Privacy policy

The Pebble Club is a friendship app for autistic and neurodivergent adults. This policy explains what we hold about you, why, and how to get rid of it. We have tried to write it in plain language. If anything is unclear, email us and we will explain it properly.

We are the data controller for the purposes of UK GDPR. Contact: hello@thepebbleclub.com.

What we collect

• Your account. Email address, and if you sign in with Google or Apple, the name they give us. We never receive your password.
• Your profile. First name, date of birth, pronouns if you add them, where you are if you add it, a short bio, your interests, and either a photo you upload or an avatar you pick.
• What you do here. Games and their state, question prompt answers, messages, songs and photos you share, badges, and who you are paired with.
• Technical. A push notification token if you turn notifications on, and the time you were last active.
• How the app is used.Which screens are opened, how long the app is open for, and taps on a few controls (for example, opening a game's instructions). This does not include the text of what you write as you type it.
• Session recordings. The app records what is shown on screen while you use it, as short replays we can watch back. We use these internally to see where the app confuses people and to fix problems, in the same way our moderators can already read messages to keep people safe. What you are typing into a box is always hidden in these recordings; content on screen, including conversations, is visible to us. Recordings are held in the EU, are never shared or made public, and are deleted with your account on request.

What other members see

Your first name, age, pronouns, location, bio, interests and picture. They never see your date of birth, your surname or your email address.

Why we hold it, and on what basis

• To run the app. Pairing you with someone, keeping a game going, delivering a message. Lawful basis: performance of a contract with you.
• To keep people safe. Screening messages before they are delivered, storing reports and blocks, checking you are 18 or over. Lawful basis: legitimate interests, namely the safety of our members.
• To send notifications you have asked for. Lawful basis: consent, withdrawn any time from Profile.

Who at The Pebble Club can see your messages

Our own moderators can read conversations. We do this so that when someone reports another member we can actually investigate it, and so we can check that automatic screening is not wrongly blocking people. Access is limited to named administrator accounts, and it is a read: nobody can post as you or alter what you said.

Please treat messages here as private between you, the person you are talking to, and our moderators, rather than as end-to-end encrypted.

Who we share it with

• Supabase hosts our database and the photos you share.
• Vercel runs the servers the app talks to.
• Anthropic: message text, profile text and shared photos are sent to Claude to screen them for abuse, harassment, sexual content and scams before they are delivered. They are used for that check only and are not used to train models.
• Expo and Apple/Google push services deliver notifications if you turn them on.
• Mixpanelis our analytics service. Our servers send it events like “a game was started”, and the app sends it the usage and session recordings described above. Events carry your account id so they join up, but never your name or email. The data is held in the EU, and you can have it deleted at any time by deleting your account or emailing us.
• Meta, for advertising measurement. Adverts are how people find out the club exists, and this is how we know they work. On thepebbleclub.com, if you say yes to the cookie question, a Meta pixel tells Meta your visit happened. In the app, Meta's measurement kit reports that the app was installed and opened, so an install can be matched to the advert that led to it. On iPhone the app asks your permission first, and if you say no, no advertising identifier is shared and installs are only counted anonymously, in aggregate. What you do inside the club (your profile, games, messages, who you talk to) is never shared with Meta either way.

We do not sell your data, and there is no advertising inside the app. The only data that touches an advertising company is the measurement described above: that a visit, an install or a signup happened. Never what you do here or who you are talking to.

How long we keep it

For as long as your account exists. Delete your account and it goes, in full and immediately: profile, games, conversations, uploaded photos, reports you made, and push tokens. Reports made about you may be retained where we need them to keep other members safe. Games nobody has touched for seven days are archived automatically. Usage counts already sent to analytics keep their random account id, but once your account is deleted that id no longer connects to anyone; email us if you want those events erased outright as well.

Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and complain to the Information Commissioner’s Office. Most of it you can do yourself: your profile is editable in the app, and deleting your account takes two taps. For anything else, email us and we will respond within 30 days.

Age

The Pebble Club is for adults aged 18 and over. We ask for a date of birth at signup and reject anyone under 18. If we learn that someone under 18 has an account, we delete it.

Changes

If we change anything that matters, we will tell you in the app rather than quietly updating this page.