What we hold, and how we hold it.

Who we are

Pepper is operated by Centa Partners (we, us, our). Pepper is designed to help households carry less mental load by helping them decide what deserves attention, what can wait, and what can safely be put down for now.

For the purposes of the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), Centa Partners is the entity responsible for the personal information described in this policy.

Website: withpepper.au
Privacy contact: hello@withpepper.au

What Pepper does

Pepper is a household judgment partner. It helps households understand what deserves attention, what can wait, and what can safely be put down.

Pepper is not designed to monitor household members, track behaviour for advertising, or maximise engagement. Pepper is designed to reduce mental load.

Information we collect

Account and sign-in information

When you use Sign in with Apple, Apple supplies an account identifier and may supply your name and email address. Apple may provide name and email only the first time you authorise Pepper. Pepper also keeps the account, user, household, authentication and session information needed to sign you in, link you to the right home and protect account recovery.

On Android, you can also use Sign in with Google. Google supplies a signed sign-in token that contains your Google account identifier and may contain your name and email address. Pepper checks the token and keeps the account identifier; it does not keep your Google email address. On Android, Sign in with Apple opens Apple's sign-in page in your browser and then returns to Pepper. You can link Apple and Google to the same Pepper account.

Household information

Information provided during onboarding and ongoing use, including:

• household members
• relationships
• ages and life stages
• household responsibilities
• communication preferences
• household priorities
• stress points
• things Pepper should pay attention to
• things Pepper should leave alone

On Android, if you add a profile photo, Pepper stores it and shows it to the members of your household. You can remove it at any time.

Subscription and entitlement information

Apple handles payment. Pepper receives and verifies signed StoreKit transaction and subscription events so it can decide whether a household is entitled to paid service. Pepper may keep the product identifier, transaction and original-transaction identifiers, purchase environment, subscription status and expiry, refund or revocation state, and the binding between one verified transaction and one household. Pepper does not receive your full payment-card details. Deleting your Pepper account does not cancel Apple billing; subscriptions are managed with Apple.

On Android, Google Play handles payment. When you subscribe or restore a purchase, Pepper sends the purchase token that Google Play gives the app to Google to verify the subscription, and asks Google again from time to time, for example after the subscription's expiry date has passed. Pepper may keep the purchase token, the product and plan, the purchase environment (including Google Play test purchases), subscription status and expiry, acknowledgement, refund or revocation state, and the binding between one verified purchase and one household. Pepper does not receive your payment-card details. A household's subscription works on iPhone and Android, whichever store it was bought from. Deleting your Pepper account does not cancel Google Play billing; subscriptions are managed in Google Play.

Device, notification and security information

Pepper may process an installation identifier, an Apple Push Notification service (APNs) device token and environment, notification-route state, device timezone, and device last-seen times so it can maintain the correct route to your Apple device. Pepper also processes request IP addresses in rate-limit buckets and records a shortened, hashed network-prefix signal, together with account or household identifiers where available, to prevent abuse, protect service capacity and control provider cost. These identifiers are not used for advertising or cross-app tracking.

On Android, Pepper delivers notifications through Firebase Cloud Messaging, a Google service. When notifications are allowed, the app registers a Firebase registration token, which Pepper keeps so it can reach your phone. The message Pepper sends through Firebase carries only content-free fields: the kind of notification, a count and a delivery reference. Your phone then fetches the details from Pepper and writes the notification itself, so no household text is sent to Google. Cloud Messaging is the only Firebase product in Pepper's Android app.

Invitation email information

If a household owner chooses to send an invitation by email, Pepper sends the recipient's email address, the inviter's display name and a single-use invitation link to Resend for delivery. The recipient does not become a household member until they open the invitation, sign in and accept it. Sharing an invitation link without using Pepper's email option does not require Pepper to collect a recipient email address.

Pepper memory

Pepper may store information that helps it become more useful over time, including household facts, preferences, recurring responsibilities, important dates, recurring stressors, boundaries, correction history, and household priorities.

Pepper keeps these kinds of information separate:

AI-generated judgments are never treated as facts.

Generated content

Pepper may store household understanding summaries, operating views, Sunday reflections, explanations, correction history, and memory updates.

