The short version
- There is no account. A household is a six-digit code. Members are just a display name on a phone. We never ask for a password, phone number or date of birth.
- Email is optional. The person who runs the household can add one email address to recover the household after losing a phone. It is required only if you buy Pesterpop Plus.
- We store what the household types in: tasks, steps, points, who did what, and the photos you attach. That is the product.
- No tracking. There is no analytics SDK, no ad SDK, no crash reporter and no cookies on this website.
- Everything lives in the EU. Our servers, database and photo storage run on Google Cloud in the europe-north1 region (Hamina, Finland).
- You can leave any time. Leaving a household detaches your phone. Email us to have a whole household and its photos wiped.
What we don't collect
We never see or store any of the following, and the app does not ask for them:
- Passwords, phone numbers, real names, ages or birthdays.
- Location. The app has no location permission.
- Contacts, calendar, call logs or anything else from other apps.
- Payment details. Purchases go through Google Play or the App Store; we only learn that a household is subscribed.
- Advertising identifiers, device fingerprints or usage analytics.
- Audio recordings. Voice dictation gives us the text only, never the sound.
What we store
Everything below sits in one Postgres database that only our own server can reach. Photos are the exception, they go to a private storage bucket (see Where it lives).
| Thing | What exactly | Why |
|---|---|---|
| Household | An internal ID, the household name if you set one, the current invite code and when it expires, and when the household was created. | So members can find each other. |
| Owner email | One optional email address per household, plus the time it was verified. Only added when the household owner chooses “Protect your household”. | Household recovery after a lost phone, and the prerequisite for buying Plus. |
| Members | Display name, role (assigner or doer), platform (Android, iOS or web), app language, time zone, avatar colour and emoji, lifetime points, and how many free voice drafts have been used. | Showing who is who, nagging at sensible local hours, keeping score. |
| Device secret | Each phone holds a random secret that identifies it. We store only a one-way hash of it, never the secret itself. | Signing you in without an account. |
| Push address | The push token issued to the app by Expo, or for the web version the browser’s push subscription. Not linked to anything outside Pesterpop. | Delivering the nags. |
| Preferences | Nag intensity, quiet hours, which notification kinds are on. | Nagging the way you asked. |
| Tasks | Title, description, tone, points, real and displayed deadlines, status, who created, claimed, finished and approved it, steps, mercy requests, and timestamps. Recurring tasks store the same plus the schedule. | The product. |
| Photos | Pictures attached when creating a task or as proof of finishing it. Stored as files in a private bucket; the database keeps only the file reference. | Showing the mess, and the fixed mess. |
| Rewards | Rewards a household defines (name, emoji, point cost) and who redeemed what, when, and whether it was approved. | The reward store (Plus). |
| Notification feed | The title and text of each in-app notification, per member, and a log of which escalation step was sent when. | The in-app feed, and not sending the same nag twice. |
| AI counter | A number per household per day. | Enforcing the daily AI quota. |
| Magic-link tokens | When we send a verification or recovery email we store a one-way hash of the link token, the email it went to, and its expiry. | Making each link single-use and short-lived. |
| Subscription | Whether the household has Plus, through which store, which product, its status and when the current period ends. | Unlocking Plus features. |
Server logs
Our application log records, per request, the HTTP method, the path, the status code, how long it took and a random request ID. It does not record your IP address, device model or browser. Public endpoints such as joining a household are rate limited by IP address, but that count lives only in memory on the server and is never written down. Cloudflare sits in front of our servers and keeps its own short-lived access logs, which include IP addresses, for security and abuse prevention.
What stays on your phone
- Your device credential (the household ID, your member ID and the device secret) is kept in the phone’s secure storage: Android Keystore or iOS Keychain. In the web version it is in the browser’s local storage.
- Your theme choice (light, dark or automatic) is kept in the same secure storage.
- A cache of tasks and the feed so the app opens instantly. It is refreshed from our server and cleared when you leave the household.
Phone permissions
The app asks for each of these only at the moment you use the feature. Decline any of them and the rest keeps working.
| Permission | Used for | What we receive |
|---|---|---|
| Camera | Scanning a household invite QR code, and taking a photo to attach to a task. | QR scanning happens on the phone and nothing is saved. Task photos are uploaded to our bucket. |
| Photo library | Picking an existing picture to attach to a task. | Only the picture you pick. The app never scans your library. |
| Microphone and speech recognition | Dictating a task instead of typing it. | The phone’s own speech service (Google on Android, Apple on iOS) turns your voice into text on their terms. We receive the text only, and only if you go on to use the draft. |
| Notifications | The nags. | A push token that lets us reach this phone. |
Where it lives
Pesterpop runs on Google Cloud in the europe-north1 region, which is a data centre in Hamina, Finland. That covers the API server, the Postgres database and the storage bucket for photos. This website runs in the same place. Traffic reaches those servers through Cloudflare, which terminates TLS and filters abuse; Cloudflare relays requests but does not store your household data. Beyond that, data does not leave the EU except when it passes through one of the services listed in the next section.
The database is reachable only from our server on a private network. The photo bucket is private: the app uploads with a link that is valid for 15 minutes, and views photos with a link that is valid for one hour. Nobody can list or browse the bucket. Photo files are named by random ID and grouped by household, so a file name reveals nothing about the picture.
All traffic between the app, this website and our server is encrypted with TLS. Secrets such as device credentials and magic-link tokens are stored hashed, so a copy of the database could not be used to sign in as you.
