Legal documents
Privacy policy
Effective · Version 1.4
The short version
- Your lists, tasks and calendar are shared only with the members of your household, and with calendar services you choose to connect.
- We don’t sell your data, show ads, use third-party analytics or advertising trackers, or track you across other apps and websites.
- We never ask for your location, contacts, photos, camera or microphone.
- You can see, correct, export and delete your data. Deleting your account erases it from our servers within 30 days.
- Pebbles is for people 16 and older.
This summary helps you find your way. The full text below is what applies.
This policy explains how WebArtefacts Inc. (“Pebbles”, “we”, “us”) handles personal information in the Pebbles app on iPhone and the web, on this website, in support conversations and in our newsletter. It is written to meet Alberta’s Personal Information Protection Act (PIPA), Canada’s PIPEDA, Quebec’s Act respecting the protection of personal information in the private sector (Law 25) for people in Quebec, and, where they apply to you, the EU and UK GDPR and US state privacy laws such as the CCPA.
Who is responsible
WebArtefacts Inc., 2246 Bayview Drive SW, Airdrie, Alberta T4N 5B6, Canada, is responsible for your personal information.
The person in charge of the protection of personal information is Dereck Guay, Privacy officer. You can reach them at dereck.guay@webartefacts.com for any question, request or complaint about your personal information.
What we collect
When you create an account
- Your name, email address and password. We store the password only as a secure hash; nobody at Pebbles can read it.
- Your language, time zone and colour in the household, detected from your device and changeable in Settings.
- Your preferences: first day of the week, time format and which notifications you want.
- Your household: its name, time zone, invite code, and your role (owner or member).
What you add to Pebbles
- Lists, sections and tasks: titles, notes, due dates and times, priorities, who a task is assigned to, repeat rules, reminders and whether something is private to you.
- Calendars and events: titles, notes, locations, dates and times, repeat rules, reminders and who an event is for.
- Activity history: who created, completed, assigned, renamed or moved something, and when. Household members see it on each task.
- Notifications in your inbox, such as “Sophie assigned you a task”.
This content can mention other people, like your children, your doctor or your daycare. Please add only what your household needs to get things done, and don’t add sensitive information (such as health details) about anyone who hasn’t agreed to it.
When you invite someone
We use the email address you type once, to send the invitation. The email includes your name, your household’s name and its invite code. We don’t keep the address after sending, and we never write to that person again unless they join.
When you connect an outside calendar (optional)
- iCloud: your Apple ID email and an app-specific password you create for Pebbles. We never ask for your Apple ID password.
- Google: your Google account email, and access and refresh tokens that let Pebbles read and write your calendars.
- Sync details: which outside calendars and events match which Pebbles ones, the time of the last sync and any sync error.
Passwords and tokens for connected calendars are encrypted in our database.
From your devices
- A sign-in token for each device, with its kind (“iPhone” or “Web”) and when it was last used.
- A push notification token and platform, if you allow notifications.
- In a web browser where you allow notifications: its push subscription (an address at the browser’s push service and encryption keys), and the reminders it has coming up (title, text and time) until they’re sent.
- Technical logs on our servers (IP address, time, the request and any error), used only to keep Pebbles running and secure.
On this website, in support and in the newsletter
- Support requests: your name, email address, language and the messages we exchange.
- Newsletter: your email address, language, and when you confirmed or unsubscribed.
- Browsing: a session cookie and the details in our cookie policy. Our servers see your IP address and browser while you visit, to protect our forms from abuse.
- Visit statistics: to learn which pages of this website help people, we count visits ourselves, without cookies or anything stored on your device. For each page view we record the page, the site you came from, campaign tags in the link (like
utm_source), your language, and your kind of device, browser and operating system. Your IP address and browser details are used only to compute an anonymous code that changes every day, so a visitor can’t be identified or followed from one day to the next; they are never stored. Browsers that send Do Not Track or Global Privacy Control aren’t counted. The app itself has no analytics.
What we don’t collect
Pebbles does not ask for or collect your location, contacts, photos, camera, microphone, health data from your devices, or advertising identifiers. We don’t use third-party analytics or advertising trackers, and we don’t track you across other companies’ apps and websites.
Why we use it
- To provide Pebbles (to perform our contract with you): your account, syncing your household’s lists and calendar between devices, reminders and notifications, and connected calendars you ask for.
- To keep Pebbles safe and working (legitimate interest): preventing abuse and fraud, fixing errors, securing accounts, and anonymous visit statistics to improve the website.
- To answer you (contract and legitimate interest): support requests and questions about your data.
- With your consent: the newsletter, push notifications, connected calendars and any optional cookie. You can withdraw consent at any time; this doesn’t affect what was done before.
- To follow the law (legal obligation): for example, keeping records we are required to keep or responding to valid legal requests.
We don’t use your household’s content to profile you, to advertise to you, or to train artificial intelligence models.
Who can see it
Your household
Everyone in your household sees the other members’ names, email addresses, colours and roles, and everything shared in the household: lists, tasks, calendars, events and activity history. They can also see which outside calendar accounts members have connected (the account email) and whether syncing works. Items you mark private are visible only to you.
People with your calendar subscription link
If you use the private calendar subscription link (.ics), anyone who has that link can see the household’s events. Treat it like a password. You can reset it in Settings at any time, which stops the old link.
Calendar services you connect
When a member connects iCloud or Google, Pebbles copies the household’s shared calendars and events (titles, notes, locations and times) into that member’s account, and keeps them in sync both ways. Those copies are then also governed by Apple’s or Google’s privacy policy. If the connection is removed, the copies already in the outside account stay there until the member deletes them.
