Privacy Policy

1. Controller

Email

hallo@peekami.com

Phone

+49 176 80698384

Sections 2 to 7 cover the website www.peekami.com, section 8 the Peekami app and our relay service. The website does not access any camera or microphone.

2. Providing the website

When you open a website, technically necessary connection data is transmitted to the server delivering it. This includes in particular the IP address, the requested address, date and time, and details of browser and operating system, as far as your browser sends them. Without this connection the page cannot be delivered.

The purpose is to deliver the requested content and to operate the website securely and without disruption. The legal basis is Art. 6(1) (f) GDPR. Our legitimate interest is to keep the website working and to be able to detect technical errors or abusive access.

Hosting and recipients of the website

The website, and only the website, is operated with the following provider:
Cloudflare, Inc.
101 Townsend Street, San Francisco, CA 94107, USA (EU representative: Cloudflare Portugal, Unipessoal Lda., Largo Rafael Bordalo Pinheiro 29, 1200-369 Lisbon, Portugal)

Cloudflare processes this data on our behalf as a processor under Art. 28 GDPR. The basis is the Cloudflare Data Processing Addendum, which forms part of our contract with Cloudflare. Cloudflare Data Processing Addendum.

Processing locations: Website only: Delivery via Cloudflare's global network (Workers and Static Assets); each request is handled in the nearest data centre, which for visitors from Europe is usually within the EU.

Logged data: Technical access data per request: IP address, time, requested address, status code, browser identifier, referrer and error messages (Cloudflare Workers Logs). The website sets no cookies and uses no analytics tools. Cloudflare also asks your browser, via "Network Error Logging", to report connection errors to Cloudflare (IP address, requested address, error type, time). Cloudflare uses these reports to monitor its own network; Peekami does not receive them.

Retention period: Cloudflare Workers Logs are deleted automatically after 3 days, the retention period of the Cloudflare Free plan we use. Peekami does not store these logs separately and only consults them when troubleshooting.

Third-country transfers and safeguards: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses under Art. 46 GDPR apply through the Cloudflare Data Processing Addendum.

Further information: Cloudflare privacy policy.

3. Contact by e-mail, phone or post

When you contact us, we process the contact and content data you provide, for example your name, e-mail address, phone number and your request. This data is used to handle and answer your request. Providing it is voluntary. Without the necessary contact or factual details we may not be able to answer your request.

If the request concerns the initiation or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. Other requests are handled under Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with interested people and handling their requests.

E-mail service

The e-mail address given uses iCloud Mail (Apple). When you send a message, your sender address, message content, attachments and technical delivery data are processed by the e-mail providers involved. The contracting party for this mailbox is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple also processes data in the United States and, according to its own statements, bases third-country transfers on the EU Standard Contractual Clauses (Art. 46 GDPR); processing is not limited to Europe. Details are available in Apple’s privacy policy. If you prefer not to have your data processed by Apple, you can reach us by phone or post instead.

Notice at app launch (“Notify me”)

If you ask us, for example via the “Notify me” button, to let you know when Peekami is available in the store, we use your email address only to send you that notice once. The legal basis is your consent given by that request (Art. 6(1)(a) GDPR). We keep no waiting list database and use no marketing software; the message stays in our mailbox and is deleted after the notice. We do not send a newsletter. You can withdraw your consent at any time with effect for the future; an informal message to hallo@peekami.com is enough. The button only opens your email program with a prepared message and does not transmit any data itself.

Retention period

Enquiries are kept only as long as necessary to deal with them completely. Where statutory retention obligations exist or individual data is needed to establish, exercise or defend legal claims, the data concerned is retained for that purpose and then deleted. Statutory retention is based on Art. 6(1)(c) GDPR; safeguarding legal claims on Art. 6(1)(f) GDPR.

4. Cookies, local content and analytics

The website currently uses no analytics or advertising cookies. No audience measurement, advertising pixels, social-media embeds or external video players are included. The website creates no visitor profiles and stores no settings in local storage or session storage.

Font files, images and program components are delivered together with the website. The browser does not connect to Google Fonts to display the typeface. Your browser may cache files technically for faster display. The access strictly necessary to display the content you requested is governed by Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

As no additional services requiring consent are used, no cookie consent banner is provided. Should such services be added, they will only be activated after the required consent has been given, and this policy will be updated beforehand.

5. External links and app stores

External sites are opened via ordinary links. Merely displaying them does not embed any content from the respective provider. When you follow a link, the destination site processes the data arising from the visit under its own responsibility. Please refer to the privacy information there. This website is configured not to transmit a referrer when you leave it.

If a download is not available, a notice opens within this website. A store is only opened via an external link that has actually been added.

6. Your rights

Subject to the respective statutory conditions, you have the right of access to your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on your consent, you can withdraw it at any time with effect for the future. Processing carried out before the withdrawal remains unaffected.

To exercise your rights, contact hallo@peekami.com or the postal address given above.

Right to lodge a complaint

Under Art. 77 GDPR you can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for private companies in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA).

7. Automated decisions

The website uses no automated decision-making with legal or similarly significant effect and no profiling within the meaning of Art. 22 GDPR.

8. Peekami app and relay service

This section covers the Peekami app on iOS, iPadOS, Android, macOS and Windows and the relay service we operate. The controller is the provider named in section 1. No data protection officer has been appointed.

8.1 In brief

• No account. You never enter a name or e-mail address. Your devices recognise each other by a random device identifier.
• No recording. Video and audio travel encrypted between your devices, directly or via our relay server. We store no video or audio recordings. A photo is only taken when you tap for it and stays on your device.
• No ads, no tracking. The app contains no third-party analytics or advertising tools. Of Firebase, only the notification service (Cloud Messaging) is included.
• Delete in the app. "Settings → Delete device access & pairing" removes your device data from our server.

