Privacy

Information we collect

• Account data — email address, password (stored hashed by our auth provider), display name, and optional username when you set one.
• Profile & billing data — subscription plan, storage quota, Stripe customer and subscription identifiers, and subscription status when you upgrade.
• Project content — project names, 3D models, textures, hotspot annotations, comments, uploaded media, camera state, and share-link tokens you create.
• Collaboration data — team names, membership roles, project collaborator invites (email or username), and who created or edited content.
• Technical data — IP address, browser type, and request logs generated when you use the service (via our hosting provider).

How we use it

We use this information to authenticate you, store and display your 3D projects, enforce storage limits, process payments, enable sharing and collaboration, convert and optimize uploaded models, protect the service from abuse, and respond to support requests.

Service providers

We use third-party services to run Peppo. They process data on our behalf and only as needed to provide the service:

• Supabase — authentication, database, and legacy file storage.
• Cloudflare R2 — primary object storage for models, attachments, and thumbnails.
• Vercel — application hosting and request logs.
• Render — application hosting, backend services, or web deployments.
• Stripe — payment processing and subscription management (when billing is enabled).
• Google — optional sign-in via Google OAuth when you choose that method.

We do not use advertising pixels, ad networks, or cross-site analytics trackers that follow you across other websites. During beta we may record first-party activation milestones (for example, first model upload or first share link) in our database to improve onboarding — not via third-party tracking scripts.

Our infrastructure providers (Supabase, Cloudflare, Vercel, Render) may process data in the United States, European Union, or other regions. Where required, we rely on your consent and contractual safeguards with subprocessors for cross-border transfers.

Cookies & local storage

Peppo uses essential cookies and browser storage only — we do not set advertising or cross-site tracking cookies.

• Authentication cookies — set by our auth provider (Supabase) to keep you signed in. They use Secure (on HTTPS) and SameSite=Lax. They are required for the product to function; there is no non-essential cookie banner because we do not use analytics or marketing trackers.
• Local preferences — theme and UI preferences may be stored in localStorage or sessionStorage on your device (not third-party cookies).
• Google sign-in — if you choose Google OAuth, Google may set its own cookies on Google-controlled domains during the sign-in flow. That is governed by Google's privacy policy, not ours.

Artificial intelligence

Peppo does not send your project content or account data to third-party AI model providers (such as OpenAI or Anthropic) for training or inference.

Retention & deletion

Projects you delete are moved to Trash and kept for 7 days so you can restore them. After 7 days, projects and their stored files (models, media, thumbnails) are permanently deleted by an automated job. You can also permanently delete a project from Trash at any time. If you delete your account, contact us and we will delete associated personal data subject to legal retention requirements.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to certain processing. Under Israel's Privacy Protection Law (including Amendment 13), you may contact us to exercise applicable rights. California residents can contact us to exercise CCPA rights. We do not sell personal information.

You can request account deletion from your workspace account settings or by emailing info@peppo.app. We will process verified requests within a reasonable timeframe, subject to legal retention requirements.

Security & breach notification

We implement technical and organizational measures to protect your data, including encryption in transit, access controls, and row-level security on project data. If we become aware of a security incident affecting your personal information, we will notify affected users and regulators as required by applicable law.