well as this policy says. In particular:

• RevenueCat uses purchase data only to provide its services to us and doesn't sell it;
• Cloudflare and OpenAI don't use your dumps to train AI models;
• Google Analytics data is not shared with Google's advertising products: Google signals, ad personalization and data sharing are off;
• Cloudflare Workers AI, OpenAI and Firebase App Check receive no account ID.

International transfers

Pero is run from Ukraine. Your data is processed outside the country, province or state where you live — for example, outside Canada and Quebec. Cloudflare doesn't publish where Workers AI runs, and OpenAI doesn't publish where it processes API requests. For Google, RevenueCat and Apple, see their privacy policies above.

In another country, your data may be accessed by the courts, law enforcement and national security authorities of that country.

How long we keep it

Our server's database (Cloudflare D1) has a built-in restore feature, Time Travel, which can bring back deleted rows for up to 30 days. It can't be turned off. Rows with your data are not copied into any other backups.

Delete your data

You can delete your Pero account and all your data in the app. You don't need to email us.

1. Open Pero and tap Settings at the top of your plan.
2. Tap Delete all data.
3. Pero asks "Delete all your data?". Tap Delete all data again. (To stop payments first, tap Manage subscription.)
4. Wait for "Your data is deleted", then tap Start fresh.

You need an internet connection. If you see "You're offline" or "Couldn't delete your data", nothing was deleted: tap Try again, or Back to Settings to keep your data. If you see "Deletion not confirmed yet", our server may already have your request: tap Try again, or Pero will try again the next time you open it. Nothing on your iPhone is erased until our server confirms the request.

What is deleted, and when

• On your iPhone, right after our server confirms: your tasks, steps, repeats, thoughts, projects, a dump waiting to be sent, onboarding answers, settings, AI consent, the cached subscription status, unsent usage events, scheduled reminders and the morning notification, Pero notifications in Notification Center, and the rest of Pero's data on this iPhone (except the free-trial reminder, see below). The analytics ID is reset, and Pero starts like a new install with a new anonymous account.
• On our server, at once: your subscription status, free-limit records and daily AI dump count. Time Travel can still restore them for up to 30 days. A record of the deletion keeps your IDs until every part is done, then only a scrambled ID and dates, for 30 days.
• Google (Firebase Authentication): our server deletes your account. Google erases it from its systems and backups within 180 days.
• RevenueCat: our server asks RevenueCat to delete you as a customer. RevenueCat doesn't publish when this is complete; its dashboard may show the data for a few more hours.
• Google (Firebase Analytics): our server asks Google to delete your data by your account ID and by every analytics app instance ID of this install — so events from before the sign-in are deleted too. Google removes it from reports within 24 hours and from its servers within the next 63 days. Reports that are already summed up, with no IDs in them, are not deleted. Google accepts a limited number of deletions per day, so a deletion may finish the next day.

What Delete all data doesn't remove

• Your App Store subscription. Deleting your data doesn't cancel it, and Apple keeps charging until you cancel (see the Terms of Use). Apple keeps your purchase history. If your subscription is active, the new account gets Pro back when Pero checks your Apple Account's purchases, and RevenueCat creates a customer under the new ID.
• The free-trial reminder, if you are in a trial. Your subscription isn't cancelled, so the charge will still happen. The reminder has no personal data in it.
• Notification permission. iOS keeps it until you delete Pero.
• Copies with no link to you: dumps, with the project names sent with them, at OpenAI (up to 30 days) and Cloudflare (period not published), crash reports (90 days), server logs (7 days), ad conversion reports, request-check data and request counters. They carry no account ID, so we can't find or delete them for you.

If you delete Pero without using Delete all data

Deleting Pero erases everything on your iPhone except the sign-in in the Keychain. Your account at Google, your RevenueCat customer and your subscription status on our server stay. If you reinstall Pero and it reconnects to the same account, Delete all data will delete them. If not, they are deleted automatically 14 months after your last use (or the end of your subscription, whichever is later). Usage data already sent to Google Analytics stays until the end of its 14-month period.

Turning off Share usage stats doesn't delete what was already sent. Delete all data does.

If you have a question about deleting your data, email support@peroday.app. Pero doesn't know your name or email, so we can't look up your data by them.

Your rights

Everywhere. You can see and change your tasks, projects, thoughts and settings in the app. You can withdraw your consent at any time in Settings: AI processing stops sending your dumps to the AI (you can still add tasks by hand), and Share usage stats stops analytics, crash reports and ad conversion codes without changing anything else in the app. You can delete all your data with Delete all data. You can email us with any question about your data.

Please note: Pero doesn't know your name or email, and the app doesn't show your account ID. So we can only find data on our server or at our providers if you can show us which account is yours. Almost all of your data is on your iPhone, where you control it.

United States. Pero doesn't track you across other companies' apps or websites, so there is nothing for a "Do Not Track" signal to turn off. We don't let other companies collect data about you across apps and websites through Pero.

Canada, including Quebec. You can ask us what personal information we hold about you, ask us to correct it, and withdraw your consent, by emailing support@peroday.app. Oleh Chausov, the person in charge of the protection of personal information, handles these requests. Your information leaves Quebec and Canada (see "International transfers"). If you are not happy with our answer, you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec.

Australia. You can ask us for access to, or correction of, your personal information, and complain about how we handle it, by emailing support@peroday.app. If you are not happy with our answer, you can contact the Office of the Australian Information Commissioner.

Children

Pero is not for children under 13. You must be 13 or older to use it (see the Terms of Use). We don't knowingly collect data from children under 13, and Pero doesn't check age.

If you are a parent and think your child under 13 uses Pero, open Pero on their iPhone and tap Settings → Delete all data. This deletes their data on the iPhone and on our server, and asks our providers to delete it too. If you need help, email us. If we learn that we hold data from a child under 13, we will delete what we can find.

Security

We take appropriate steps to protect your data. For example:

• Pero has no passwords, emails or names that could leak.
• Our server doesn't keep your dumps.
• Every request to our server must carry an App Check token that shows it comes from the real Pero app.
• Our server logs don't contain IP addresses, tokens or what you record.
• Rows with your data are not copied into backups.

If data from Pero is ever compromised, we will tell the people affected as the law requires.

Changes to this policy

When we change this policy, we will post the new version on this page and change the "Last updated" date. The current version is always at https://peroday.app/privacy. If Pero is going to use your data for a new purpose, or send it to a new company, the app will ask for your permission first.

Contact

Oleh Chausov, Kharkiv, Ukraine
Email: support@peroday.app