Last updated: September 6, 2026
Encrypted at rest
Sensitive data is AES-encrypted before it touches our database
No data sales
Your information is never sold or shared with data brokers
You control visibility
Hide any profile field from other users at any time
No tracking cookies
We use localStorage for auth only. No third-party trackers
When you use Pebble, we collect information you provide directly: your name, email address, city, profile details (username, bio, interests, skills, social links), and profile picture. We also collect messages you send to Pebble and within matched chats, along with photos you upload, such as item photos on an exchange listing or attachments in a chat.
We automatically collect your approximate location (city-level, via IP), timezone, and basic usage data (pages visited, features used) to improve the service. If you turn on push notifications, we store a push token for each device you enable them on, so we can deliver them.
Pebble's assistant runs on Anthropic Claude, a third-party AI service. To understand what you want, we send Anthropic: your messages to Pebble (including your onboarding conversation and any text you paste about yourself), photos you attach in chat, and profile details such as your interests, city, personality tags, and preferred times. Anthropic uses this only to extract your intent and preferences, create and adjust your plans, draft your suggested bio, and pick events for you. Messages you exchange with matched users are never sent to any AI service.
We ask for your explicit permission before any of this happens, and you can withdraw it by deleting your account. Anthropic processes this data on our instructions under its Commercial Terms of Service and Data Processing Addendum: it does not train models on your data, deletes inputs and outputs within 30 days, and protects them with encryption in transit and at rest. Neither Pebble nor Anthropic trains AI models on your personal data.
We share limited profile information with users you are matched with. What is visible depends on your privacy settings (you can hide your real name, age, and other fields). We do not sell your personal data to third parties. Verified businesses may pay to maintain a presence on Pebble and post events, but your data is never shared with them beyond what you choose to make visible on your profile.
We use the following third-party services. Each one acts as a processor on our instructions: they may only handle your data to run Pebble, never for advertising, and none of it is sold.
Your profile is only visible to users you are connected with through the matching process (candidates who have been notified about your proposal, or proposers whose proposals you have been matched to). You control which fields are hidden via the "hide fields" toggle on your profile.
Your account data is retained as long as your account is active. Chat messages in matched conversations are stored for the duration of the chat. You can request deletion of your account and associated data by contacting us.
You can also delete everything yourself, from inside the app or by email if you no longer have it installed: Delete your account
We use JWT-based authentication, HTTPS encryption in transit, and access controls to protect your data. Sensitive personal information (email address, real name, profile picture, and social links) is encrypted at rest using AES symmetric encryption before being stored in our database.
Profile pictures are validated for size limits. Social links are sanitized to prevent injection attacks. All user-generated content is sanitized with DOMPurify before rendering.
Pebble uses localStorage to store your authentication token. We do not use third-party tracking cookies.
We may update this policy from time to time. Significant changes will be communicated through the app. Continued use of Pebble after changes constitutes acceptance of the updated policy.
Questions about this policy? Reach out at contact@pebble.wtf