PeanutStudy Privacy Policy

The short version. Players 13 and over sign in at the end of setup (with Apple, Google or a code sent to their email), so their progress is backed up to their account (see 12). Players under 13 never have an account. PeanutStudy does not track you across other apps or websites. In the iPhone and Android app, reward videos are optional and non-personalized, and in every version a few counts, tied to a random ID made on your device and never to your name, help us tune the app (both off under 13). The app (on iPhone, Android and the web) also sends a few usage events to PostHog (see 7). Your progress is saved on your device, and while you are signed in a copy of it is backed up to your account (see 12). A few optional online features (the live village, room visits, notes, gifts, friend invites and reminders) send a small, fixed set of details, listed below, to a server run for this app. Nothing you type is ever shown to people who do not have your friend code, and what you type as your task never leaves your device.

When this copy of the app has its server set up, the live village (where strangers see only your animal) and room sharing (friends with your code only) start switched on for people 13 and over. You can switch either off in Settings at any time. For anyone under 13 they are off and cannot be turned on.

1. Opening the app

Like any website, loading PeanutStudy asks our web host for the app’s files, including the 3D library, and Google Fonts for the Jua font. These services see your IP address and browser details as part of the request. PeanutStudy sets no cookies.

In the iPhone and Android app, the app's files, the font and the 3D library are inside the app, so opening it loads nothing from a web host. Opening the app also asks the App Store or Google Play (not our server) for prices and whether you are in Peanut Club. For people 13 and over it also sends the counts in 7, asks our server whether a purchase was refunded if you have bought something (see 8), and, once you have tapped to watch a reward video, starts Google's ads SDK (see 8). On the web and in the app alike, the counts in 7 are sent whether or not online features are on, and the app asks our web host for a small settings file that says whether this version still works and whether any feature is paused (it sends nothing about you beyond the request itself).

2. The live village (if switched on)

While the live village is on, this is shared through a realtime channel for the room you are in: one per place (a busy place opens a second room when the first is full), or your friends-only nook, which people join only with its link or an invite (it is not locked any other way, so share the link only with friends). No name or anything else you typed is in it:

• Always: two random IDs (one for the connection, and a live ID that is also stored in your shared room), the place and room you are in, and when you came into that room.
• While you focus or take a break: your animal's species and outfit, the spot you sit in, when your timer started and ends, the tag you picked if it is one of the built-in ones (such as "Study"; your own tags show as "Focusing"), your streak count, and whether you are on a break or paused.
• When you cheer someone: your live ID and your animal's species. When you say a phrase: only its number in the preset list.
• When you invite a friend to your place: your live ID, theirs, the place and, for a nook, its ID, sent to their app directly, on a channel named from their friend code. Their app ignores invites from anyone who is not in their friends list. If they turned on reminders, our server also sends them a notification that says only "A friend invites you" (see 5).
• When you start a timer together with friends in your room: a random ID for that start, its length, and who said they are ready.

How names work: people who are not your friends see you as your animal with a made-up name the app picks from your random live ID (for example "Mossy Duck"), never anything you typed. A friend who added your code reads your live ID from your shared room, and their app shows your name, from their own friends list. Removing a friend (Friends, the x next to them) shows them as their animal again.

The channels keep nothing. Separately, while the app is open (every 30 seconds while you focus, every 60 seconds otherwise, and not at all while the app is in the background and you are not focusing) the database records your live ID, the place and room you are in, and whether you are focusing (with a scrambled form of your device's secret token, so nobody else can use your live ID), and the country your connection comes from (two letters such as "DE", which our database host's network works out from the connection; we never store your IP address). The country is kept with your live ID, so we can see where people use the app. Once each start has loaded (13 and over only), the app also saves with your live ID which device it runs on, so when you tell us the app is slow or will not start we can see why: the operating system and browser and their versions, the graphics card name the browser reports, the number of processor cores, the memory size the browser reports, the screen size, the app version, your graphics switches (such as Lamp glow and Depth of field), whether the lighter graphics mode was on, how long loading took and whether the start before it froze. Never anything you type. It is replaced on the next start and deleted with your live ID. That is what shows how many people focus in each place, which of your friends are online, and how long a friend focused in the same room as you (for the friend bonus). Your friends' app asks by your friend code, so only people who have your code can see whether you are online and where; a friends-only nook is never named to anyone. These records are deleted after a day, the stretches of focusing time after two days, and the link between your live ID and the scrambled token a year after you last use the app. Friends-only nooks are not counted in the place totals.

