Privacy

What we collect, and why

On the waitlist: your name, email address, best-effort city and country from Cloudflare, confirmation and beta-approval status, and the campaign tag, referral, landing page, referring site, or answer you provide about how you heard of Petak. We ask that question only when an explicit campaign or referral link has not already answered it. We send the confirmation, at most one reminder after 48 hours, a confirmation receipt, and a beta invitation only after approval. Unconfirmed names and addresses are deleted after seven days. Unsubscribing is one tap and immediate: the address goes on a do-not-contact list and nothing is sent to it again unless you join and confirm again. An operator may permanently delete any waitlist row; after registration this does not delete the separate Petak account or app records.

On the beta download page: if you claim a beta invite with Google or Apple, we store your Petak account ID, login provider, email address, name if the provider gives it, platform choice, update-email choice, and the referral or campaign tags that brought you there. This lets the invite follow your account after install, lets Ollie call you by the right name, and lets us send beta access or product updates only when allowed.

In the app: what you hand your neighbours — messages, photos, and the entries read from them (receipts, meals, journal entries, settlements). Plus the account basics: the sign-in identity from Google or Apple, and your subscription state from the app store. That's the list.

Neighbours read only what you send

A photo is read only when you send it to be read, and only by the neighbours whose job it is. A photo attached to a journal entry is kept as a memory — held, not mined. Every petak has its own lock: what you tell one neighbour is not browsed by another without a reason you can see in the thread.

What we never do

We don't sell your data. We don't use your records for advertising, and there are no third-party ad trackers on the site or in the app. We don't train public models on your entries. We don't read your records to make decisions about you — they exist to be served back to you.

Where your records live

Records are stored per account, isolated row by row, encrypted in transit and at rest. Reading what you send uses service providers under contract as processors — they process it to serve you and keep nothing for their own use. Depending on where you live, this processing may happen outside your country; wherever it does, it's covered by contractual safeguards holding it to this policy's standard. The current list of processors is available on request at hello@petak.app.

Crisis-like messages

If what you send appears to include explicit self-harm wording, Petak may mark that record internally and show a safety message. In Tell Ollie, those words are kept inside Petak and are not forwarded to external app-work tools such as ClickUp. In Mira's journal, the entry is kept unless you specifically ask not to record it, and crisis-marked entries are excluded from generated day and week reflections. We use this handling for safety response, audit, privacy control, and account deletion — not advertising.

Moving out, and deleting

When a neighbour moves out, your records stay with you — the room is swept, not deleted. Deleting your account deletes everything, completely, on request, with no waiting-period games. You can also export your records at any time.

Cookies and analytics

Petak uses PostHog as its product analytics processor across the marketing site and app. Browser analytics starts only after you choose Accept All; Essential Only stores no persistent PostHog browser identifier. With Accept All, we may store the pseudonymous PostHog browser ID beside your waitlist row so an approved invitation opened on another device can be joined to the Petak account you create. The raw invitation is never stored in analytics or left in the download URL, and one anonymous ID cannot be joined to multiple accounts. Analytics events cover page views, download platform choice, country, referrer, campaign source, and product milestones such as signup, app open, onboarding, and first photo extraction. We do not record message text, photos, journal entries, prompts, names, or emails in analytics events. No advertising trackers, no IDFA, no device fingerprinting, and no attempt to match a person across other companies' apps or websites.

Referrals and attribution

Referral links and campaign tags are attached to your Petak account after you sign in on the beta download page. For an approved waitlist invitation, those first-touch fields come from the confirmed waitlist row rather than assuming your waitlist email and Google or Apple email are the same. This is first-party attribution: it tells us which Petak route brought you here and whether the beta signup worked. It is not used for ad targeting and is not sold.

Children

Petak is for ages 16 and up. If someone younger has joined the waitlist, write to us and the address is removed.

Your rights

Wherever you live, you get the same set: see what we hold, correct it, export it, delete it. Write to hello@petak.app and a person answers.

Changes

If this policy changes in a way that matters, we say so plainly — in the app and on this page — before it takes effect. No silent edits.

Who to write to

Data questions go to hello@petak.app, attention: the founder. This policy is governed by the laws of Singapore.