We cannot read your cards. They are encrypted on your phone before they are sent, and only the person you sent one to can open it. That is how the app is built, not a promise about our behaviour.
We can see that a card went from one account to another, and when. We cannot see what it said.
Card contents are end-to-end encrypted. The keys that open them are made on your device and stored in your iOS Keychain, synced between your own devices through iCloud Keychain — which is itself encrypted against Apple. They are never uploaded to us and there is no way for us to recover them.
Encrypted the same way, and equally unreadable by us:
Cards you are working on are never sent to us. Drafts are stored on the device and are not backed up to us.
A card sent by link is encrypted too. The key travels in the part of the
web address after the #, which browsers never send to a
server — so we hold the sealed card and never the key to it, unless
somebody who has the link reports it (below).
If somebody sends you a card and you report it, the report includes that card's message so a person here can read it. Your phone decrypts it to include — because only you can — and the app tells you that is what is happening at the moment you report.
A card shared by link can be reported from the page it opens on, by whoever has the link — no account is needed. That report includes the link itself, key and all, so a person here can open that one card, photos included, just as you saw it. Nothing about you is sent with it. The link opens only that card, and only until it expires or is stopped.
This does not change what encryption protects you from. It protects your cards from us and from anyone watching the network. It has never protected a card from the person you chose to send it to, who could always repeat it, screenshot it, or show it to somebody. Reporting is that, made deliberate.
It happens nowhere else and is never automatic.
If a report suggests a crime, or that a child may be at risk, we may pass it to the police or the National Crime Agency, together with what we hold about the account that sent the card. The law requires us to report child sexual abuse to the National Crime Agency.
An honest list of what is stored unencrypted:
We don't make decisions about you by automated means that have legal or similarly significant effects.
If Pemba stops unexpectedly, it sends a report so the fault can be found and fixed. The report says where in the app it stopped, your phone model, which version of iOS it is running and which build of Pemba you had. It contains nothing from a card — no message, no names, no handles, and nothing about who you write to. It carries no name or identifier of yours either.
These reports go to Google, who provide the tool that collects them (Firebase Crashlytics). It is the one thing in Pemba that tells anyone outside your phone anything about how you use it.
It is on to begin with, because a crash on somebody's first day is the one most worth seeing and the one least likely to be reported by hand. You can turn it off whenever you like: Profile → Privacy → Send crash reports. Turning it off stops any further reports and deletes anything still waiting on your phone.
The database and the code that runs against it are in London (europe-west2), including account deletion. Sign-in and push delivery are Google services, and where those store their own records is Google's arrangement rather than ours.
Some of what Google and Apple do for Pemba — sign-in, push delivery, crash reports and App Store purchases — may happen outside the UK, including in the United States. Where it does, it is covered by the safeguards those companies provide under UK data protection law.
Photos you put in a card stay on your device and travel inside the sealed card.
Your phone's own backups. Cards you've received and sent, and your occasions, are kept readable on your phone so you can use them — so Pemba keeps them out of your phone's backups (iCloud Backup, or a backup to a computer), and no readable copy ends up there. On a new phone, sign in and Pemba brings them back from its own sealed backup. That needs iCloud Keychain switched on, so the key that opens them comes with you.
Drafts are included in your phone's backups, because they are the only copy of your unsent work. Those backups belong to your Apple account and follow Apple's rules, not ours.
Nobody else. There is no payment processor of ours — purchases go through Apple — no support-desk software, and no third-party service that receives anything about you.
Stamps are bought through the App Store. Apple takes the payment and we never see your card details. We keep a record of each purchase — Apple's transaction id, what was bought and when — so that the same purchase cannot be claimed twice.
You can delete your account from your profile in the app. It removes your profile, keys, saved handles, occasions, push tokens, stamp balance, handles, your mailbox and sent archives, your blocks and allow list, and every card sent to or from you that nobody has collected.
Three things outlive it, and each for a stated reason:
One consequence worth knowing before you delete: cards sent to you that you have not opened become permanently unopenable, because the key that opens them is destroyed with the account.
You can delete your account and everything under it from inside the app, at any time, without asking us. You also have the right to:
To use any of these, email pembaapp@gmail.com. We'll reply within one month. Because your cards are encrypted, what we can give you is the list under "What we do hold" — we have no way to read the rest.
If you're unhappy with how we've handled your personal information, tell us first: email pembaapp@gmail.com with "Data protection complaint" in the subject. We'll acknowledge it within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint.
Pemba is not intended for children under 13.
If this policy changes in a way that matters, we will say so in the app rather than only here.
Pemba is run by Kevin Bazan Valencia, a sole trader in the United Kingdom, who is responsible for your personal data (the "data controller"). Registered with the Information Commissioner's Office, registration number ZC259654.
Contact: pembaapp@gmail.com, or see the support page.