Tapping someone in the live village shows "Hide" and "Report". Hide is kept only on your device: their live ID goes on a list there and you stop seeing them. Report opens an email to us (see 11).

Some of the animals you see focusing are not people: the app runs residents (with a leaf) and guests (who look like people focusing) to keep the town lively. They are made on your device, from the time of day, and nothing about you goes into them.

3. Sharing your room (if switched on)

A few seconds after you change your room, outfit or passport sharing, the app saves a copy of your room on the server, under your 6-letter friend code:

• The room: which furniture is where (piece, position, rotation), wall, wallpaper, floor and window view, how many days your garden has grown, and today's day number.
• You: your animal's name, species and outfit, your live ID (see above), your passport's issue date, how many passport parts you keep private, a small Peanut Club mark if you are a member, and only the parts you switched on in Passport, "Who can see this": handle, age, what you do, Soup Club, level and focus minutes with your best streak, wish, and goals. Age is never sent for anyone under 13.
• A scrambled (SHA-256) form of this device's secret room token, so only this device can change or delete the room. The token itself is never stored.

Only people who know your friend code can read this copy: your code is how friends add you, so share it only with people you know. It is kept until you delete it (see below).

When you visit a friend, the app reads their room by their code. While you are inside someone's room (or friends are inside yours), the app sends your animal's species and outfit, your live ID, whether it is the host, and where it walks or which furniture it uses. Other visitors see your name only if you are in their friends list. That live part is not stored.

4. Notes

Leaving a note sends your friend code, the friend's code and the note's number in the preset list (such as "Love your room!"). No name is sent: your friend's app shows your name if you are in their friends list, or "A friend" with your code. Notes are never free text. A note waits on the server until your friend's app collects it, then it is deleted. At most 30 can wait for one room.

5. Reminders on the web, while the app is closed (if switched on)

In the iPhone and Android app, reminders are scheduled on your phone as local notifications, and nothing in this section is sent. The one exception is the "Friends" reminder (13 and over): so a friend's note, invite or gift, or a thank-you for inviting a friend, can reach you while the app is closed, the app sends our server your phone's push token from Apple or Google, this device's secret token (kept only in scrambled form), your friend code, your time zone and your platform. Apple (APNs) or Google (Firebase Cloud Messaging) then delivers one of four fixed messages, never anything a friend typed: "A note in your room" (a friend dropped by and left a note), "A friend invites you" (come focus together), "A parcel came for you" (a gift, see 13) or "Your friend finished a focus" (a thank-you for an invite, see 14). Turning reminders or the Friends reminder off, or "Delete my data", deletes the push token from our server. For anyone under 13 nothing in this section is sent either: reminders only show while the app is open. On the web, when you turn reminders on and this copy of the app has a reminder server, the app sends:

• Your browser's push subscription: an address at your browser's push service (Google, Apple, Mozilla or Microsoft) and the keys to encrypt messages for it.
• This device's secret token, which the server keeps only in scrambled form.
• Your time zone name (for example "Europe/London").
• Your friend code, only while the "Friends" reminder is on, so a friend's note, invite or gift, or a thank-you for an invite, can send you a push.
• The plan for the next 7 days, up to 14 reminders: the kind, the time, and the exact text. That text is written on your device from your progress, for example "Your 5-day streak ends tonight", the length of the session you started, how far away your next D-day is ("Your big day is in 3 days", never the name you gave it), or that your daily parcel is waiting. It is signed with your animal's species ("Your shiba"). It never contains anything you typed.

The plan is sent again when it changes and when you leave the app. When a friend leaves a note, invites you or sends you a gift, or a friend you invited finishes their first focus, the server queues one of the four fixed messages above. Each reminder is encrypted for your browser before it goes to the push service, so the push service cannot read it.

How long it is kept: sent or expired reminders are deleted after 3 days. A device that has not checked in for 90 days is deleted with its plan. Turning reminders off deletes this device's subscription and plan right away.

6. Things you share yourself

Your invite link contains your friend code, your animal's name and species, and sometimes a place. Postcards, photo cards and record cards are images you share with your phone's share sheet. These go only to the people and apps you choose, and the web host sees an invite link's address when someone opens it.

7. Counts (13 and over)

To judge changes to the app (for example, which Peanut Club price works), the app sends a few counts to the same server: a random ID made on your device, which version of a test you were given, your platform, how many days since you installed, and events such as "finished a session" (with its length), "saw the Peanut Club page", "tapped a purchase" or "watched a reward video", each with its time and, where there is one, the product's ID and the gold peanuts involved. Never your name, friend code, task, tags or anything you type. The random ID is the same one your purchase records use (see 8), so these counts are not anonymous to us, though nothing in them says who you are. If you sign in, this random ID is saved in your account's backup with the rest of your save (see 12), so it is then linked to your account. Counts cannot be switched off apart from deleting your data; they are kept for 13 months, and "Delete my data" deletes them (new ones start from the next time you open the app). Players under 13 send none.

