Privacy Policy

1. Who we are

Piccola is developed and operated by I.E. BLANKET BYTE (individual entrepreneur), registration ID 305834292, University Street N.17a, Floor 10, Vake district, Tbilisi, Georgia. We are the data controller for the personal data described in this policy.

You can reach us at support@piccola.app for anything privacy-related. We answer in English or Italian.

2. The short version

• We store what you type into Piccola so we can show it back to you, on every device you sign in on.
• No ads, no advertising networks, no analytics or telemetry SDKs, no crash-reporting services, no tracking of any kind.
• The app sets no cookies. It keeps a handful of settings and your sign-in session in your browser or phone storage (see section 6).
• We never sell your data and never share it for marketing. Other Piccola users only see what you choose to share: your name, email and profile photo with your connections, the notes and grocery lists you share with them, the progress you choose to show them, and the messages you send them.
• Luna, the optional AI helper ("Ask Luna"), sends your Piccola data to Anthropic (Claude) only when you ask it a question, to answer it. It can also make changes you ask for, but only after you confirm each one on its card. When you tap Translate on a chat message, that message alone is sent to Anthropic to translate it. See section 7.
• If you connect an AI app such as Claude or ChatGPT to your account (Settings → AI connections), it can read and change the parts of Piccola you allow, and what it reads goes to that app. You can disconnect it at any time. See sections 3 and 7.
• You can export everything and delete your account yourself, from Settings, at any time.

3. What we store

Everything below is stored only because you chose to enter it or enable it.