Pebbles’ use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Our service providers
We rely on a few companies to run Pebbles. They may use your information only to provide their service to us, under contracts that require them to protect it:
| Service | What it does | Where | Who |
|---|---|---|---|
| Amazon Web Services | Runs the Pebbles servers and databases that store your account and household data. | Canada | Everyone |
| Amazon Web Services (S3) | Keeps encrypted daily backups of the database, to recover from a failure. | Canada | Everyone |
| Resend | Delivers the emails we send: invitations, password reset links, support replies and the newsletter. | United States | Everyone |
| Expo (650 Industries, Inc.) | Delivers app updates and relays push notifications (the device token, and the title and text of the notification). | United States | Everyone |
| Apple Push Notification service | Delivers push notifications to your iPhone, if you allow notifications. | United States | Only if you turn it on |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Delivers reminders to your web browser, even with no Pebbles tab open, if you allow notifications there. Your browser’s maker runs it (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). Reminders are encrypted so the service can’t read them; it sees your browser’s push address and when a reminder is sent. | United States | Only if you turn it on |
| Apple iCloud Calendar | Two-way sync with your iCloud calendars, if you connect an iCloud account. | United States | Only if you turn it on |
| Google Calendar | Two-way sync with your Google calendars, if you connect a Google account. | United States | Only if you turn it on |
Other cases
We may disclose information if the law requires it, to protect someone’s safety, or as part of a merger or sale of Pebbles, in which case the new owner must respect this policy. We do not sell or rent personal information, and we don’t share it for targeted advertising.
Notifications on your lock screen
On iPhone, reminders are scheduled on your phone itself, so they work offline. They show the task or event title, its time and, for events, the location, and they can appear on your lock screen. You can change what iOS shows on the lock screen, or turn reminders off, in Pebbles’ Settings and in iOS Settings.
In a web browser where you allow notifications, the browser hands its upcoming reminders to our server, which sends each one at its time through your browser’s push service, so reminders arrive even with no Pebbles tab open. Reminders are encrypted on their way, so the push service can’t read them. A reminder about something done or deleted in the meantime isn’t sent. Signing out, or turning notifications off in the browser, stops them.
When someone assigns you a task, we send a push notification through Expo and Apple that contains their name and the task title.
Where your information is stored
Pebbles’ servers and backups are listed in the table above. Some providers are outside Canada, mainly in the United States. Before transferring personal information outside Canada (or, for people in Quebec, outside Quebec), we assess the protection it will receive, and we use contracts that require an equivalent level of protection. Information stored in another country can be accessed by that country’s authorities under its laws.
Your household’s data is also stored on each member’s devices so Pebbles works offline: in the app on iPhone, and in the browser’s storage for the web app. Signing out removes it from that device.
How long we keep it
| Information | How long |
|---|---|
| Your account and household content | Until you delete it or your account |
| Items you delete (tasks, lists, events…) | 30 days, so the deletion reaches every device, then permanently erased |
| Your account after you delete it | Erased within 30 days |
| Database backups | Rolled off after 30 days |
| Inbox notifications | 2 months |
| Device sign-ins | Until you sign out, or after 90 days without use |
| Browser notification subscriptions | Until you sign out, or the browser ends them |
| Browser reminders waiting to be sent | Until sent, then deleted within 1 day |
| Server logs | 14 days |
| Support conversations | 24 months after the conversation is closed |
| Newsletter sign-ups never confirmed | 30 days |
| Newsletter address after you unsubscribe | 30 days |
| Proof of your cookie choices | 24 months |
| Website visit statistics (anonymous) | 13 months |
When a member deletes their account, what they shared with the household stays with the household, without their name attached; what they marked private is deleted. We may keep information longer only when the law requires it.
How we protect it
Connections to Pebbles are encrypted (HTTPS). Passwords are hashed, connected-calendar credentials are encrypted, and on iPhone your sign-in is kept in the iOS Keychain. Access to our systems is limited to the people who need it to run Pebbles.
If a confidentiality incident creates a risk of serious injury, we will notify you and the Office of the Information and Privacy Commissioner of Alberta promptly, along with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec for people in Quebec, and any other authority the law requires, and we keep a register of incidents.
Your rights
Depending on where you live, you can:
- Access the personal information we hold about you, and learn how it’s used and who it’s shared with.
- Correct it. You can edit your name, email, colour and preferences in Settings.
- Export it in a structured, commonly used format (data portability).
- Delete it. You can delete your account in Settings, under Account.
- Withdraw consent for the newsletter (a link in every email), notifications (in Settings), connected calendars (disconnect in Settings) and optional cookies (cookie settings).
- Object to or restrict some uses, and ask us to stop using your information for a purpose you didn’t expect.
- Complain to the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec if you live in Quebec, or your local data protection authority.
To make a request, write to dereck.guay@webartefacts.com. We may ask you to confirm your identity, and we answer within 30 days. Requests are free. Residents of US states with privacy laws can use the same address; we don’t sell or share personal information, so there is nothing to opt out of.
Children
Pebbles is not meant for children, and you must be at least 16 to create an account. We don’t knowingly collect personal information from children. Parents often add tasks and events about their children; that information belongs to the household and is handled like the rest of your content. If you think a child has created an account, write to us and we will delete it.
Features that aren’t available yet
The Pebbles website describes a future paid Pro plan, and we may later add optional AI helpers. Neither exists yet. Before we launch any feature that processes your information in a new way (for example with an AI provider or a payment provider), we will update this policy, name the new providers, and ask for your consent where the law requires it. AI features will be optional.
Changes to this policy
We will post any change here with a new effective date. If a change matters, for example a new use of your information, we will tell you in the app or by email before it takes effect.
Contact us
Dereck Guay, Privacy officer
WebArtefacts Inc., 2246 Bayview Drive SW, Airdrie, Alberta T4N 5B6, Canada
dereck.guay@webartefacts.com
You can also reach us through support.