Privacy Policy

What Peko stores, how long it keeps it, and who else sees it.

Who we are

Peko UI Technologies LLC runs Peko. Write to contact@pekoui.com about anything on this page, including a request to see, correct, export, or delete what we hold about you.

What we store

Three things, and they are kept apart.

• Your account: the email address and name your sign in provider gives us, and the identifier it assigns you. We never receive your password. Google, GitHub, and Firebase hold that.
• Your organisation and its API keys. A key is stored as a hash and a few leading characters. We cannot show you a key again after it is issued, because we do not have it.
• A record of each request: which endpoint, which tier, which platform, how many files, how many findings by severity, the status code, and how long it took.

The request record holds no file names, no file contents, and no finding text. What your code contains does not enter it.

Your code

The free checks run on your own machine. Nothing about your project reaches us unless you ask for an audit or upload an archive.

An archive you upload is encrypted with AES-256-GCM before it is written down, using a key held outside the database. It is deleted when the audit that needed it finishes, and after 24 hours whatever happens. Nothing extends that.

A finished report is held for 60 minutes so you can collect it, and then deleted.

The audit tier and the model

The audit tier sends the parts of your source that a rule applies to, along with the policy text, to Anthropic, which returns the reading. This is the one place your code leaves our systems, and it happens only for an audit you started and confirmed.

The free lint tier calls no model and sends nothing anywhere.

A rejection letter

When you run `peko diagnose` or paste a rejection into the site, that letter reaches our server. It names your app and it was written about you, so it is worth saying plainly what happens to it.

It is read for the guideline numbers it cites, the matching rules are sent back, and the text is thrown away. It is not written to any table, it is not written to any log, and no model reads it. Nothing about it survives the request.

That is different from `peko outcome`, where you choose to tell us what a store decided and we keep it. That one we do store, and the privacy policy says so above.

What we measure

We record how the product is used, so a rule that never fires or always misfires can be found. This is the part you can switch off, and the switch is on the account page.

• From an audit: which rules ran, what each decided, how long it took, and what it cost us. A rule id and a number, never the code the rule read and never the text of a finding.
• From the command line: the command, how long it took, how it ended, the version, the operating system, and the shape of the project. Never your source, never a file path, and never your app's identity.
• From this site: the page, the site that sent you here, the campaign parameters in the link, how far down a page you read, where on the page you clicked, and how quickly the page loaded for you.
• Errors, so a page that breaks for you is one we can find. The message and the file, never a stack trace, because a stack can carry values from the code it walked.

A click is stored as a fraction of the page rather than a pixel, and what was clicked is recorded as a kind of control, never its text. We do not record your screen, your typing, or the contents of any field.

Counting a visit to this site needs nothing kept on your machine, so we do it without asking first. It carries the page, the site that sent you, the country the network already told us, and how the page performed. It sets no cookie and writes nothing to your browser's storage. The one thing we leave out is the identifier that would join one visit of yours to the next, which means we can see that a page was read and not that you read it twice.

Agreeing changes two things. Google Analytics loads, and we start sending an identifier your browser keeps, so a return visit joins up with the one before it. Declining stops all of it, the counting included, and so does Do Not Track or Global Privacy Control.

Turning it off on the account page covers the whole account, including runs from a copy of the command line tool that has not been updated. On one machine, set PEKO_TELEMETRY=off or add "telemetry": false to .pekorc.json. We also honour Do Not Track and Global Privacy Control in the browser.

The guided setup at /start works differently, and on purpose. The page gives you a code, that code is printed in the command you paste, and the command tells the page how the run went: which step it reached, the platform, the version of the tool, and how many findings there were at each severity. Counts and nothing else. No file name, no path, no project name, and no source. It is how the page knows to move on while you are still looking at your terminal.

That report is not the measurement described above and is not covered by the switch for it, because it is not us watching you: it only happens when you run a command carrying a code you pasted yourself, and it only reports to that code. The code stops working after a day and the record goes with it. If you would rather it did not happen at all, every command the setup gives you is listed at /install without one, and the tool works exactly the same.

Three things in that setup are worth naming separately. The installer reports that it finished, and only that, and only when the command you pasted carried a code. The sample apps it checks are ours and ship in a public repository, so what it found in them is sent in full and shown on the page: rule, severity, file, line, and the suggested fix. A run against your own project sends counts and nothing else, because a rule id paired with one of your file names is a description of your code, and we were not given that.

The setup also audits one of those sample apps without you making an account, using a key it fetches for itself. That key belongs to an account of ours rather than one of yours, it stops working after two hours, and it can only run against that sample app: anything else costs money, and it cannot spend any. No account is created for you, and nothing about you is attached to it.

One thing is not covered by that switch: when you tell us what an app store decided about your app, through `peko outcome` or the form. That is you choosing to tell us something, not us watching you, and it is the only record we hold that says whether our rules are right. Ask and we delete it.

When you delete your account, everything that names you goes with it, including what you told us about a store decision. Two things stay, with the link to you removed: which rules ran and what they cost. Those rows hold a rule id, a duration, and a number. They say nothing about you, your app, or your code, and keeping them is what stops a rule that never fires going unnoticed. Clicks and scroll depth are never linked to an account in the first place, so there is nothing there to unlink.

How long we keep things

A scheduled job enforces every line of this. It is not a promise about what somebody remembers to do.

Who else processes your data

We do not sell your data, and we do not share it for advertising.

Analytics

This site uses Google Analytics, and it loads only after you agree. Decline and no analytics script runs and no analytics cookie is set. Our own counting is separate, sets no cookie, and is described under what we measure. Your choice is kept in your own browser, and you can change it by clearing this site's storage.

Analytics never sees your code, your findings, or your API keys, and it is not joined to your Peko account.

Your rights

Write to contact@pekoui.com to see what we hold, correct it, export it, or have it deleted. We answer within 30 days. If you are in the EU, the UK, or California, the rights your law gives you apply here whether or not this page repeats them.

Peko staff can also see and, where the service genuinely needs it, change an account directly: correcting an address that bounces, answering a support request, or acting on abuse. This reaches the same things you can already see and do from your own account page, nothing further, and every use of it is recorded.

We operate from San Diego, California, United States, and the data described here is processed in the United States. Using Peko from outside the United States means your data is handled there.

We do not sell or share personal information as the California Consumer Privacy Act uses those words, so there is nothing here to opt out of.

Children

Peko is a tool for people who ship software commercially. It is not for anyone under 16, and we do not knowingly hold data about anyone under 16.

Changes

When this page changes in substance we ask you to accept it again before you continue using your account. The date at the top is the version you accepted.