Privacy policy

This policy explains how WebArtefacts Inc. (“Pebbles”, “we”, “us”) handles personal information in the Pebbles app on iPhone and the web, on this website, in support conversations and in our newsletter. It is written to meet Alberta’s Personal Information Protection Act (PIPA), Canada’s PIPEDA, Quebec’s Act respecting the protection of personal information in the private sector (Law 25) for people in Quebec, and, where they apply to you, the EU and UK GDPR and US state privacy laws such as the CCPA.

Who is responsible

WebArtefacts Inc., 2246 Bayview Drive SW, Airdrie, Alberta T4N 5B6, Canada, is responsible for your personal information.

The person in charge of the protection of personal information is Dereck Guay, Privacy officer. You can reach them at dereck.guay@webartefacts.com for any question, request or complaint about your personal information.

What we collect

When you create an account

• Your name, email address and password. We store the password only as a secure hash; nobody at Pebbles can read it.
• Your language, time zone and colour in the household, detected from your device and changeable in Settings.
• Your preferences: first day of the week, time format and which notifications you want.
• Your household: its name, time zone, invite code, and your role (owner or member).

What you add to Pebbles

• Lists, sections and tasks: titles, notes, due dates and times, priorities, who a task is assigned to, repeat rules, reminders and whether something is private to you.
• Calendars and events: titles, notes, locations, dates and times, repeat rules, reminders and who an event is for.
• Activity history: who created, completed, assigned, renamed or moved something, and when. Household members see it on each task.
• Notifications in your inbox, such as “Sophie assigned you a task”.

This content can mention other people, like your children, your doctor or your daycare. Please add only what your household needs to get things done, and don’t add sensitive information (such as health details) about anyone who hasn’t agreed to it.

When you invite someone

We use the email address you type once, to send the invitation. The email includes your name, your household’s name and its invite code. We don’t keep the address after sending, and we never write to that person again unless they join.

When you connect an outside calendar (optional)

• iCloud: your Apple ID email and an app-specific password you create for Pebbles. We never ask for your Apple ID password.
• Google: your Google account email, and access and refresh tokens that let Pebbles read and write your calendars.
• Sync details: which outside calendars and events match which Pebbles ones, the time of the last sync and any sync error.

Passwords and tokens for connected calendars are encrypted in our database.

From your devices

• A sign-in token for each device, with its kind (“iPhone” or “Web”) and when it was last used.
• A push notification token and platform, if you allow notifications.
• In a web browser where you allow notifications: its push subscription (an address at the browser’s push service and encryption keys), and the reminders it has coming up (title, text and time) until they’re sent.
• Technical logs on our servers (IP address, time, the request and any error), used only to keep Pebbles running and secure.

On this website, in support and in the newsletter

• Support requests: your name, email address, language and the messages we exchange.
• Newsletter: your email address, language, and when you confirmed or unsubscribed.
• Browsing: a session cookie and the details in our cookie policy. Our servers see your IP address and browser while you visit, to protect our forms from abuse.
• Visit statistics: to learn which pages of this website help people, we count visits ourselves, without cookies or anything stored on your device. For each page view we record the page, the site you came from, campaign tags in the link (like utm_source), your language, and your kind of device, browser and operating system. Your IP address and browser details are used only to compute an anonymous code that changes every day, so a visitor can’t be identified or followed from one day to the next; they are never stored. Browsers that send Do Not Track or Global Privacy Control aren’t counted. The app itself has no analytics.

What we don’t collect

Pebbles does not ask for or collect your location, contacts, photos, camera, microphone, health data from your devices, or advertising identifiers. We don’t use third-party analytics or advertising trackers, and we don’t track you across other companies’ apps and websites.

Why we use it

• To provide Pebbles (to perform our contract with you): your account, syncing your household’s lists and calendar between devices, reminders and notifications, and connected calendars you ask for.
• To keep Pebbles safe and working (legitimate interest): preventing abuse and fraud, fixing errors, securing accounts, and anonymous visit statistics to improve the website.
• To answer you (contract and legitimate interest): support requests and questions about your data.
• With your consent: the newsletter, push notifications, connected calendars and any optional cookie. You can withdraw consent at any time; this doesn’t affect what was done before.
• To follow the law (legal obligation): for example, keeping records we are required to keep or responding to valid legal requests.

We don’t use your household’s content to profile you, to advertise to you, or to train artificial intelligence models.

Who can see it

Your household

Everyone in your household sees the other members’ names, email addresses, colours and roles, and everything shared in the household: lists, tasks, calendars, events and activity history. They can also see which outside calendar accounts members have connected (the account email) and whether syncing works. Items you mark private are visible only to you.

People with your calendar subscription link

If you use the private calendar subscription link (.ics), anyone who has that link can see the household’s events. Treat it like a password. You can reset it in Settings at any time, which stops the old link.

Calendar services you connect

When a member connects iCloud or Google, Pebbles copies the household’s shared calendars and events (titles, notes, locations and times) into that member’s account, and keeps them in sync both ways. Those copies are then also governed by Apple’s or Google’s privacy policy. If the connection is removed, the copies already in the outside account stay there until the member deletes them.