The app, on iPhone, Android and the web, also sends a few usage events to PostHog, so we can see how people use the app: opening the app, finishing the welcome, starting and ending a focus session (its length, mode and place), which panel you opened, the animals and shop items you look at, bring home, wish for or take with the Club gift ticket (the animal's or item's ID, its tier and price), the Peanut Club page and purchases (the product's ID), and reward videos. They carry a separate random ID made on your device, your platform, your animal, level and streak, how many focus sessions and minutes you have, and days since install. Never your name, friend code, task, tags or anything you type. PostHog stores them in the United States; we have it drop your IP address and do not use your location. None of these usage events are sent before the age question or for anyone under 13, and no replay of your screen is recorded. "Delete my data" and "Start over" throw away this ID and anything waiting to be sent. Events already sent stay in PostHog, under an ID nothing on your device points to any more.

Each time the app starts, it also sends PostHog one loading report, so we can fix starts that stall or freeze on computers we cannot test on: how far loading got and how long each step took, whether it finished, was left early or froze, the browser and its version, the operating system, the graphics card name the browser reports, the number of processor cores, the memory size the browser reports, the screen size, and whether the lighter graphics mode was on. If loading stops with an error message on screen, the report also carries that error as one short technical line (what went wrong and where in our code), with any web address in it cut down to its path. It is sent before the age question too, because loading comes first, but it has no ID that stays: every report gets a new random one, so reports cannot be tied to each other, to you or to the usage events above. It carries nothing from your save or anything you type, and it is not sent once your age is saved as under 13. If a start froze, the next start sends its report. The report is kept on your device only until it is sent.

8. Reward videos and purchases (iPhone and Android app, 13 and over)

Reward videos come from Google AdMob. Google's ads SDK starts the first time you tap to watch one; after that it starts when the app opens, so a video is ready when you want one. Where the law asks for it (for example in the EU and the UK), Google's consent form appears before the first video, and Settings has "Ad privacy choices" to change your answer. Ads are non-personalized: the app does not read your phone's advertising ID and never asks to track you. Google's SDK still collects device and usage details to show and measure the video (an app-specific device ID, your IP address for an approximate location, the ads you saw and how you interacted, and crash and performance data), as described in How Google uses information from sites or apps that use its services. On iPhone, RevenueCat also receives an attribution token from Apple (AdServices), which says only whether the install came from an Apple Search Ads campaign; it is not the advertising ID and needs no tracking permission. If you installed from a friend's invite, RevenueCat is told "Friend invite" as the source. Purchases are made through the App Store or Google Play; we receive no payment details, only whether a purchase went through. RevenueCat checks each purchase with the store for us and keeps who has Peanut Club. It starts only once you have picked an age of 13 or over, and knows you by a random ID it makes for this install (not the one from 7, not your name, not your advertising ID): it receives that ID, your purchases and subscription status, the store's receipts, your platform, app version, country or region from the store, and your IP address. Each purchase is recorded on the same server (a scrambled form of the random device ID, the platform, the store's transaction number, a scrambled form of Google Play's purchase token, the product and the gold peanuts it gave), so that if the store refunds it, the app can take those gold peanuts back the next time it opens. Nothing else is done with these records. They are kept for 400 days, longer than any store's refund window, and "Delete my data" does not remove them early, because a refund can still arrive. Peanut Club members see no videos. Players under 13 see no videos and cannot buy anything.

9. Moving to a new phone (only if you use it)

Settings, "Move to a new phone" makes a 12-letter moving code. Your whole save is encrypted on your device with a key made from that code, and only the encrypted copy is sent to our server, filed under a scrambled (SHA-256) form of the code. The server never sees the code itself, so it cannot read your save. Typing the code on your new phone fetches the copy and deletes it from the server at once. A copy nobody fetched is deleted after 7 days. Anyone who has your code within those 7 days can take your save, so keep it to yourself.

10. Crash reports (13 and over)

When the app hits an error it did not expect, it sends a crash report to Sentry so we can fix it: the error and where in the app's code it happened, the app version, your platform, your phone or browser model and system version, and the last screens and taps before it (never what you typed in them). No name, friend code, task text or account, and Sentry is told not to keep your IP address. Crash reports are kept for about 30 days. Players under 13 send none, and the app stops sending them the moment an age under 13 is picked.

