Privacy policy

Summary

We don’t sell personal information or use it for advertising.
Parse scans pages in your browser. Page content, names, emails and full phone numbers aren’t sent to us, except in bug reports you choose to send.
Paste and Contacts encrypt content on your device. We store ciphertext we can’t read.

1. Parse

Parse finds phone numbers and postal codes on the pages you visit and resolves them in your browser. For time zones, weather and alerts it sends api.pea.dev:

the ZIP code, first three characters of a Canadian postal code, state, province or area code, never a full phone number or postal code (for other countries, only a location rounded to about 1 km);
a random device ID for daily limits and usage counts, or your Pea account if you’re signed in;
the Parse version and browser name;
the domain of the site you’re on, such as app.hubspot.com, never the path or page content, to prioritize compatibility and features;
your IP address (IPv6 truncated to the network prefix) and the approximate city, region, country, time zone and network Cloudflare derives from it, to group devices on a shared connection and localize usage reports.

Weather alerts. Parse sends a location rounded to about 1 km and its country code, which we forward to that country’s national weather service. You can turn alerts off in Settings > Weather.

Usage statistics. About every 15 minutes Parse sends hourly totals of badges shown, by website domain, country and alert type, and of popup searches. Daily and on change, it also sends these settings: Beta features, other-country numbers, default countries, alert level and live weather. Firefox sends usage data only if you allow technical and interaction data.

Announcements. Parse checks auth.pea.dev hourly for popup announcements. No page or lookup data is sent.

Bug reports. A report includes your message, the number or code, the badge text and the page URL, plus about 60 characters of surrounding text, the page title and element type unless you untick “Include page context”. We add your IP address, country and browser version.

All other Parse settings stay in your browser.

2. Pea accounts

We store your email, optional name, hashed password and plan, and use your email for sign-in, password resets and service notices. Marketing email requires your consent. Stripe processes payments, and we never see full card numbers.

3. Paste

Pastes are encrypted in your browser, and the key in the link or code never reaches us. We store the ciphertext, a salt and a key-check hash, plus metadata: the creating account, label, size, file count, password, expiry and burn settings, open times and count, failed password attempts and outcome. When a paste ends, we delete the ciphertext and keep its status record until you remove it from Sent.

4. Pea Contacts

Contacts are encrypted on your device with a key protected by your vault passphrase. Your passphrase and recovery code never leave your device. We can see contact counts per book, change times, device labels and approximate record sizes. The Contacts extension scans pages locally and sends nothing until you save a contact.

5. This website

pea.dev uses Google Analytics, which sets cookies and receives your IP address and browser details. You can opt out with a content blocker or the Google Analytics opt-out add-on. Our lookup tools and example badges send queries to api.pea.dev, which aren’t stored, along with the page path and a random visitor ID kept in your browser. We store the ID hashed, with usage counts and your IP address. It isn’t linked to your account, though usage from a shared IP address may be grouped with Parse usage. Clearing site data resets it. The extensions contain no analytics or ad trackers.

We share data only with service providers under contract: Cloudflare (hosting and storage), Stripe (payments), our email provider, weather data providers and national weather services (location queries only), and Google (website analytics). We disclose data when the law requires it. For Paste and Contacts, that is limited to the metadata above.

7. Retention

We keep data for up to:

rate-limit counters: 2 days;
earlier versions of contacts: 30 days;
bug reports: 90 days;
IP addresses, location, Parse version, browser and settings: 180 days;
usage and lookup counts: 400 days;
account data, pastes and contacts: until you delete your account, except records required for legal or tax purposes.

8. Your choices

Parse works without an account. You can delete your account at app.pea.dev, which deletes your pastes and contacts, and export contacts as vCard or CSV at any time. To request a copy or correction of your data, email us. Our services aren’t directed at children under 13, and we don’t knowingly collect their data.

Karebin LLC is the controller of your personal data. Our legal bases are:

contract: accounts, payments, Paste, Contacts, and Parse lookups, weather and alerts;
legitimate interests: usage statistics, website analytics, rate limits, security, bug reports and compatibility work;
consent: marketing email and, in Firefox, Parse usage statistics;
legal obligation: tax and accounting records.

You may access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent at any time by emailing hello@pea.dev. You may also complain to your data protection authority. Providing data is voluntary, but some features can’t work without it. We don’t make decisions about you based solely on automated processing.

We’re based in the United States and process data there and through our providers’ global networks. Transfers rely on the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, as applicable.

10. Changes

For material changes, we’ll update the effective date and notify account holders by email or in the product.

11. Contact

Privacy questions: hello@pea.dev