Pebbles’ use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Our service providers

We rely on a few companies to run Pebbles. They may use your information only to provide their service to us, under contracts that require them to protect it:

Service	What it does	Where	Who
Amazon Web Services	Runs the Pebbles servers and databases that store your account and household data.	Canada	Everyone
Amazon Web Services (S3)	Keeps encrypted daily backups of the database, to recover from a failure.	Canada	Everyone
Resend	Delivers the emails we send: invitations, password reset links, support replies and the newsletter.	United States	Everyone
Expo (650 Industries, Inc.)	Delivers app updates and relays push notifications (the device token, and the title and text of the notification).	United States	Everyone
Apple Push Notification service	Delivers push notifications to your iPhone, if you allow notifications.	United States	Only if you turn it on
Browser push services (Google, Mozilla, Apple, Microsoft)	Delivers reminders to your web browser, even with no Pebbles tab open, if you allow notifications there. Your browser’s maker runs it (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). Reminders are encrypted so the service can’t read them; it sees your browser’s push address and when a reminder is sent.	United States	Only if you turn it on
Apple iCloud Calendar	Two-way sync with your iCloud calendars, if you connect an iCloud account.	United States	Only if you turn it on
Google Calendar	Two-way sync with your Google calendars, if you connect a Google account.	United States	Only if you turn it on

Other cases

We may disclose information if the law requires it, to protect someone’s safety, or as part of a merger or sale of Pebbles, in which case the new owner must respect this policy. We do not sell or rent personal information, and we don’t share it for targeted advertising.

Notifications on your lock screen

On iPhone, reminders are scheduled on your phone itself, so they work offline. They show the task or event title, its time and, for events, the location, and they can appear on your lock screen. You can change what iOS shows on the lock screen, or turn reminders off, in Pebbles’ Settings and in iOS Settings.

In a web browser where you allow notifications, the browser hands its upcoming reminders to our server, which sends each one at its time through your browser’s push service, so reminders arrive even with no Pebbles tab open. Reminders are encrypted on their way, so the push service can’t read them. A reminder about something done or deleted in the meantime isn’t sent. Signing out, or turning notifications off in the browser, stops them.

When someone assigns you a task, we send a push notification through Expo and Apple that contains their name and the task title.

Where your information is stored

Pebbles’ servers and backups are listed in the table above. Some providers are outside Canada, mainly in the United States. Before transferring personal information outside Canada (or, for people in Quebec, outside Quebec), we assess the protection it will receive, and we use contracts that require an equivalent level of protection. Information stored in another country can be accessed by that country’s authorities under its laws.

Your household’s data is also stored on each member’s devices so Pebbles works offline: in the app on iPhone, and in the browser’s storage for the web app. Signing out removes it from that device.

How long we keep it

Information	How long
Your account and household content	Until you delete it or your account
Items you delete (tasks, lists, events…)	30 days, so the deletion reaches every device, then permanently erased
Your account after you delete it	Erased within 30 days
Database backups	Rolled off after 30 days
Inbox notifications	2 months
Device sign-ins	Until you sign out, or after 90 days without use
Browser notification subscriptions	Until you sign out, or the browser ends them
Browser reminders waiting to be sent	Until sent, then deleted within 1 day
Server logs	14 days
Support conversations	24 months after the conversation is closed
Newsletter sign-ups never confirmed	30 days
Newsletter address after you unsubscribe	30 days
Proof of your cookie choices	24 months
Website visit statistics (anonymous)	13 months

When a member deletes their account, what they shared with the household stays with the household, without their name attached; what they marked private is deleted. We may keep information longer only when the law requires it.

How we protect it

Connections to Pebbles are encrypted (HTTPS). Passwords are hashed, connected-calendar credentials are encrypted, and on iPhone your sign-in is kept in the iOS Keychain. Access to our systems is limited to the people who need it to run Pebbles.

If a confidentiality incident creates a risk of serious injury, we will notify you and the Office of the Information and Privacy Commissioner of Alberta promptly, along with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec for people in Quebec, and any other authority the law requires, and we keep a register of incidents.

Your rights

Depending on where you live, you can:

• Access the personal information we hold about you, and learn how it’s used and who it’s shared with.
• Correct it. You can edit your name, email, colour and preferences in Settings.
• Export it in a structured, commonly used format (data portability).
• Delete it. You can delete your account in Settings, under Account.
• Withdraw consent for the newsletter (a link in every email), notifications (in Settings), connected calendars (disconnect in Settings) and optional cookies (cookie settings).
• Object to or restrict some uses, and ask us to stop using your information for a purpose you didn’t expect.
• Complain to the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec if you live in Quebec, or your local data protection authority.

To make a request, write to dereck.guay@webartefacts.com. We may ask you to confirm your identity, and we answer within 30 days. Requests are free. Residents of US states with privacy laws can use the same address; we don’t sell or share personal information, so there is nothing to opt out of.

Children

Pebbles is not meant for children, and you must be at least 16 to create an account. We don’t knowingly collect personal information from children. Parents often add tasks and events about their children; that information belongs to the household and is handled like the rest of your content. If you think a child has created an account, write to us and we will delete it.

Features that aren’t available yet

The Pebbles website describes a future paid Pro plan, and we may later add optional AI helpers. Neither exists yet. Before we launch any feature that processes your information in a new way (for example with an AI provider or a payment provider), we will update this policy, name the new providers, and ask for your consent where the law requires it. AI features will be optional.

Changes to this policy

We will post any change here with a new effective date. If a change matters, for example a new use of your information, we will tell you in the app or by email before it takes effect.

Contact us

Dereck Guay, Privacy officer
WebArtefacts Inc., 2246 Bayview Drive SW, Airdrie, Alberta T4N 5B6, Canada
dereck.guay@webartefacts.com

You can also reach us through support.