11. Writing to us and reporting someone

"Contact us" in Settings, and "Report" on a neighbour or a friend, open an email in your own mail app, addressed to us, with the app version, your platform and, for a report, the other player's live ID or friend code filled in. Nothing is sent until you press send in your mail app. We use the email only to answer you and to look into the report, and delete it when that is done.

"Send feedback" in Settings sends your note straight to us from the app (not for players under 13). It carries the kind you picked, what you typed, the app's language, your platform and the app version, and, only if you leave the switch on for a problem, the app's error report. It carries no name, account, device ID or contact, so we cannot answer it or tell who sent it: please do not type personal details in it. We read notes to fix and improve PeanutStudy, and delete them after a year.

12. Signing in and backing up (only if you use it, 13 and over)

Players 13 and over are asked to sign in at the end of setup, right after making their passport (a player who moved in before this was added is asked at their next start). If the server cannot be reached, the app lets you go on and asks again later. You can sign in with Sign in with Apple, with Google, or with a 6-digit code emailed to you. The sign-in is handled by Supabase Auth on the same server, which keeps an account ID, your email address (with Apple this can be a private relay address that hides your real one), which way you signed in and when. If you use the email code, your email address is used only to send that code. Google can also provide a display name and a profile-picture link, which Supabase Auth keeps with the sign-in record. Your app passport still uses your animal, not that Google picture. We never receive your Apple or Google password, and the email code has no password at all. While you are signed in, the app backs up your whole save to your account: everything listed in "What stays on your device" (your animal, passport, sessions with their task text, tags, D-days, peanuts and gold peanuts, streak, room and settings), plus this device's secret token, live ID and the random ID the counts use (see 7), so that signing in on a new phone brings back your progress, your room and your friends. A short summary (name, animal, minutes, peanuts, gold peanuts and streak) is kept next to it so the app can ask which save to keep when two phones differ. Only you, signed in, can read the backup; nobody else, friends included, can. Signing out keeps the backup for the next time you sign in. "Delete my data" deletes the backup and the account itself. If you signed out on this phone first, sign in again so "Delete my data" can reach the backup. Players under 13 cannot sign in, and a save with an age under 13 is refused by the server. If the age on a phone that is signed in is changed to under 13, the account and its backup are deleted, and the save on the phone stays.

For Sign in with Apple, our server also keeps an encrypted authorization token so it can disconnect Apple when you delete your account. Only the server can read it. It is removed with your account, after Apple access is revoked.

13. Gifts to friends (if room sharing is on, 13 and over)

Sending a friend an outfit as a gift sends our server your friend code, your friend's code, which outfit it is and the number of the note you picked in the preset list (never free text), checked against this device's secret token. The server keeps those with when the gift was sent, when your friend's app collected it, when they said thank you and when your app saw the thank-you. If your friend turned on the "Friends" reminder, it also queues them the fixed push "A parcel came for you" (see 5). The server clears old gifts as new ones are sent and once a day: a thank-you once the sender's app has seen it (and the gift is a day old), an opened gift nobody thanked after 30 days, and any gift older than 60 days. "Delete my data" deletes every gift you sent or received.

14. Inviting friends (13 and over)

When a new device (in its first 7 days) comes in through a friend's invite link, or by typing their friend code in Friends, it sends our server this device's secret token (kept only in scrambled form) and the inviter's friend code. The server keeps those with a scrambled form of the inviter's room token, when the invite was taken, when this device's current focus started and when its first focus of 10 minutes or more finished, both by the server's own clock, and when each of you got the thank-you. Nothing anyone typed is stored, and nobody's contacts are read. When that first focus counts, the inviter's phone gets the fixed push "Your friend finished a focus" if their "Friends" reminder is on (see 5). An invite that never counts is deleted after 30 days, and a finished one a year after it finished. After that the server keeps only how many friends each friend code was thanked for (a number, nothing else), so a code is thanked for 10 friends at most, ever. "Delete my data" deletes this device's invites that are not finished and, for friends you invited, a finished one where only your own thank-you was still waiting. Any other finished invite stays until its year is up with this device's token removed (the inviter's friend code stays on it), so the other person still gets a thank-you that is waiting for them and their count of friends stays right.