• Account: your email address and, if you set one, a password. The password is stored only as a secure hash by our authentication provider (Supabase) — we never see it. Instead of a password you can sign in with a 6-digit code we email you; it works once and only for an hour. The only emails we send are the ones needed to run your account: sign-in and signup codes, password reset, a confirmation when you change your email address, and a security notice when your password, email address or sign-in methods change. If you sign in with Google, or with Apple on iPhone and iPad, instead of a password, we receive your email address and, if you share it, your name from them; with Apple you can hide your email, in which case we get an Apple relay address that forwards to you.
• Profile and preferences: a display name (by default, the part of your email before the "@"), an optional avatar picture, your locale, time zone, currency, first day of the week, date format, interface language, theme, "reduce motion" preference, and the date you completed onboarding. From the first-run setup we keep what you picked (the sections you wanted help with, the starters you chose, and what was created from them), so it is applied only once and so we can check, counting accounts and never with tracking tools, whether the setup helps people get started. We also keep whether you hid the "Getting started" card on Home and whether you told us you added Piccola to your home screen.
• Routine: your routines (title, description, icon, color, time), their repeat rules, the individual occurrences generated from them, and which ones you marked as done or skipped.
• Groceries: your lists and their items (name, category, quantity, unit, note, and whether you bought it).
• Budget: your spending categories, monthly limits, expenses (amount, currency, date, merchant, note), and any receipt files you attach (PNG, JPEG, WebP or PDF, up to 25 MiB each).
• Reminders: your reminder categories (Piccola starts you with "Medicine" and "Nuts", and you can add your own), the items in them, the log entries you record (time, optional amount and unit, note), and the reminders you schedule (label, time, repeat rule, snooze). See section 4 about health-related entries.
• Notes: your notes (title, text, checklist items and whether each is ticked, color, pinned and archived state) and the time of a note's reminder, if you set one. A note reminder shows the note's title and the start of its text (or how many checklist items are done) so you know which note it is (section 9).
• Connections and sharing: the email addresses you invite, your invitations and whether they were accepted, the invite links you create (a random code, when it was made and expires — after 14 days — and who used it; a link works once), the people you are connected with, and which notes and grocery lists you share with whom (view or edit). Your connections can see your display name, email address and profile photo; anyone who opens an invite link you created sees your display name and profile photo, so share it only with the person you mean to invite; the people you share a note with can see that note, who else it is shared with, and — if they can edit — change it and its reminder. The people you share a grocery list with can see it and who else is on it, and — if they can edit — add, change, tick and remove its items. Notes and lists someone shares with you stay theirs: only they can delete them or change who they are shared with.
• Progress: we work out your rhythm score, full days, streak and rest days from your routine history each time you open the app, and keep the milestones you earn (with the date), the cheers you send and receive, and how many shopping and checklist items you have ticked. Nothing is shared until you choose, per connection: "Status" shows them your band (for example "On track"), your streak and your latest milestone; "+ Routines" also shows the routines you pick, by name, with whether today's is done. Your score number, logs, amounts and budget are never shown to anyone. Removing a connection stops sharing both ways.
• Chat: the messages you send to and receive from your connections, one to one or in groups (text, time sent, and when they were read), and the translation of a message you received if you asked for one (kept with the message, with its language). Both people in a conversation can see it. If you or they remove the connection, the conversation stays readable to both of you but no new messages can be sent.
• AI connections: if you connect an AI app to Piccola (with a personal token or by signing in from the app), we keep the connection's name, the areas you allowed and whether each is read-only, its expiry date, whether messages it sends show "via" its name, when and from which app it was last used, and how many requests it made each day. We also keep a list of every change it makes in your Piccola (what kind of change, the item's name at that moment, and a short detail such as an amount or a person's name), which you can see on the connection's page in Settings, and we send you a notification saying how many changes it made. This list stays after you revoke the connection, so you can still see what it did, and is deleted with your account. The token itself is stored only as a hash, so we cannot read it back. When you sign in from an AI app, we also keep the app's name, website and the address it returns to after sign-in, plus a one-time sign-in code that expires within minutes. Revoking a connection stops it working immediately.
• AI assistant (Luna): the questions you ask Luna ("Ask Luna") and its answers, plus how many tokens each answer used, kept as one running conversation until you clear it. When it proposes a change, the conversation also keeps the change it proposed (what it would do, in a sentence) and whether you confirmed it. Every change it made after you confirmed it is kept in its history (the button at the top right of the assistant's chat: what kind of change, the item's name at that moment, a short detail and the sentence you confirmed); this history stays when you clear the conversation and is deleted with your account. A chat message it sends for you is labelled "via Luna" for the person who receives it.
• Focus: your focus rounds (an optional label, planned and focused length, whether you finished, paused or extended, start and end time), the daily goals you completed, and Luna's coat and treats. If you host or join a focus room with friends, we keep the room's plan, who was invited and who joined, each person's current round and phase, and the paws and waves sent in it. On iPhone, the apps you choose to block during Focus are picked with Apple's Screen Time and stay on your device; we never see them.
• Chat photos: the photos you send in a chat, kept privately and shown only to the people in that chat.
• Widgets: for each device where you add a Piccola widget, a widget key (stored only as a hash) and when it was last used, so the widget can show your summary without signing in.
• Piccola Plus: whether you are a founding member, the date you started your one free trial, and, if you buy Plus, your plan, its status, when it renews or ends, where you bought it (App Store, or Creem on the web and Android) and the store's subscription and customer identifiers; for a family plan, who is in it. To apply the free limits, we count how many Luna questions and chat translations you use each month. We never receive your card details.
• Your country, for prices: when the website or the Android app shows Plus prices or opens a checkout, our server looks up which country your IP address belongs to, using a country database that runs on our own server (IP Geolocation by DB-IP, so the address is not sent anywhere), to show prices in euros or US dollars. We don't save the country, and the IP address is used for nothing else (beyond the brief technical logs described below).
• Devices and notifications: for each device you enable notifications on — its platform, a push token (an Expo push token on iOS/Android; a push subscription endpoint and keys on the web), a device name (on the web, the first part of your browser's user agent string; on mobile, your device's name), your per-category notification toggles, and when it was last seen. We also keep your in-app notification inbox and a log of which notifications were sent to which device.
• Technical records: short-lived request identifiers that stop the same action from being applied twice if your connection drops; these are deleted after about 48 hours. Hosting providers may also keep brief technical logs (such as IP address and request time) to keep the service running securely.

4. A note on health-related entries

Piccola is not a medical device and the Reminders module is not a medical record. By design it stores factual log entries only — there are no dosage, prescription or exposure-plan fields, and nothing in the app instructs you to take, eat or avoid anything. As the app itself puts it: "No records for this day — that's not a health claim, just no log."

If you choose to log medicines, allergens such as nuts, or similar items, you are giving us information that relates to your health. We treat those entries like everything else you type into Piccola: we store them solely so we can show them back to you, we never analyze them, we never share them, and you can delete them individually or by deleting your account. By using Reminders for this purpose you explicitly agree to us storing those entries for you.