8.2 Device identifier and device secret

On first launch the app generates a random device identifier and a device secret. The secret stays in your device's protected storage (keychain or keystore). Our relay service stores the identifier and only a SHA-256 hash of the secret to recognise your device on each connection. Purpose: recognition without a user account and protection of the pairing. Legal basis: Art. 6(1)(b) GDPR. Retention: until deleted in the app, at the latest 90 days after the device's last connection.

8.3 Pairing

To connect two devices, the camera generates a one-time eight-digit code (also as a QR code). The code exists only in our server's memory, is valid for five minutes and is deleted after use, replacement, camera stop or loss of connection. After pairing, the server stores a pairing identifier, the device identifiers and roles (camera, viewer). Legal basis: Art. 6(1)(b) GDPR. Retention: until "Unpair devices" (Settings), device deletion or 90 days of inactivity.

8.4 Connection setup

The app keeps an encrypted WebSocket connection (WSS) to our relay service, which forwards connection states and the WebRTC connection descriptions and network candidates between your devices. These candidates contain IP addresses and ports; the server only forwards them. Your IP address is held in memory for at most 60 seconds to limit connection and message rates. We keep no access logs. Technical error and warning messages of the proxy, relay and TURN server may contain IP addresses; they are written to size-limited log files (at most 15 MB per service) that are continuously overwritten. Legal basis: Art. 6(1)(b) GDPR (connection setup) and Art. 6(1)(f) GDPR (operational security; our legitimate interest in a stable, abuse-free service).

8.5 Video and audio

Video and audio are transmitted with WebRTC encryption (DTLS-SRTP). A direct connection is attempted first. If it fails, our TURN server forwards the encrypted packets; it cannot decrypt or store them. Your app receives short-lived credentials for this (valid for one hour). Noise detection and, if unlocked, motion detection run only on the camera device; only the alert is transmitted, never a recording. Legal basis: Art. 6(1)(b) GDPR. No storage; real-time processing only.

Photo from the live view. When you tap "Photo" on a viewer device, the app creates a single image of the current live picture with a small Peekami mark. This happens only on your device and only on that tap; nothing is sent to our server. The image is briefly kept in the app's temporary storage, handed to your operating system's share sheet and then deleted. What you do with it afterwards (save it, pass it to another app) is up to you and subject to that app's terms. To save it to the photo library, iOS asks once for the "Add Photos" permission. Keep in mind that other people may be visible in the photo.

8.6 Event history

The relay service stores, per pairing, events with type (noise, motion, camera offline), time and duration, without images, audio or location data. Legal basis: Art. 6(1)(b) GDPR. Retention: up to 24 hours without active Plus access, up to 30 days with active Peekami Plus, at most 1,000 entries per pairing. The camera can clear the history at any time; "Unpair devices" and device deletion remove it immediately.

8.7 Alerts and push notifications

If you turn on "Notifications" on a viewer device, the app sends a push token and the selected app language to our server. On an event, our server sends a short, generic notification (such as "A noise was detected.") with an event identifier to your platform's push service:

• Google Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for Android and, as an intermediary, for Apple devices,
• Apple Push Notification service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland) for iOS, iPadOS and macOS.

The push service receives the token, notification text and event identifier, no video or audio. Windows devices receive notifications only while the app is running. Legal basis: Art. 6(1)(a) GDPR (consent by turning on notifications, revocable at any time in the app or in system settings). Retention: the token is deleted immediately on deactivation or device deletion, otherwise after 90 days of inactivity.

8.8 Technical transmission diagnostics

To assess connection quality and operating costs, the app reports technical measurements: pairing and session identifier, role, transferred data volume, timestamps, connection path (direct or relayed), reconnections and error events. No content, no location, no device names. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable and economically operable service); you may object. Retention: 14 days; longer term only aggregated figures without device or pairing reference.

8.9 Purchase of Peekami Plus

The purchase is processed by the respective store (Apple App Store, Google Play). We receive no names, addresses or payment data. The app sends the store's purchase confirmation to our server, which verifies it with the store operator. We store the transaction identifier, store, product, pairing and device identifier, time of purchase, any revocation or refund, and a hash of the confirmation. The store operators notify us of subscription changes. We verify and store the current entitlement, expiry and verification time so that trials, renewals, cancellations, expiry and refunds determine access correctly. The purchase confirmation itself is not stored. Legal basis: Art. 6(1)(b) GDPR, for retention Art. 6(1)(c) GDPR. Retention: 24 months after purchase or revocation.

8.10 Data that stays on your device

Settings, the device secret and the server address stay on your device. A diagnostic summary ("Copy diagnostics") leaves your device only if you send it to us yourself; the same applies to photos from the live view (section 8.5). Camera, microphone, notification and photo library permissions are granted through the operating system.

8.11 Recipients and third countries

The relay and TURN server run on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in Germany, as a processor under Art. 28 GDPR. A daily backup of the server database (without video or audio), encrypted before upload, is stored in Cloudflare R2 with EU jurisdiction; Cloudflare cannot decrypt it. Backups are deleted after seven days. Push notifications are delivered by Google and Apple; data may be processed in the USA. Google LLC and Apple Inc. are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the EU Standard Contractual Clauses (Art. 46 GDPR) apply in addition. Purchases are processed by Apple and Google as independent controllers. We do not pass on data for advertising and do not sell data.

8.12 Your rights without an account

Your rights under section 6 also apply to the app. Because we store no names or e-mail addresses with devices, we can match a request only if you give us the device identifier from the app (Settings → Help & diagnostics). The easiest way to delete is in the app itself. Uninstalling does not delete server data; it is removed after 90 days of inactivity. Peekami is not directed at persons under 16. Questions: hallo@peekami.com.