15. Free trial consent in Korea (Peanut Club, 13 and over)

Korean law asks for a separate yes before a free trial turns into a paid plan. If you started a Peanut Club free trial through the Korean App Store or Google Play, the app asks during the trial whether to carry on, and sends our server your answer as the record of it: a scrambled (SHA-256) form of the random ID from 7, your platform, the product, the price shown, when the trial ends, your answer ("continue" or "cancel") and when you gave it. No name and no payment details. It is kept as the record of your answer for 3 years after the trial ends, then deleted automatically. The seller has to be able to show that this separate consent was asked and answered, so "Delete my data" does not delete the answer: it removes the scrambled ID from it, and what stays (platform, product, price, trial end, answer, when) cannot be linked to you or your device.

16. The waitlist (peanutstudy.app/waitlist, only if you join)

If you join the waitlist, we keep the email you type, the language your browser is set to, the country it was sent from (as our server's network provider reports it), and where you came from: the link's campaign tag, or the name of the website that sent you, never the page. We use your email only to tell you when PeanutStudy opens, and keep it until it opens or until you ask us to remove it, whichever comes first. To limit abuse, we count tries for a day under a scrambled (SHA-256) form of your network address, never the address itself.

We use these services only to run PeanutStudy, and we do not sell your data:

• Supabase: the database and realtime service for the online features, hosted in the EU (Ireland).
• Vercel: serves the website's files, and on the website counts page visits and website and web-app startup milestones with Vercel Web Analytics. These counts include the browser, operating system, country and device type. Startup events record a stage such as controls ready, poster fallback, or graphics context lost, and a broad timing range. They use no cookies and include no account, beta code, or graphics adapter identifier.
• Google Fonts: serves fonts on the website.
• PostHog: stores usage events and loading reports from the app on iPhone, Android and the web, in the United States (see 7).
• Google AdMob: shows reward videos in the iPhone and Android app, only when you tap to watch one. They are non-personalized.
• RevenueCat: checks purchases with the App Store and Google Play and keeps Peanut Club status, in the iPhone and Android app (13 and over).
• Sentry: receives crash reports (10), only for players 13 and over.
• Apple and Google: deliver friend pushes in the iPhone and Android app (APNs and Firebase Cloud Messaging), and handle purchases through the App Store and Google Play. We never see your payment details.
• Browser push services (Google, Apple, Mozilla or Microsoft): deliver web reminders, encrypted so they cannot read them.

We only use providers whose terms protect your data at least as strongly as this policy. Some of them may process data outside your country.

• Live village and room company: never stored. They disappear when you leave.
• Your shared room: until you delete it or turn off sharing.
• Live village records: where you were last seen, a day; your focusing stretches, two days; the link between your live ID and your scrambled token, a year after you last use the app (2).
• Notes: until your friend's app collects them, or until the room is deleted.
• Gifts: up to 60 days, and sooner once they are opened and thanked (13).
• Friend invites: 30 days for an invite that never counts, a year after it finished for one that did, then only a count of friends thanked for each friend code (14).
• Web reminders and push tokens: sent or expired reminders after 3 days, and a device that has not checked in for 90 days is deleted with its plan and push token.
• Counts: 13 months (7).
• Purchase records: 400 days, for refunds (8).
• Free trial answers in Korea: 3 years after the trial ends, unlinked from your device if you use "Delete my data" (15).
• Moving codes: deleted when the new phone fetches the save, or after 7 days.
• Your account and its backup: until you delete them with "Delete my data". Signing out keeps them (12).
• Feedback notes: a year (11).
• Crash reports: about 30 days.
• Emails to us: until your question or report is dealt with.
• Everything on your device: until you erase it or remove the app.
• Waitlist emails: until PeanutStudy opens or you ask us to remove yours (16).

Everything sent to the server travels over encrypted connections. The app cannot read the database tables directly: each request goes through a function that checks it is allowed. Only a scrambled form of your device's room token is stored. No system is perfectly secure, so please tell us at baduruduru0722@gmail.com if you notice a problem.

Notifications are optional and you are asked first. Reminders are scheduled on your phone; only a friend's note, invite or gift, or a thank-you for an invite, comes through Apple or Google (see 5). The app never asks to track you and never reads your advertising ID. The app also uses vibration and keeps the screen awake while you focus. It does not use your camera, microphone, location or contacts, and never reads your photo library: saving a picture to Photos asks for add-only access. Saving a postcard or photo card goes through your phone's share sheet, which you control.

We process this data to provide the features you use, and you can withdraw from any of them by switching it off in Settings. You can ask us to tell you what we hold about you, correct it or delete it by emailing baduruduru0722@gmail.com, and we answer within one month. Depending on where you live, you may also have the right to object or to complain to your data protection authority. Here is how to delete your data.