Peeka Privacy Policy
Version: peeka-privacy-v0.2.2-beta · Last updated 2026-08-22
Corrected 2026-10-24: the paragraph on using Peeka without an account now describes the 30-day deletion that has applied since 2026-06-24. Corrected 2026-10-25: the section on submitted product reports now describes the two photos newer versions of the app ask for and the deletion of medicine-label photos. Corrected 2026-10-27: a new section, "If you email us", says which overseas companies handle email sent to Peeka's addresses, and a sentence under "Where your data lives" points to it. Corrected 2026-11-02: the first paragraph under "Where your data lives" now says your health data is stored and processed on servers in Sydney, and that it may pass through networks in other countries on its way to and from those servers. Nothing else in this policy has changed.
What Peeka stores and why
- Your email address and account credentials. We use your email to sign you in, to sync your results across your devices, to contact you about your account, and to send you recall or reformulation alerts for products you have checked. We will send you Peeka news and updates only if you ask us to, and you can stop those at any time from Settings or from any message we send. You can use Peeka without an account. If you do, your child profiles are linked only to the phone you use it on. If Peeka isn't opened on that phone, with an internet connection, for 30 days, they can be deleted, and we can't restore them for you. You can also lose them by deleting the app or changing phones. If you create an account, we don't delete it for inactivity.
- Your child's date of birth, known allergens, and family health history (to personalise results).
- Scan history linked to your account.
We do not store payment card numbers. Subscription billing is handled by RevenueCat; we receive only a subscription status token.
Where your data lives
In the app, your child's details, allergens, family history, scan history and personalised results are stored and processed on servers in Sydney, Australia, in your encrypted Supabase account (AWS ap-southeast-2). They travel to and from those servers over encrypted connections, and the network companies that carry them may route them through their systems in other countries on the way. Pseudonymous subscription, usage and error data, with no health information in it, goes to the overseas providers listed under "Overseas service providers" below.
Email is different. If you email us, your message is held by our email providers outside Australia. See "If you email us" below.
Who can see your data
Only you. We do not sell your data or share it with advertisers. We send only pseudonymous, health-free usage events to our analytics provider (PostHog) to understand how the app is used. We may disclose data if required by Australian law (e.g. a valid court order), and will tell you unless prohibited.
Overseas service providers
To run subscriptions, understand usage, and fix crashes, we share a pseudonymous identifier (and, for billing, your subscription status) with a small number of providers outside Australia. None of them receive your child's name, date of birth, allergens, family history, scan results, or any other health information; these fields are scrubbed before any data leaves the app.
- RevenueCat (United States): subscription billing. Receives a pseudonymous account identifier and subscription status. We never see or store your payment card details.
- PostHog (United States): product analytics. Receives pseudonymous, health-free usage events.
- Sentry (United States): crash and error reporting. Receives pseudonymous diagnostic data with health fields scrubbed.
If you email us
Our email addresses (hello@, support@ and [email protected]) are not part of the app, and email sent to them is not stored in Sydney. When you email us:
- Cloudflare (its worldwide network; it keeps its own records mainly in the United States and Europe): forwards your message to the founder's Gmail account. Cloudflare says it does not store or access the content of forwarded email; it checks messages for spam as they pass through.
- Google (United States and other countries where Google keeps servers): your message is delivered to, and kept in, the founder's Gmail account.
- Hostinger (United Kingdom, the Netherlands, Lithuania, Cyprus and other countries, including the United States): sends the replies we write to you. A reply, and anything it quotes from your message, passes through its servers.
- Anthropic (United States): the founder uses an AI tool from Anthropic to sort Peeka's inbox. For email from someone it does not recognise, which includes parents, it sees only who sent it, who it was sent to, and the date, not the subject line or the message. For email from businesses we work with, such as suppliers and advisers, it reads the message. We have turned off the setting that lets Anthropic use these emails to train its models.
Everything you write in an email is held by Google, including anything you tell us about your child, and anything a reply quotes passes through Hostinger. Replies to parents are written by the founder. Please do not put your child's name, allergens or other health details in an email.
Personalised results
Results personalised to your child are computed in memory and stored only in your encrypted account. They are treated as sensitive health information under the Australian Privacy Act 1988 (s.6(1)) and are never included in crash reports, logs, or any third-party service.
We describe results using the terms HIGHLY SUITABLE, GENERALLY OK, USE WITH CAUTION, and AVOID. These are relative assessments against published standards, not medical diagnoses.
Peeka provides regulatory and ingredient information. It does not provide medical advice. For health concerns about your child, consult a healthcare professional.
Automated decision-making
Peeka's results are produced by a computer program. No one at Peeka looks at a result before you see it.
We set this out here because from 10 December 2026 the Privacy Act requires it (Australian Privacy Principles 1.7-1.9), and because you should be able to read it now rather than then.
What the program uses. For a result personalised to your child: their date of birth, the allergens recorded on their profile, and any family health history you have entered. For a general product result, nothing about your child is used, only the product.
What it decides. It reads a product's ingredient list and label against published Australian standards and against your child's profile, and returns one of four gradings (HIGHLY SUITABLE, GENERALLY OK, USE WITH CAUTION or AVOID) with the reasons that produced it. Where the information behind a grading is missing, out of date, or could not be resolved, the program is built to return the more cautious grading rather than the more reassuring one.
What it does not do. It does not diagnose, it does not treat, and it does not replace advice from your doctor, child health nurse or allergy specialist. It reports what a label says and how that reads against the standards.
If you think a result is wrong, you can report it from the result screen. Reported results are reviewed by our team. You can also contact us at [email protected].
How we keep your data private
- At-rest encryption: AES-256 (Supabase-managed).
- In-transit encryption: TLS 1.2 or higher. No plain-HTTP endpoints.
- Auth tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore).
- Health data (child profiles, allergen lists, family history) is kept in memory only, never written to unencrypted device storage.
Your rights
You can access, correct, or delete all data we hold about you at any time from the app settings. To exercise these rights, contact [email protected]. We respond within 30 days.
Submitted product reports
If you submit a product Peeka doesn't recognise, newer versions of the app ask for two photos: the front of the pack and the ingredients list. Both are needed. We also collect the barcode and the text your phone reads from the photos. If you report a disputed result, we collect your description and any photo you choose to attach. Please do not include your child's name or any health details in these submissions; they are reviewed by our team.
If the text read from your photos looks like a pharmacy or prescription label (which can carry a named patient), we delete both photos straight away and keep none of the photos or text from that attempt. The app tells you when this happens. Older versions of the app let you add a product by typing its name, and could also send text read from its label; if that text looks like a prescription label, we remove it and the rest of the submission still goes through.
Children
Peeka is used by parents and carers on behalf of infants and children. We do not collect data directly from children. All account holders must be 18 or older.
Changes to this policy
If we materially change this policy, we will ask for your consent again before the change takes effect. Old policy versions remain on record and linked to your consent history.
Contact
Peeka · [email protected] · Australia