Privacy Policy
Last updated 8 September 2026 · Stak Technologies, Inc.
The short version. Pepper processes your documents entirely on your device. No document content is transmitted anywhere. We collect the minimum needed to run an account and a subscription: an account identifier and your subscription status. We do not sell personal information, and we do not use your documents to train models.
1. Who we are
Pepper is published by Stak Technologies, Inc., a Delaware corporation. For any privacy question or request, contact privacy@stak.cc.
2. What Pepper does with your documents
When you import a document, Pepper reads it, splits it into passages, and builds a searchable index on your device. That index and the document remain in the app's private storage on your phone.
No part of your document leaves the device at any point — not during import, not during search, and not when an answer is generated. Your searches and the answers Pepper produces are likewise never transmitted. We hold no copy of your files and could not produce one if asked.
3. What we collect
| Data | Why | Where it lives |
|---|---|---|
| Account identifier and email address | To sign you in and associate your subscription with you | Auth0 (Okta, Inc.) |
| Subscription status | To determine whether your subscription is active | RevenueCat, Inc. and Google Play |
| Purchase records | Billing, refunds, and receipt validation | Google Play |
| Request counts per account | To prevent abuse of our download service | Our servers, expiring automatically |
| App install identifier, device model and IP address | Collected by our subscription provider to match a purchase to an install and prevent fraud | RevenueCat, Inc. |
We do not collect your documents, your search queries, the answers Pepper produces, your contacts, your precise location, or advertising identifiers. Pepper contains no advertising and no third-party analytics or tracking software.
Location and maps
Pepper can display maps. If you use a feature that centres the map on your position, Android asks your permission and the coordinates are used on the device to position the map. Pepper never transmits your coordinates to us or to anyone, and does not store them.
Map tiles themselves come from OpenFreeMap, an independent third-party service, both for the live map and for downloading offline regions. Those requests go directly from your device to OpenFreeMap and carry no Pepper account identifier — but OpenFreeMap does receive your device's IP address and which area of the map you requested. If the map is centred on your own position, that area reflects roughly where you are.
4. Payments
Subscriptions are purchased and billed through Google Play. We never see or handle your payment card details. Google processes payment and shares with us and with RevenueCat only the fact of a purchase and its status, so we know whether your subscription is active.
5. Service providers
- Auth0 (Okta, Inc.) — authentication and account identity.
- Google Play (Google LLC) — distribution, payment processing, subscription management.
- RevenueCat, Inc. — subscription status and entitlement management.
- Google Cloud (Google LLC) — hosting for knowledge-pack delivery.
- OpenFreeMap — map tiles for the live map and offline regions. Receives your IP address and the map area requested; receives no account identifier.
Each processes data only to provide its service to us. We do not sell personal information, and we do not share it for cross-context behavioural advertising.
6. How long we keep things
Account and subscription records are kept while your account exists, and afterwards only as long as required for tax, accounting and legal obligations. Abuse-prevention counters expire automatically within days. We hold no document content at all, so there is nothing to retain.
7. Your rights
You may request access to the personal information we hold about you, correction of it, deletion of it, or a copy in portable form. Depending on where you live you may have additional rights under the GDPR, the UK GDPR, or the CCPA/CPRA, including the right to object to processing and the right not to be discriminated against for exercising a right.
To make a request, email privacy@stak.cc. To delete your account, see Delete your account. We respond within 30 days.
8. Children
Pepper is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
9. Security
Authentication tokens are stored in encrypted storage backed by the Android Keystore. Traffic to our services uses TLS. Your documents remain in the app's private storage, protected by your device's own security.
10. International transfers
We operate in the United States, and our service providers may process data there and elsewhere. Where required, transfers rely on Standard Contractual Clauses or another approved mechanism.
11. Changes
If we change this policy we will update the date above and, for material changes, notify you in the app before they take effect.
12. Contact
Stak Technologies, Inc.
Seattle, Washington, United States
privacy@stak.cc