Documents, notes and calendars you share

When you ask Pepper to read something, it processes what you give it so it can turn it into items on your board. This happens today and includes:

• Photos of notes or forms (for example a school note): the original image is sent to our AI provider for processing but is not written by Pepper's current extraction handler to Pepper's active database or Storage. Pepper keeps a household-scoped content hash (not the image itself), together with the structured extraction and cached result used by the product. The items Pepper reads out of it are kept on your board. Our AI provider may separately retain API inputs or outputs under its terms, contract and account controls.
• Text you forward or paste (for example an email you choose to share): processed in the same way.
• Calendars you choose on your Apple device: Pepper uses Apple's EventKit framework to access calendars available on your device. You choose which calendars Pepper may access. With your permission, Pepper can read events from selected calendars and create or update events in calendars that support editing. Selected event details are kept on your board. When you create or change an event in Pepper, the corresponding change may be written to the connected calendar. Changes made in that calendar may also be reflected in Pepper. Pepper's own household decisions about an event, such as who is responsible for it, its Scheduled Days, its preparation and whether you have handed it to Pepper, stay in Pepper and are not automatically written to the connected calendar. Changes to shared calendars may be visible to other people who have access to those calendars. Calendar synchronisation depends on device permissions, connectivity and the calendar provider. Changes may be delayed or may not synchronise successfully. Removing an event from Pepper's board does not delete it from the connected calendar. Pepper does not currently delete source-calendar events.
• Calendars you choose on your Android phone: with your permission, Pepper uses Android's calendar access to read events from the calendars on your phone that you choose. Selected event details, such as the title, times, location and calendar, are sent to Pepper and kept on your board. When you ask Pepper to add an event to a calendar, it writes the event to a calendar on your phone that you chose and that can be edited; when you change such an event in Pepper, the change may be written to that calendar. Pepper does not add attendees to calendar events and does not currently delete calendar events. The calendar account on your phone carries changes to its provider, and changes to shared calendars may be visible to other people who have access to those calendars.
• iCal / webcal links you paste: Pepper sends the link to its server and retrieves the read-only feed from the calendar provider, which may be Apple/iCloud, Google, Microsoft/Outlook or another provider. Pepper accepts an HTTPS iCal link or converts a webcal link to HTTPS before validation. It rejects unencrypted HTTP links and any redirect that does not remain on permitted HTTPS transport. The server may follow up to three redirects; every hop is resolved again, restricted to validated public network addresses and pinned before the connection is made. Pepper shows the returned events for you to choose and keeps selected event details and an opaque source fingerprint on your board. The link may remain in Pepper's local app cache on that device so it can be shown again. This is a snapshot import, not an OAuth connection or a continuing provider account link. An iCal or webcal link can act like a secret, so keep it private and revoke or replace it with the calendar provider if it is exposed.

Sensitive information. Notes, calendars and forms can contain health information, information about children, and other sensitive details. Pepper does not ask for sensitive information it does not need, and you choose what to share.

By sharing a note, photo, forwarded text or calendar event, you consent to Pepper processing the information in it, including any sensitive information, to provide the service. If what you share is about someone else in your household, including a child, you confirm you are entitled to share it.

Services you may connect in future

In future you may be able to connect additional accounts (for example an email mailbox). Pepper will only access these with your explicit permission, and we will update this policy before that begins.

What Pepper does not collect

Pepper is designed around data minimisation. We do not intentionally collect information that is not required to provide the service. Pepper is not intended to become a surveillance tool.

How we use information

We use information to:

• create and secure your account and connect it to the right household
• provide Pepper and maintain household memory
• process material you deliberately add or select
• create, update and synchronise calendar events when authorised by the user
• generate, store and explain Pepper outputs
• verify StoreKit transactions and maintain server-authoritative household entitlement
• verify Google Play purchases with Google for the same household entitlement
• send an invitation email when a household owner chooses that option
• register and deliver household notifications when notification access is allowed
• remember corrections and product decisions
• prevent abuse, apply rate limits and protect provider capacity and cost
• measure product interaction, performance and reliability, diagnose errors and provide support

We will not use your information for materially different purposes without notifying you and, where required, obtaining consent.

AI processing

Pepper uses artificial intelligence to structure material you deliberately add and to generate household summaries, explanations and suggestions. Depending on the feature, Pepper may send selected note or email text, a selected image, calendar-event details, and relevant household context or memory to its AI provider for that task.

