Privacy Policy

Version V1.2 (English translation of the Chinese original) · Effective: 29 September 2026 · Last updated: 6 October 2026

This translation is provided for reference only. If any discrepancy, inconsistency or conflict exists between this translation and the latest updated Chinese version (including due to delays in translation), the Chinese version shall prevail.

In one sentence: we collect only the minimum information needed to run “photo → bead pattern”. Your original images and patterns are used solely to provide the Service to you; we do not sell your personal data; all payment information is handled by a licensed third-party payment provider and we do not retain card numbers. Your data is stored primarily in Singapore. Please read carefully Clause 5 (third-party services and data flows), Clause 7 (storage location and international transfers), Clause 10 (protection of minors), Clause 11 (your rights) and the regional appendices at the end.

This Privacy Policy is issued by Peko (“we”, “us”) and explains how we collect, use, store, share and protect your personal information when you use the Peko perler bead pattern generator (the “Service”). Stopping use of the Service, or closing your account, is the exit that ends our processing of your personal information.

01Scope

This Policy applies to the Service’s web and PWA. The Service may link to third-party websites; how those third parties collect your information is not governed by this Policy — please refer to their own policies.

02Information We Collect

We collect only what is necessary for the scenarios below, and no sensitive personal information unrelated to the Service (such as biometric data or precise location).

Account information: the email address, nickname and avatar you provide when registering; where you sign in with a Google account, the email, name and avatar obtained from Google with your authorisation. Sign-in credentials are encrypted and hosted by the authentication service (Supabase Auth); we never see your password in plain text.
Content data: images you upload (compressed on upload to a maximum long edge of 1600 pixels, to control size and transfer safety), the pattern data generated from them, the project files you edit and save, and the content you voluntarily publish to the Community Wall together with interaction records (likes, comments, reactions).
Transaction information: your plan type, subscription status and transaction order identifiers. Card and other sensitive details required for payment are collected and processed by the payment provider (Creem); we never access or store your full card number.
Service logs: to keep the Service secure and to troubleshoot faults, Cloudflare automatically records access logs (IP address, User-Agent, request time and the like). We do not enable cross-site behavioural tracking and we do not integrate advertising tracking networks.
Feedback: content you send to our contact email address, including contact details you choose to provide.

03Local Storage and Similar Technologies

The Service mainly uses browser localStorage / caches to store your preferences (language, sound on/off), session state and local copies of patterns. This content stays on your device and is deleted when you clear your browser data.

To support the “add to home screen” offline experience, the Service registers a Service Worker that caches static resources.

We use cookies only within the scope necessary (for example to maintain the sign-in session) and set no advertising cookies.

04Purposes of Processing and Legal Basis

Providing core functionality: generating patterns by pixelation, editing, export and AI-assisted processing (performance of your service request / contractual necessity);
Account system: sign-in, security verification, entitlement and quota determination (contractual necessity);
Community display: showing content you voluntarily publish to other users at your instruction (your consent and the contractual arrangement);
Security and compliance: preventing abuse, fraud and infringement; to discharge the content obligations in Clauses 3 and 8 of the Terms of Service we may apply automated safety screening to images (legitimate interests and legal obligation);
Improving the experience: aggregated usage statistics that cannot identify you (legitimate interests).

Before using information for any purpose beyond those listed above, we will obtain your consent separately.

05Third-Party Services and Data Flows (Important)

To deliver the complete Service, the steps below are handled by the corresponding third parties. We integrate only the downstream services necessary to provide the functionality, and require them to act on our processing instructions.

Provider / role	Data involved	Purpose
Supabase account authentication, database and file storage	Email, nickname, avatar; pattern project data; images you upload and content you publish	Account system and cloud storage, enabling sync across devices
Cloudflare Pages hosting and CDN	Access logs (IP, User-Agent, etc.)	Content delivery and security protection
Volcengine AI image capability	When you voluntarily use the AI features, the relevant image is transferred to its interface for processing	Image enhancement, background removal
Creem payment provider	Order information; payment-instrument details are collected directly by them	Payment acceptance, subscriptions and invoicing
Google third-party sign-in	Basic Google account information you authorise	Convenient registration and sign-in

Other than in the table above, we do not provide personally identifiable information to any other third party, except where required by law or where we have your consent.

06Sharing, Transfer and Public Disclosure

We do not sell your personal information, and we do not share it for advertising purposes.

Content you voluntarily publish to the Community Wall is disclosed by you to all users of the platform; please consider this before publishing (including background details visible in your images).

In a merger, acquisition, asset transfer, or where judicial or regulatory authorities compel disclosure, we will act as the law requires and, unless prohibited, notify you in advance where practicable.

07Storage Location and International Transfers

Your personal data is primarily processed and stored on cloud servers located in Singapore (the database and account authentication services are deployed in the Singapore region); static site resources are distributed through Cloudflare’s global edge network, cached according to proximity; payment transaction data is processed within the infrastructure of the licensed payment provider Creem and its compliant channels; when you voluntarily use the AI features, the relevant images are transmitted to our AI service provider (whose servers are located in mainland China) solely to complete that processing.

Accessing the Service from a jurisdiction outside Singapore involves cross-border data transfers that are necessary to provide the Service to you. In that respect:

If you are located in the European Union / European Economic Area / United Kingdom: transfers to Singapore and elsewhere rely on the European Commission’s adequacy decision or on Standard Contractual Clauses (SCCs) and other regulator-recognised lawful mechanisms (see regional appendix A);
If you are located in mainland China: the Service stores your personal information outside China, which constitutes a cross-border provision of personal information; by using the Service you acknowledge and consent to such transfer;
Other jurisdictions: we will perform our notification or consent obligations as local law requires.

