Pacelli privacy policy

Who is responsible

Pacelli is a personal project. Its developer, Juan Carlos Celis Pinto, is the controller of the personal data described in this policy. There is no company behind the app.

For anything about your data, write to hello@pacellilabs.com.

The short version

• No advertising, no analytics, no tracking across apps or websites, and no selling or sharing of your data for marketing.
• What you write in Pacelli and the photos you attach are encrypted on your iPhone before they are uploaded.
• That encryption keeps the database unreadable to anyone who reaches it, but it does not stop the developer. The household key is stored wrapped with a key derived from your account identifier, so the developer could unwrap it. Keys that only your devices hold are being built, and this policy will change when they ship. Until then, do not put anything in Pacelli that you would not want the developer to be able to read.
• If you connect an AI assistant, our server decrypts your household content for that assistant's requests while it is connected.

Your account

If you use Pacelli as a guest, Firebase Authentication creates an anonymous account identifier. If you sign in with Apple, Google or email, it also stores your email address and the sign-in method, and processes technical data such as your IP address to keep sign-in secure. If you use Sign in with Apple and hide your email, Pacelli only receives Apple's relay address. Your display name is encrypted before it is stored.

Why: to give you an account, keep your household in sync across your devices and limit access to its members. Legal basis: providing the service you asked for (Article 6(1)(b) GDPR).

Your household content

Tasks, checklists, plans, the household manual and attached photos are stored so that every member sees the same household. These are encrypted with AES-256 on your device before upload:

• Task titles and notes, and subtask titles
• Checklist titles and item titles
• Plan titles, entry titles, labels and descriptions
• Category names, and checklist and plan item quantities
• Photos you attach, and the text your phone reads in them
• The household name and your display name

What is not encrypted

Some fields stay readable so the server can sort, query and enforce access rules. They contain nothing you write in free text:

• Dates and times, completion status and priority
• Category icons and colours, sort order and record identifiers
• Which household each record belongs to, and who its members are
• For an invitation, the email address you invite, so that person can be recognised when they sign in. Pacelli does not email them.

Photos

Location data is removed from a photo before it is stored. The text in a photo is read on your phone so you can search for it later, and what it reads is encrypted. No photo is sent to anyone to be analysed.

A readable copy of each photo stays on the phones in your household, in a Pacelli folder in the Files app, and is deliberately left out of iCloud backups. Legal basis for household content and photos: Article 6(1)(b) GDPR.

Notifications

Reminders for your own tasks are scheduled on your iPhone and never leave it.

If you turn on alerts for tasks that other members add, Pacelli stores a push token for your device. Alerts are delivered through Firebase Cloud Messaging and the Apple Push Notification service. An alert says that a task was added, and the task title travels encrypted and is decrypted on your phone.

Legal basis: your consent, given when you allow notifications and switch alerts on, and withdrawn when you switch them off (Article 6(1)(a) GDPR).

Connected AI assistants

You can connect an AI tool, such as an assistant on your computer, as a member of your household with a one-time pairing code. It then reads and writes through our server, which decrypts and encrypts on its behalf, so your household content passes through the server in readable form for those requests. What the assistant reads is received by that tool and its provider under their own terms. Disconnecting the assistant ends its access.

Legal basis: providing the service at your request (Article 6(1)(b) GDPR).

Feedback

Feedback you send from the app is encrypted on your iPhone with a separate key that only the developer holds, and is used only to fix problems and improve Pacelli. Legal basis: legitimate interests in maintaining the app (Article 6(1)(f) GDPR).

Keeping the service secure

Server rules let only signed-in members of a household read its records. Guest accounts that have not opened the app for 14 days are deleted automatically, unless their household is still in use by someone else, and photo uploads that never finish are removed after 14 days. Legal basis: legitimate interests in running a secure service and not keeping data nobody uses (Article 6(1)(f) GDPR).

What we do not do

• No advertising and no analytics or crash-reporting tools.
• No tracking across other companies' apps or websites.
• No selling or renting of personal data.
• No automated decisions that have legal or similarly significant effects on you.
• No use of your content to train AI models.

Who processes data for us

• Google, through Firebase: Authentication, Cloud Firestore (the database), Cloud Storage (photos), Cloud Functions (the server) and Cloud Messaging (alerts). Google acts as our processor under the Firebase Data Processing and Security Terms.
• Apple, for Sign in with Apple if you use it, and for the Apple Push Notification service.
• Google Sign-In, if you choose to sign in with Google.
• The provider of any AI assistant you connect, under that provider's own terms.

Where your data is stored

• The database is hosted in London, in the United Kingdom, which the European Commission recognises as providing adequate protection.
• Photos are stored in Belgium, in the European Union.
• Firebase Authentication and the server code run in the United States, so data is processed there when you sign in, sync, receive alerts or use a connected assistant. Google LLC is certified under the EU-U.S. Data Privacy Framework, and the Firebase terms include the European Commission's Standard Contractual Clauses.

How long we keep it

• Household content and photos: until you delete them, burn the household's data, or the household is deleted.
• Your account: until you delete it in Settings, Delete data.
• Guest accounts: deleted after 14 days without the app being opened, as described above.
• Push tokens and the feedback you sent: deleted automatically, within seconds, when your account is deleted, however that happens.
• Emails you send to hello@pacellilabs.com: see the website privacy notice.

Your rights

You can access, correct, export and delete your data, restrict or object to its processing, and withdraw consent at any time. In the app, Settings, Export data gives you a full copy as a JSON file, and Settings, Delete data lets you burn the household's shared data or delete your account. For anything else, write to hello@pacellilabs.com. We answer within one month and do not charge for it.

Complaints

If you think your data has been mishandled, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where the problem happened.

Children

Pacelli is designed for adults managing a household. If you are under 16, use it only with the permission of a parent or guardian. If you believe a child has given us personal data without that permission, write to us and we will delete it.

Changes

If this policy changes, the new version will be published on this page with a new date, and significant changes will be described in the app's release notes.

Contact

Questions about this policy: hello@pacellilabs.com. You can also read the Pacelli help page.