• Pepper's application code is configured to send AI-provider requests through server-side HTTPS endpoints.
• Pepper aims to send only information needed for the task.
• AI-generated outputs are advisory, may be wrong and are not treated as facts.
• Pepper may keep generated outputs so the household can revisit them and so later Pepper outputs can use the household's own history.
• Models may identify literal date, time and money candidates and their source evidence. Pepper code validates and normalises those candidates. Date/time authority, monetary authority, subscription entitlement and notification assembly are not left to the model.

Pepper currently uses Anthropic's Claude models for AI processing. Pepper also records content-free AI operation data described in Section 14.

Pepper does not make promises on behalf of its AI provider about model training or how long that provider keeps API inputs and outputs. Those are governed by the provider’s own published terms and by our account configuration with them.

Legal basis

Pepper handles personal information only for the purposes described in this policy, with consent where required, and as otherwise permitted or required by applicable law.

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth), and we apply those principles to Pepper regardless of whether an exemption might otherwise be available to us.

Sharing and disclosure

We do not sell, rent, or trade personal information. Information may be shared only as described in this section: with household members you admit; with platform and service providers needed to operate Pepper; with user-selected calendar sources contacted for an import you request or changed at your direction through Apple's EventKit framework; and with legal, regulatory or other parties where applicable law permits or requires it.

Google, Microsoft, Apple/iCloud and other calendar hosts can be user-selected content sources, not fixed Pepper account integrations. Pepper does not currently connect to Google or Microsoft accounts through OAuth. With native Apple-device calendar access, Apple EventKit supplies the selected event data from calendars already configured on the device, and Pepper may send event changes you authorise to the connected calendar through Apple's EventKit framework; the calendar account already configured on the device then carries those changes to its provider. With an iCal or webcal import, Pepper's server converts webcal to HTTPS, accepts only permitted HTTPS transport, contacts the feed address you provide and may follow up to three separately validated HTTPS public redirects.

With Android calendar access, Android supplies the selected event data from calendars already on the phone, and events Pepper writes at your direction go to the calendar on the phone; the calendar account on the phone then carries those changes to its provider. Sign in with Google, offered on Android, is used only to sign you in; Pepper does not use it to access your Google calendars or other Google account data.

Pepper's customer-facing app serves its current web font and browser-library files from its own hosted application. Google Fonts, UNPKG and jsDelivr are not contacted by the customer-facing app to load those runtime assets.

If you share your household, the people you invite become members only after accepting the invitation. Household members can see the household's items, who is holding them, and what has been marked done.

Information may also be disclosed where required by law.

Data storage and security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Measures include:

• encrypted connections (HTTPS/TLS) between the app, Pepper’s servers and Pepper’s database, with HTTP Strict Transport Security enforced and a content security policy that restricts where the app may connect
• row-level security controls
• authenticated access controls
• server-side AI processing
• environment-variable-based secret management

Calendar changes are subject to the permissions granted through the device and the connected calendar. Pepper does not use calendar access to independently modify events without a user-authorised action.

No system can guarantee absolute security. If an incident occurs, we will assess it and comply with any notification obligations that apply.

International processing

Pepper's direct service providers and their subprocessors may process personal information outside Australia. The direct service providers are listed in Section 08.

In particular: the database and file storage holding your household’s information are operated by Supabase and are hosted in Seoul, South Korea; text and images you give Pepper to read are processed by our AI provider, Anthropic, in the United States; and invitation emails you choose to send are delivered by Resend, in the United States. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, through the terms we hold with each provider.

Data retention

Pepper keeps active account and household information while it is needed to provide the service, maintain household memory, secure the service, prevent abuse, support users and meet applicable legal obligations. Different records and providers may have different retention periods.

When operational account deletion completes, Pepper removes the applicable identity, sessions, memberships, person links, notification routes, active database records, active storage objects and supported Pepper data held on the device. For a whole-home deletion, Pepper removes the household's active product data, entitlement and transaction binding. Limited copies may remain for a time in provider-managed backups or logs outside ordinary product use and subject to provider controls. Pepper does not claim immediate physical erasure from every provider copy or an exact backup/log destruction time unless it has evidence for that claim.