5. Why we process your data

We rely on the following grounds:

• To provide the service you signed up for (performance of our contract with you): storing your data, syncing it between your devices, and keeping your account working.
• Your consent: for push notifications (opt-in per device, revocable at any time in Settings) and for any health-related entries you decide to log (section 4).
• Our legitimate interest in keeping Piccola secure and reliable: protecting accounts, preventing abuse, and fixing problems; and in checking, from the setup choices stored with each account (section 3), whether the first-run setup helps people get started.
• To sell and manage Piccola Plus if you buy it (performance of our contract with you), including confirming purchases, renewals and refunds, and applying the free limits.
• Legal obligations, where they apply to us.

6. Cookies and on-device storage

Piccola sets no cookies. To work as an app, it keeps a few things in your browser or on your phone:

• On the web: your theme (piccola.theme) and accent colour while you are signed in (piccola.accent), interface language (piccola.language), a copy of your Piccola data and of the changes you made while offline, so the app opens and works without a connection (piccola.queryCache.v1.<your user id>, in the browser’s IndexedDB; older versions also used piccola.offlineQueue.v1.<your user id>), the last app configuration it loaded (piccola.runtimeConfig.v1), the identifier of this browser’s notification registration if you turn on notifications (piccola.webDeviceId.<your user id>), the choices you make in the first-run setup before you create an account, for up to 7 days or until the setup is done (piccola.onboarding.draft.v1), an invite link you opened before signing in (piccola.pendingInvite.v1), and your sign-in session with its refresh token (sb-<project>-auth-token), plus a temporary verifier while you sign in.
• The web app's service worker caches only the app shell (the code and images needed to open the app, also when you're offline). It never caches API responses or files — your offline copy is the one above, kept per signed-in person — and it is what displays push notifications when you enable them.
• On iOS and Android: your sign-in session is stored in the operating system's secure storage (Keychain on iOS, encrypted storage on Android). The app also keeps a device identifier and, in its own app storage, a copy of your Piccola data and of the changes you made while offline, so it opens and works without a connection. Before you create an account, it also keeps the choices you make in the first-run setup (for up to 7 days or until the setup is done) and an invite link you opened.
• That offline copy is removed when you sign out; changes still waiting for a connection are lost then (the app warns you first).

Clearing your browser data or uninstalling the app removes these; it does not delete your account or the data stored on our servers (see section 11 for that).

7. Where your data lives and who helps us run Piccola

We run Piccola on a small number of infrastructure providers, each of which processes data only on our instructions and only as needed to provide their service to us:

• Supabase — hosts our database, authentication and file storage.
• A virtual private server hosting our API and background worker.
• Expo Push Service, together with Apple Push Notification service and Google Firebase Cloud Messaging — to deliver notifications to the iOS and Android apps.
• Anthropic (the Claude API) — only when you use "Ask Luna" or tap Translate on a chat message. When you tap Translate, we send Anthropic the text of that one message and the language to translate it into, and nothing else. Each time you ask the assistant a question, we send Anthropic your question and your recent conversation with the assistant; to answer, the assistant then looks up only the Piccola data it needs (for example your shopping lists, a note, this month's expenses, your routines, the names of your connections or a chat), and what it looks up is sent to Anthropic too. Push tokens, devices and files are never sent. Under Anthropic's commercial terms this data is not used to train their models; Anthropic may keep it for a limited time for safety and abuse monitoring. If you never use the assistant or Translate, nothing is sent to Anthropic.
• AI apps you connect yourself (section 3) — for example Claude by Anthropic or ChatGPT by OpenAI. They are not our providers: you choose them, and they act under their own terms and privacy policy. Each time the app uses a Piccola tool, it receives the data that tool returns (for example today's routines, a note, or your expenses for a month), only within the areas you allowed. Nothing is sent to an AI app unless you connect it, and disconnecting it stops access at once.
• Your browser vendor's push service (Apple, Google, Mozilla or Microsoft, depending on your browser) — to deliver web push notifications.
• Creem (creem.io) — our reseller and merchant of record for Piccola Plus bought on the web and in the Android app. When you start a checkout we send Creem your email address and your Piccola account identifier, so the purchase is linked to your account. You enter your payment details on Creem's checkout; Creem processes the payment, issues your invoice, handles tax and keeps the records the law requires, under its own privacy policy. It tells us the purchase's plan, status and renewal dates.
• RevenueCat — manages Piccola Plus bought in the iPhone and iPad app. It receives your Piccola account identifier, your email address and the purchase records Apple provides, and tells us whether your subscription is active.
• Apple (the App Store) — processes payments for Plus bought on iPhone and iPad, under Apple's terms and privacy policy. We never receive your payment details.
• An email delivery provider — for the account emails listed in section 3.
• Let's Encrypt — to issue the TLS certificates that keep your connection encrypted.

