PewPad
Privacy Policy
This policy explains what data PewPad collects, why, where it's stored, and the choices you have. PewPad is a sermon notes app published by Pews & Pixels. We've tried to keep this readable. If anything below is unclear, email hello@pewsandpixels.com and we'll explain in plain language.
1. Who we are
PewPad is published by Pews & Pixels, a small Christian software studio based in the United Kingdom. For the purposes of UK and EU GDPR, Pews & Pixels is the data controller for any personal data PewPad collects.
You can contact us at hello@pewsandpixels.com for any privacy-related question or request.
2. What data we collect
a. Account data
When you sign up, we store:
- Your email address (used to identify your account and for sign-in)
- A hashed password (we never see or store the plaintext)
- The date your account was created
b. The notes you write
When you create a sermon note, we store:
- The note's title, body text, and any formatting you applied
- The sermon date, and any church / preacher / series name you typed
- Any tags you added
- Any photos you attached to the note
- Any reflections (three-question review answers) you saved
If you turn Cloud Sync on (it's on by default during the beta), this data is synchronised to our cloud database so you can read it on another device. If you turn Cloud Sync off, your notes stay only on the device where you wrote them.
c. App preferences
We store your in-app preferences (font size, font family, theme, notification reminder time) on your device. These never leave the device.
d. Diagnostic data
PewPad does not include any third-party analytics, advertising SDKs, or crash reporters. We do not collect:
- Your location
- Your contacts, calendar, or browsing history
- A device advertising identifier
- Usage analytics or behavioural events
- Any data from other apps on your device
Apple and Google may collect aggregate, anonymised crash and install statistics through their own developer tools (App Store Connect / Google Play Console). We see counts only — never personally identifying data.
3. Why we collect it
We collect the minimum data needed for the app to work. Specifically:
| Data | Why |
|---|---|
| Email + password | So you can sign in and access your notes |
| Notes, tags, photos, reflections | So we can show you what you wrote |
| App preferences | So the app remembers how you like it |
We do not use your data for advertising. We do not profile you. We do not sell, trade, or rent your data to anyone, ever.
4. Permissions PewPad asks for
When you use a feature that needs a permission, your device will prompt you. You can refuse, and you can change your mind later in your device settings.
| Permission | What it's used for | Required? |
|---|---|---|
| Camera | Taking a photo to attach to a note | No — only when you tap "Take photo" |
| Photo Library (read) | Choosing an existing photo to attach to a note | No — only when you tap "Choose photo" |
| Photo Library (add) | Saving a "Highlight" share card to your camera roll | No — only when you tap "Save to Photos" |
| Notifications | Sending the optional daily reflection reminder | No — only if you enable the reminder in Settings |
PewPad does not access your microphone, location, contacts, calendars, health data, or motion data.
5. Where your data is stored
On your device
Notes you've written, tags, and reflections are kept locally on your device (using the operating system's standard secure storage). The app works offline — you can write notes without an internet connection and they will sync the next time you're online (if you have Cloud Sync on).
In the cloud (if Cloud Sync is on)
We use Supabase (supabase.com) to store your account and synchronised notes. Supabase is operated by Supabase, Inc., based in the United States, and uses Amazon Web Services data centres. Our Supabase project is hosted in the EU (Frankfurt) region, so by default your data stays inside the European Economic Area.
Supabase acts as a data processor on our behalf. They do not use your data for any purpose of their own. Their privacy policy is at supabase.com/privacy.
Photos
Photos you attach to notes are stored on your device. If Cloud Sync is on, they are also uploaded to Supabase Storage (same EU region) so they appear on your other devices.
6. Who we share data with
We share data only with the service providers strictly required to run the app:
| Provider | What they do | What they receive |
|---|---|---|
| Supabase, Inc. | Hosts our authentication and database | Account email, hashed password, your notes (if Cloud Sync is on) |
| Apple / Google | App distribution and push notification delivery | Standard install / device data (we don't see this) |
We do not share data with advertisers, analytics companies, or any other third party. We have never sold user data and will never do so.
If we're ever legally compelled to disclose data (court order, etc.), we'll push back where we can and tell you unless we're legally barred from doing so.
7. International data transfers
If you use PewPad from outside the European Economic Area, your data may travel through servers in the United States (Supabase's company headquarters) or wherever Apple/Google's notification servers are routed. Where this happens, transfers are protected by Standard Contractual Clauses (the legal mechanism approved by the UK ICO and the European Commission for transfers to "third countries").
8. How long we keep your data
- While your account is active: as long as you keep using PewPad
- If you delete your account: we delete your account record and your notes within 30 days. Backups containing the data are overwritten on a rolling 30-day cycle.
- If you stop using PewPad without deleting: we keep the data so it's there if you come back. If you'd like us to delete it, just email us at hello@pewsandpixels.com.
You can also export everything yourself at any time: Settings → Export to JSON produces a single file with every note, tag, and reflection you've created. You own that file.
9. Your rights
If you're in the UK or EU, GDPR gives you the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your data ("the right to be forgotten")
- Export your data in a portable format
- Restrict or object to how we process it
- Withdraw consent at any time
- Complain to the Information Commissioner's Office (ico.org.uk)
If you're in California, the CCPA gives you broadly equivalent rights, including the right to know what we collect, the right to delete it, and the right not to be discriminated against for exercising those rights. PewPad does not "sell" personal information as defined by the CCPA.
To exercise any of these rights, email hello@pewsandpixels.com. We aim to respond within 7 days and will action requests within 30 days.
10. Children
PewPad is not directed at children under 13. We don't knowingly collect data from children under 13. If you're a parent or guardian and believe your child has signed up, email us and we'll delete the account.
11. Security
- Passwords are hashed using industry-standard algorithms before storage — even we cannot read your password.
- Data in transit between your device and Supabase is encrypted with TLS.
- Data at rest in Supabase is encrypted on disk.
- We use Apple's secure-storage APIs for any session tokens kept on your device.
No system is perfectly secure. If we ever detect a breach affecting your data, we'll notify you within 72 hours, as required by GDPR.
12. Future features
PewPad may, in the future, introduce a paid subscription tier (managed by RevenueCat, a subscription-management provider). If and when that launches, we'll update this policy, and RevenueCat's role and the specific data they receive (a subscriber identifier — never your email or notes) will be added here. Today, no subscription processing is active.
13. Changes to this policy
If we change this policy in a way that materially affects your rights, we'll let you know inside the app and update the "Last updated" date at the top. Continued use of PewPad after a change means you accept the updated policy.
14. Contact
For any privacy question, request, complaint, or anything in between:
Email: hello@pewsandpixels.com
Postal: Pews & Pixels, United Kingdom
We read everything personally. There's no support ticket queue — it goes straight to a real human.