Privacy policy

In short

We cannot see what you write: every chat is end-to-end encrypted.
We do not ask for your phone number. No ads, and we never sell your data.
We keep only the little Pebl needs to work, and delete it on a schedule.
You can download your data or delete your account at any time.

This policy explains what information we process when you use the Pebl app and pebl.im, why, and what you can do about it. It is written for everyone, including people in the European Union and the UK, whose rights under the GDPR are set out below. The Turkish version (pebl.im/privacy) and the KVKK notice (pebl.im/kvkk) apply in Türkiye.

01Who is responsible

Pebl is made by independent developers; there is no company behind it. The controller of your personal data is Pebl. For anything about your data, write to kvkk@pebl.im (in English or Turkish).

02What we process

To run Pebl we process:

AccountYour email address, username and display name; if you choose, a profile photo and avatar colour.

Sessions and devicesThe kind of device and app version you sign in with, session times, and the public encryption keys each device creates.

Notification tokenThe token your phone’s system gives us so we can wake it for new messages.

Contacts and groupsFriend requests, people you saved and the nicknames you gave them, people you blocked, group memberships and roles.

Message metadataWho wrote to which chat and when; courier and disappearing-message timers; the size of an encrypted file. Never the content.

Call historyWho called whom, when, and for how long. Calls are not recorded.

CallsVoice and video calls always go through our relay, so our server sees your IP address while the call lasts; the other person never does. Audio and video pass through encrypted and are not stored.

Approximate location (optional)Only if you turn it on, to time couriers: rounded to 5 km, shown to nobody, deleted when you turn it off.

Crash reports (can be turned off)If the app crashes: the error, where in the code it happened, the app version and the phone model.

ReportsIf you report someone: the reason, your note and, if you choose, up to 5 of that chat’s latest messages, sent by your phone. They are stored encrypted; only Pebl staff handling the report can open them, and every opening is logged.

Account restrictionsWarnings, limits, suspensions or bans given for breaking the rules, with their reason and duration, your appeal and our answer, and which staff member decided.

Technical logsIP addresses and request logs, kept briefly for security and to stop abuse.

03What we never collect

We cannot see, or never ask for:

The content of your messages, photos, voice messages, files, polls and reactions.

Your phone number or your phone’s address book.

Your precise location, and the links you share.

Your advertising ID. We use no analytics or tracking tools.

04Why we process it, and our legal basis

We do not build advertising profiles and make no decisions about you based solely on automated processing.

To provide Pebl (GDPR art. 6(1)(b), contract)Your account, delivering messages and calls, notifications, contacts and groups.

Security and abuse prevention (art. 6(1)(f), legitimate interests)Sign-in codes, two-step verification, sessions, technical logs, rate limits, handling reports and restrictions. Our interest is keeping Pebl and its users safe; we keep as little as we can, for as short as we can.

Fixing bugs (art. 6(1)(f), legitimate interests)Crash reports, which hold no messages, names or account. You can turn them off in Settings.

Courier times (art. 6(1)(a), consent)Your approximate location, only after you agree in the app. You can withdraw consent at any time by turning it off; it is then deleted.

Legal obligations (art. 6(1)(c))Answering lawful requests from authorities, with what we have. Message content is not something we have.

05Who processes data for us

We never sell your data. Only these providers process part of it for us, as much as their job needs:

HostingOur servers are in Türkiye, in the data centres of two hosting providers (Bilhost and Alastyr); if one fails, the other carries on. Database backups are encrypted before they leave the server and kept on a separate backup server that cannot read them.

Sign-in emailsResend, Inc. (USA): your email address and the one-time code.

Email you send usAmazon Web Services (Ireland) receives mail sent to pebl.im addresses and passes it to us.

NotificationsGoogle Firebase Cloud Messaging (USA): your notification token and a wake-up signal that carries no content.

MapsMap tiles and place names come from OpenStreetMap through our server; those services never see you.

GIF searchWhat you type is passed to KLIPY through our server; KLIPY does not see you, your IP address or your phone. A GIF you send travels encrypted, like a photo.

AuthoritiesOnly on a lawful request, and only what we have. We do not have message content.

06International transfers

Pebl’s servers are in Türkiye. If you use Pebl from the EU or the UK, your data is transferred to Türkiye, which does not currently have an adequacy decision from the European Commission. The transfer is necessary to provide the service you ask for when you create an account and send messages (GDPR art. 49(1)(b)); what we keep there is limited to what this policy lists, and message content stays end-to-end encrypted.

Sign-in emails and notifications are processed in the USA by the providers named above.

07How long we keep it

Account dataAs long as your account is open; deleted at the latest 30 days after you ask.

Encrypted messagesUntil delivered to and synced with your devices. Disappearing messages go when their time is up; messages you delete go at once.

BackupsDatabase backups are deleted after 14 days, media archives after 15 days.

Crash reports60 days after they were last seen.

ReportsOne year. Messages attached to a report go 30 days after it is closed; if a penalty was given, when the penalty and appeal period end, at most 180 days.

Account restrictionsAs long as the account is open. A ban is kept with an irreversible hash of the email address, so the same address cannot open a new account.

Technical logs14 days.

08How we protect it

Chats are end-to-end encrypted with MLS; the keys that open your messages exist only on your devices, and the key exchange also resists quantum computers. Connections to the server use TLS. Location data is stripped from photos on your phone before they are sent. We plan an independent security audit. More on the Security page.

09Your rights

Under the GDPR (and similar laws) you have the right to:

Access and portabilitySettings › Download my data gives you your account, contacts and sessions in one file. Your messages are already only on your devices.

RectificationChange your name, username and photo in Settings.

ErasureSettings › Delete account deletes it at once after you confirm with a code sent to your email. If you cannot reach the app, write to kvkk@pebl.im from your registered address.

Restriction and objectionWrite to us to restrict or object to processing based on legitimate interests; crash reports and location you can turn off yourself.

Withdraw consentTurn location sharing off at any time; it does not affect what happened before.

ComplainYou can complain to the data protection authority where you live or work. We would rather you wrote to us first: kvkk@pebl.im.

10Children

You must be at least 13 to use Pebl, or older where your country requires it for consent to online services (up to 16 in some EU countries); below that age, you need your parent’s or guardian’s permission. If we find an account of a child under 13, we close it.

11If this policy changes

We announce important changes in the app and on this page before they take effect. The date at the top of the page shows when this version took effect.

12Contact

For anything about your personal data: kvkk@pebl.im. For everything else: destek@pebl.im.

Something wrong? Anything about your personal data: kvkk@pebl.im.Write

Support

Legal