Purchase records are kept after an account or household is deleted. When a household is deleted, the record of its App Store or Google Play subscription (the product, the store's transaction or purchase identifiers and tokens, dates and subscription state) stays in Pepper's database but is no longer linked to any person or household. Pepper keeps it so the same Apple or Google account can restore that subscription later, for example in a new household. Pepper does not currently delete these records, so we cannot give an end date for them.

We do not publish fixed retention periods by category. We keep personal information while it is needed for the purposes described here, and we do not claim erasure we cannot carry out.

Apple controls the Apple subscription and Apple's own transaction records. Deleting a Pepper account does not cancel Apple billing.

Google controls the Google Play subscription and Google's own purchase records. Deleting a Pepper account does not cancel Google Play billing.

Access, correction and deletion

You may request access to, correction of, export of, or deletion of your information. You can start account deletion inside Pepper from Account → Delete Pepper account, or contact hello@withpepper.au.

In a shared household, deletion depends on the person's role. Removing an ordinary member removes that person's Pepper account and links while the home can continue for its remaining members. If the last owner deletes the home after confirming the consequence, the home's active Pepper data is removed and the other members no longer have that home. If household ownership is unclear, Pepper stops rather than guessing or deleting the wrong home.

Pepper confirms active-system deletion separately from provider backup/log erasure. Account deletion does not cancel an Apple subscription; use Apple's subscription-management controls to manage or cancel billing.

Removing an event from Pepper's board does not remove it from a connected calendar. Changes made to external calendars through Pepper may remain in those calendars if a Pepper account is later deleted.

Deleting your Pepper account

You can delete your Pepper account at any time through the app. If you need help, you can also contact us by email.

Our Account Deletion page explains how to delete your account, what information is removed, what may be retained and how to manage your subscription separately.

How to delete your Pepper account: withpepper.au/delete-account

On Android, you start deletion from Account → Delete account. Before anything is deleted, Pepper on Android asks you to confirm with the same Apple or Google sign-in you use for Pepper; if your account uses Sign in with Apple, Pepper disconnects Pepper from your Apple ID first. We never delete an account because of an email alone.

In Pepper on Android, if you are the only adult in your household, your household is deleted with your account. If other adults share your household, it continues for them: items you added stay with it, unassigned, and records of reminders sent to you no longer name you.

Deleting your account does not cancel a Google Play subscription; manage or cancel it in Google Play. If you share a household and you are the person who subscribed, your subscription keeps covering the household after you delete your account, until you cancel it.

Children

Pepper may store information about household members, including children, where that information is provided by a parent, guardian, or household account holder. Pepper is not intended for children to use independently.

When a note or form is about a child, the structured items Pepper reads from it (for example "permission slip due Friday") are kept on your board under the image, cache and provider-retention boundaries described in Section 03. You can review, correct or delete these at any time.

Analytics and diagnostics

Pepper collects limited, linked product-interaction, performance and diagnostic information for app functionality, service reliability and analytics. This can include the account, household or opaque installation identifier; route, task, model and version; whether a suggestion was shown, accepted, changed, dismissed or completed; notification-delivery outcomes; token counts and estimated provider cost; latency and performance stages; cache and retry outcomes; success or failure; error codes; and provider request identifiers.

Pepper's product and AI telemetry is designed to record signals rather than household content. It does not intentionally include calendar text, note images, pasted email content, personal notes, child names or medical details. Product and diagnostic records can still be linked to an account, household or installation; they are not described as anonymous.

When you contact support from Pepper, an “Include diagnostics” option is on by default and can be turned off before the email is sent. The diagnostic block can include the app and native build, platform, environment, sign-in and household-authority state, subscription status and expiry, calendar permission and event counts, sync times, content-free performance stages and content-free entitlement checks. Calendar names and household content are kept out of that support block.

Pepper does not use this information for advertising, does not track people across other companies' apps or websites, and does not declare any tracking domains.

Pepper's Android app contains no analytics, advertising or crash-reporting library; its only Firebase product is Cloud Messaging, described in Section 03. On Android, contacting support opens your own email app and adds no diagnostic block.

Changes to this policy

We may update this Privacy Policy from time to time. Where material changes occur we will update the effective date, notify active users where appropriate, and seek consent where required.

Contact

For privacy questions, requests, corrections, deletion requests, or complaints, contact hello@withpepper.au. We will acknowledge a privacy complaint and explain the next steps.

We aim to acknowledge a privacy complaint within 7 days and to respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.