Wherever the data is located, we will use contractual arrangements with our providers and technical measures to ensure a level of protection equivalent to that described in this Policy.

08Security Measures

HTTPS/TLS encrypted transmission across the entire site;
Row-level security (RLS) enabled on the database, so that by default each user can read and write only their own data, with family sharing and co-building opened only within the scope you authorise;
Keys and credentials are never placed in front-end code or chat windows; server-side secrets are stored encrypted;
Least-privilege access and access auditing.

Please understand that no internet service can be absolutely secure. In the event of a personal information security incident, we will notify you and report to the regulators promptly as required by law.

09How Long We Keep Information

Account information: retained until you close your account; after closure we delete or anonymise it within a reasonable period, except where retention is required by law.

Patterns and content data: retained until you delete them. If you are inactive for a long period we may notify you and then clean up, to avoid indefinite retention.

Transaction records: kept for the periods required by tax and accounting law.

Browser-local data: you may delete it at any time by clearing your browser data.

10Protection of Minors

The Service is designed for a general audience and is not directed at children. Whether a minor may use the Service without parental consent depends on the law of your jurisdiction:

Mainland China: children under 14 must be accompanied by a guardian who consents and acts on their behalf;
European Union / United Kingdom: the digital age of consent is generally 16 (some member states set 13–15; local law governs); below that threshold parental consent is required;
United States: protected by COPPA — we do not knowingly collect personal information from children under 13;
Singapore and other jurisdictions: handled according to the local digital age of consent and capacity rules.

We do not knowingly collect personal information from minors without authorisation.If a guardian discovers that a minor has submitted personal information without consent, please request deletion through the contact email in Clause 13; once verified we will delete the relevant data promptly and apply restrictions to the account.

11Your Rights

To the extent permitted by applicable law, you may submit the following requests to us, and we will respond within 15 business days:

Access and copy: obtain a copy of the personal information we hold about you (request it via the contact email in Clause 13; we provide it after verifying your identity);
Correction and completion: edit it yourself in account settings, or contact us to handle it;
Deletion: delete content or close your account;
Withdrawal of consent: withdraw consent to a specific processing activity (withdrawal does not affect processing already lawfully carried out before it);
Account closure: contact us to proceed; closure stops processing and starts the deletion process.

We may ask you to verify your identity when you exercise these rights. If you are located in the European Union / European Economic Area, you also have the right to lodge a complaint with a supervisory authority.

12Updates to this Policy

We may update this Policy from time to time; the new version and its effective date will be published on this page. Where material changes are made to purposes, methods or third parties, we will additionally notify you in a prominent manner such as an on-site announcement.

13How to Contact Us

Data protection contact / channel: [email protected].
We will respond to your request within 15 business days. If you are dissatisfied with our response, you may also complain to a competent supervisory authority.

Regional Appendices

These appendices supplement the main text and apply to users in the relevant jurisdictions; where an appendix differs from the main text, the appendix prevails. We provide access to users worldwide; apart from the jurisdictions listed below, the mandatory data protection rules of your location also apply and take precedence.

Appendix A · European Union / EEA / United Kingdom (GDPR / UK GDPR)

Purposes and legal bases: performance of a contract — account registration, pattern generation/editing/export, cloud storage and sync; your consent — publishing content to the Community Wall, and acknowledgement and consent to international transfers of your data; legitimate interests — security protection, fraud and abuse prevention, anonymised product analytics; legal obligation — retention of tax and accounting records and co-operation with law enforcement.
Additional rights: in addition to Clause 11 of the main text, you have the right to restriction of processing, the right to object, and the right to data portability, as well as the right not to be subject to a decision based solely on automated processing (the Service does not carry out automated decisions producing legal effects on you).
Safeguards for transfers: if you are in the EU/EEA/UK, our transfers of data to Singapore and elsewhere rely on the European Commission’s adequacy decision or the Standard Contractual Clauses (SCCs) and other lawful mechanisms (Clause 7 of the main text).
Complaints: you may lodge a complaint with the data protection supervisory authority of your habitual residence or where our establishment is located; you are also welcome to contact us first through the channel in Clause 13, and we undertake to handle the matter within the statutory period.
Data controller: Peko, contact [email protected].

Appendix B · United States (California CPRA and other applicable state privacy laws)

No sale, no sharing: we do not sell your personal information and do not share it for cross-context behavioural advertising; we do not process sensitive personal information to advertise or for any purpose other than providing the Service.
Do Not Track: the Service does not respond to browser DNT signals; because we deploy no cross-site tracking, our actual processing is consistent with mainstream privacy browser settings.
Rights: the right to know / access, the right to delete, the right to correction, the right to limit certain sensitive uses and targeted advertising, and the right to non-discrimination for exercising these rights. You may act through an authorised agent, and we may request proof of that authorisation.
Categories collected: identifiers (account information), commercial information (transaction records), internet activity (logs), visual images (content you upload), and other information presumed linkable to you — see Clause 2 of the main text.

Appendix C · Singapore (PDPA)

We discharge our purpose notification and consent obligations through Clauses 4 and 5 of the main text; you may withdraw consent through the channel in Clause 13, in which case we will inform you of the service limitations that follow (for example loss of cloud features) and handle the relevant data in accordance with the PDPA.
We have appointed a Data Protection Officer as the PDPA requires; contact: [email protected].

Appendix D · Other Jurisdictions

If the law of your place of residence grants you a higher standard of consumer or data protection rights (including but not limited to correction, deletion, portability and complaint channels), that law prevails, and nothing in this Policy excludes such mandatory rights.