Some of these providers may store or process data outside the country you live in. Where that happens, transfers rely on the provider's contractual safeguards. We do not use any provider for advertising or analytics.

8. Your files (receipts and avatars)

Receipts and avatar pictures are stored in two private storage buckets (up to 25 MiB per receipt and 5 MiB per avatar). Files are uploaded directly from your device to storage, are kept under a path that belongs only to your account, and are never reachable through a permanent public link: the app opens them through short-lived signed links (about 5 minutes for receipts and 1 hour for avatars). Deleting an expense's receipt, replacing your avatar, or deleting your account removes the files.

9. Notifications

Notifications are off until you turn them on, per device and per category. So you can tell at a glance what each one is about, a notification names what it is for, and that text travels through the push services listed in section 7 and can appear on your lock screen: a routine reminder shows the routine's name, icon and time; a reminder shows its label and what to log; a note reminder shows the note's title and the start of its text (or its checklist progress); a shared note or connection notification shows the other person's name (and the note's title); a chat message shows the sender's name and the first part of the message (up to 140 characters). We never include amounts, expenses or logged entries. To keep this off your lock screen, turn off notification previews for Piccola in your phone's or computer's settings, or switch categories off per device in Settings. If you read the message within a few seconds in an open chat, no notification is sent. Delivery is best-effort: push services can delay or drop messages, so please don't rely on Piccola for anything time-critical. You can remove a device or switch categories off at any time in Settings.

10. How long we keep your data

We keep your data for as long as you keep it: until you delete an item, or delete your account. There is no automatic expiry, apart from the short-lived technical records mentioned in section 3 (deleted after about 48 hours). Backups of the database are kept for a limited period, after which data you deleted also disappears from backups.

11. Export and deletion

• Export: in Settings you can download a JSON export of everything in your account, including your chat messages and AI conversation. The mobile apps also offer a CSV export of your expenses.
• Deletion: in Settings, "Delete account" asks you to type DELETE MY ACCOUNT and to confirm it is you — with your password, or, if you sign in with Google or Apple, by signing in with it again just before. It then cancels any pending notifications, deletes all your files, and deletes your account together with every routine, list, expense, entry, reminder, note, chat message, AI conversation, device and notification record. Your connections and invitations are removed, notes you created are deleted for everyone you shared them with, and you are removed from notes others shared with you. This is immediate and cannot be undone.

12. Security

We designed Piccola so that your data is isolated to your account: the database enforces per-user row-level security (covered by automated tests), every API request is verified against your session token, all traffic is encrypted with TLS (with HSTS), passwords are hashed by our authentication provider and must be at least 10 characters with upper and lower case letters and a digit, and server-side keys are never shipped to the app. We are not certified under SOC 2, HIPAA, PCI DSS or similar schemes, and no system is perfectly secure — please use a unique password and keep your devices protected.

13. Your rights

Depending on where you live (for example under the EU or UK GDPR), you have the right to access, correct, delete and export your data, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with your local data-protection authority. You can exercise most of these yourself in Settings (edit, export, delete). For anything else, email support@piccola.app and we will respond within a reasonable time, normally within 30 days.

14. Age

Piccola is for people aged 16 and over. We do not knowingly keep accounts of younger users; if you believe someone under 16 has created one, write to support@piccola.app and we will remove it.

15. Changes to this policy

When we change this policy we publish the new version here with a new date at the top. If a change materially affects how we use your data, we will let you know in the app before it takes effect.

16. Contact

I.E. BLANKET BYTE · University Street N.17a, Floor 10, Vake district, Tbilisi, Georgia · support@piccola.app · blanketbyte.com