Services we use
These are the outside companies that process some of your data on our behalf. We have listed what each one actually receives. None of them are allowed to use it for their own purposes.
| Service | What for | What it receives |
|---|---|---|
| Google Cloud | Hosting, database and photo storage in europe-north1 (Finland). | Everything in What we store, at rest in the EU. |
| Cloudflare | The network edge in front of our servers: TLS, DNS and abuse filtering. | Every request passes through it in transit, so it sees IP addresses and request metadata and keeps short-lived access logs. It does not store the contents of your household. |
| Expo (EAS) | Push notification delivery and over-the-air app updates. | For push: your push token and the text of each notification, relayed to Firebase Cloud Messaging on Android and Apple Push on iOS. For updates: the app’s platform and version, so it can be told whether a newer bundle exists. |
| Firebase Cloud Messaging (Google) and Apple Push | Final delivery of notifications to the phone. | The push token and notification text. On the web version the browser’s own push service does this job. |
| Resend | Sending the “confirm your email” and “recover your household” emails. | The owner email address, the subject line and the one-time link. |
| RevenueCat | Managing Pesterpop Plus subscriptions across Google Play and the App Store. | The household ID as its customer ID, the store purchase receipt, the app version, platform and OS version, device language, and the IP address the SDK connects from. It sends us the subscription status back. It never sees your email or your tasks. |
| Google Play and Apple App Store | Taking payment for Plus. | Whatever your store account already holds. Governed by Google’s and Apple’s own privacy policies. |
| Anthropic, OpenAI or Google (Gemini) | The AI features. One provider is active at a time. | See AI features below. |
| Google and Apple speech services | Voice dictation. | Your audio, handled by the phone’s built-in speech recognition. We never receive the audio. |
That is the whole list. There is no analytics provider, no advertising network, no crash reporter, no customer support widget and no social login.
AI features
Two features in the app call a large language model. They only run when you press the button.
- Break into steps sends the task title and description, and gets back a list of suggested subtasks.
- Voice draft sends the text of what you dictated, the display names of your household’s members (so “ask Mia to do it” can be matched to Mia), the current time and your time zone (so “Friday” means the right Friday). It gets back a suggested task.
The model never receives photos, email addresses, device credentials, household IDs or your history of tasks. Requests go to one of Anthropic, OpenAI or Google (Gemini) over their paid developer APIs, under terms that keep your content out of their model training. Free households have a daily quota, tracked as a single number per household.
Pesterpop Plus
Plus is bought inside the app through Google Play or the App Store, so we never handle card details. Before buying, the household owner has to verify an email address. That address is used for exactly two things: recovering the household after a lost phone, and proving who the subscription belongs to. We do not send newsletters or marketing to it.
Downgrading or cancelling does not delete anything. Plus only gates features; the household’s history stays where it is.
How long we keep things
| Data | Kept for |
|---|---|
| Tasks, steps, points, rewards | As long as the household exists, or until you delete the task. |
| Photos | While the task exists in the app. The files themselves are wiped from storage when the household is deleted. |
| Notification feed | 30 days. Older entries are deleted automatically every night. |
| Verification links | 24 hours, then they stop working. |
| Recovery links | 15 minutes, then they stop working. |
| Removed members | The phone is signed out immediately. The display name stays on past tasks so the history still makes sense; everything else about the member becomes unusable. |
| Application and edge logs | Rotated on our hosting provider’s and Cloudflare’s standard short retention. |
Leaving and deleting
- Leave a household from the Household screen. Your phone is signed out and your device credential is erased from the phone.
- Remove a member (assigners only) from the same screen. That phone stops working with the household immediately.
- Delete a task and its steps and photos disappear from the app with it.
- Delete a whole household by emailing [email protected] from the verified owner address, or with the household’s invite code if no email was ever added. It is a single operation on our side that removes every task, member, notification, reward, the owner email, the subscription record and every photo file in one go. We do it within 30 days and confirm when it is done. If the household has a Plus subscription, cancel it in Google Play or the App Store first; we cannot do that for you.
Kids
Pesterpop is built for families, so children use it. That is why members have no account: a child in the app is a display name, which can be a nickname, plus a role and a list of chores. We do not ask children for an email, a birthday or anything that identifies them outside the household. The household owner, an adult, controls who is in the household and can remove any member at any time.
Your rights
Pesterpop is made by Vidd Studio in Norway, and the GDPR applies to everything on this page. Our legal basis for storing household data is that it is what you asked us to do (performance of a contract). The optional owner email, push notifications and phone permissions are based on your consent, which you can withdraw in the app. Rate limiting and abuse prevention are based on our legitimate interest in keeping the service up.
You have the right to:
- See what we hold about you or your household, and get a copy of it.
- Correct anything that is wrong. Most of it you can edit in the app yourself.
- Have it deleted (see Leaving and deleting).
- Object to, or restrict, any processing you don’t agree with.
- Complain to a data protection authority. In Norway that is Datatilsynet; you may also use the one in your own country.
For any of these, email [email protected]. Because there are no accounts, we will ask you to prove you belong to the household, usually by writing from the verified owner email or by sharing the invite code from the Household screen.
Changes
If we add a service, start collecting something new, or move where data is stored, this page changes first and the date at the top moves. We will not quietly widen what we collect. Material changes are also announced in the app.
Last updated 9 September 2026.