privacy policy

Last updated: June 2026

This privacy policy explains how Pebble ("we", "us", "our") collects, uses, and stores your personal data when you use pebble.eu.com ("the Service"). This policy complies with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Cookie and device-access matters are governed by the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Who is responsible for your data?

Data controller:
Dani Kabbani
Krampenburger Weg 47L
Berlin, Germany
d.kabbani04@gmail.com

2. What data we collect and why

2.1 Visiting the website

When you visit pebble.eu.com, Vercel Analytics collects anonymised usage data including page views, referrer, and device type. This is collected without cookies and without personal identifiers. Legal basis: our legitimate interest in understanding how the Service is used (Art. 6(1)(f) GDPR).

2.2 Waitlist

If you submit your email address to join the waitlist, we store that email in our database (Supabase, EU region). We use it only to notify you about access to the Service. Legal basis: your consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time by contacting us.

2.3 Prompt analysis

When you use the linter, the prompt text you submit is sent to our API and processed by Anthropic's Claude model to generate feedback. Prompt text is not permanently stored unless you are signed in to an account (see 2.5). Anthropic processes this data as a processor on our behalf and under their own terms.

2.4 Feedback

If you submit a thumbs up or thumbs down rating, we store your rating, the associated prompt text, and any optional comment you provide. This is used to improve the Service. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

2.5 User accounts

When you create an account, we will store the following data:

  • Your email address
  • Your display name (if you provide one)
  • Your profile photo (if you upload one)
  • Your prompt history (the most recent analyses and generated prompts associated with your account)
  • Your account creation date

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Account features are optional; the Service can be used without an account.

Your prompt history is limited to your 10 most recent analyses or generated prompts. Older entries are automatically replaced as you use the Service. Prompt history may include any text you submit, which could include sensitive or confidential information if you choose to include it in a prompt — we do not review, moderate, or filter the content of stored prompts.

2.6 Payments

Where the Service offers paid features, payment processing will be handled by a third-party payment provider. We will not store your full payment card details on our own systems. Details of the payment provider and the data they process will be described here once paid features are made available.

2.7 Cookies and device storage

The Service does not currently use tracking or marketing cookies. Vercel Analytics operates without cookies. Where you sign in to an account, a strictly necessary session cookie or token will be used to keep you logged in; under Section 25(2) TDDDG this does not require consent, as it is essential to provide a service you have requested. Should we ever introduce non-essential cookies or tracking technologies, we will request your prior consent through a consent banner before they are activated.

3. Data retention

  • Waitlist emails: deleted upon your request or when the waitlist is closed
  • Feedback entries: the rating may be retained in anonymised form to improve the Service; any data linked to an identifiable account is deleted within 60 days of account deletion
  • Account data and prompt history: if you request account deletion, your account is flagged for deletion and you have 60 days to cancel the request via your account settings. If not cancelled, your account and all associated data, including prompt history and your profile photo, are automatically and permanently deleted after 60 days.
  • Analytics data: retained by Vercel in anonymised form per their own policy

Anything associated with a specific account is deleted within 60 days of that account being deleted.

4. Who we share your data with

We use the following third-party processors:

  • Vercel (hosting and analytics) — servers in the EU and USA. Privacy policy
  • Supabase (database) — EU region. Privacy policy
  • Anthropic (AI processing) — prompt text is sent to Anthropic's API for analysis. Privacy policy

We have a data processing agreement in place with each processor, as required under Art. 28 GDPR. Anthropic's data processing terms, including standard contractual clauses for international data transfers, are incorporated into their Commercial Terms of Service.

We do not sell your data. We do not share your data with advertisers.

5. Your rights under GDPR

You have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict processing of your data
  • Data portability — receive your data in a machine-readable format
  • Object to processing based on legitimate interests
  • Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at d.kabbani04@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Berlin data protection authority:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin
datenschutz-berlin.de

6. Data security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls on our database, and restricting access to personal data to what is necessary to operate the Service.

7. Changes to this policy

We may update this policy as the Service evolves, including when account and payment features are introduced. Material changes will be communicated via the website. The date at the top of this page reflects the most recent update.