Clarity about your information.

Who operates Pepper

Pepper is operated by John Nesgoda in Texas, United States of America. Contact support@pepperwork.app for privacy questions or help with your data.

Pepper is intended for individual professionals organizing their own work. The iPhone and iPad app is in beta; an initial US App Store release in English is in preparation.

Device and Cloud are separate

The Device workspace keeps notes and actions in the app’s local storage. Signing in does not automatically upload or merge that work. Device notes are separate from your native Cloud workspace and from the hosted web pilot.

When you use Cloud, Supabase stores your sign-in email, account and session identifiers, notes, summaries, follow-up drafts, accepted tasks, and usage records needed to run Pepper. Account access controls restrict Cloud work to its account. We use this information to sign you in, save and retrieve your work, provide requested AI help, protect the service, and handle support.

The app also keeps sign-in information in the device’s secure Keychain and a small local record for an unfinished AI request or sign-in cleanup. Those local status records contain identifiers, not note text. They are separate from the Device workspace.

Device storage is not a promise that no other copy exists. Apple device backups may include app data, depending on your settings. Exporting, copying, or sharing work creates copies in the places you choose. See Apple’s backup information.

AI help starts with your choice

For a saved Cloud note, you choose whether to enable sending it to OpenAI and tap Generate. Pepper sends that selected note’s title and body to create a summary, suggested actions, and an editable follow-up draft. It does not automatically send your whole workspace. Summaries and drafts are saved to Cloud; suggestions become saved tasks only when you accept them. Pepper does not send your drafts or messages for you.

To decline future AI processing, leave the consent switch off and do not generate. You can continue using manual notes and actions. Changing your choice does not recall a request already sent or erase provider records; use the deletion options below for saved Pepper work.

Pepper disables OpenAI’s optional response storage. This is not Zero Data Retention. OpenAI’s published API policy says data is not used to train its models by default unless the customer opts in. Standard abuse-monitoring logs may contain prompts and responses for up to 30 days, with longer retention where required by law or reasonably necessary to prevent harm. Encrypted prompt-cache state may be retained for up to 24 hours. These are provider rules, not a special retention arrangement for Pepper. See OpenAI’s API data controls and prompt-cache information.

Connection and operational records

Hosting and account providers process information such as IP addresses, browser or app information, request paths, status codes, service timing, and account or session identifiers. For signed-in Cloud requests, provider records can link approximate city, region, and country inferred from IP addresses to the account. This is not GPS or precise device location. A visitor to this information website does not need a Pepper account.

We use operational records to protect the service, investigate problems, and maintain performance. Providers process request and response content to deliver the features described here. We have not added advertising or cross-app tracking.

Retention and your data controls

Saved notes, summaries, follow-up drafts, and accepted tasks remain until you delete them. We do not automatically delete that content or your account just because it is inactive.

• Device → My Data: export Device work or delete Device data. These actions do not delete Cloud data or your Pepper sign-in account.
• Cloud → My Data: export native Cloud work or delete Cloud Pepper data. Data deletion keeps the sign-in account.
• Cloud → My Data → Delete my Pepper account: permanently delete the native Pepper sign-in account and its associated Pepper data. Follow the in-app confirmation.

Cloud-account deletion does not erase your Device workspace, separately exported or shared files, the hosted web pilot, support correspondence, Apple backups, or copies held on other devices. The app separately clears matching local request and sign-in records when it can confirm cleanup. If cleanup cannot be confirmed, it warns you and a local status record may remain. An unconfirmed sign-in cleanup keeps Cloud access blocked. Contact support if that warning remains.

Provider logs, delivery records, and backups have separate retention rules. Deleting a note or account is not a promise of immediate erasure from every provider-held copy.

Support and email

Resend processes email addresses, sign-in email content, delivery information, and messages sent to Pepper support. We keep support correspondence as needed to answer the request, follow up, and document the issue. You can ask us to delete it; deleting your Cloud account does not automatically delete the support mailbox or copies you hold.

Resend’s published rules retain email and log data for 30 days on its Free plan, backups for seven days, and remaining customer data for up to 90 days after the Resend customer account is terminated. These periods are separate from a sign-in code’s expiry. Resend documents that moving an inbox thread to trash schedules deletion after 30 days; restoring it cancels that deadline. This does not mean Pepper automatically moves every support thread to trash after 30 days. See Resend data handling and inbox deletion information.

Supabase logs and backups

Supabase’s Free plan currently lists one day of API/database log history and one hour of Auth Audit Log history. Optional database audit records and internal operational or security records can follow different rules. Those visible-history windows are not a guarantee that every record is erased on that schedule. See plan details, Auth logs, and function logs.

Supabase Free does not include automatic database backups. Manual exports, if created, need separate handling. Supabase’s published deletion period of up to 30 days after deleting a whole project does not set a deadline for deleting an individual Pepper note or account. See backup information and retention information.

Apple TestFlight beta

During TestFlight testing, Apple automatically collects beta crash and usage information and shares it with the app provider. Feedback you choose to submit is also shared; these records may include your name or email address, depending on how you joined the beta. We use beta information to understand problems and improve Pepper. Apple’s separate TestFlight privacy notice explains the data and your choices. Keep private work out of screenshots and feedback unless it is necessary for your request.

Website and processing locations

This information website is hosted through ChatGPT Sites on Cloudflare. It has no signup, waitlist, upload, contact, or payment form. Emailing support is a separate interaction.

Supabase, OpenAI, Resend, and hosting providers process information for the functions above and may use their own service providers. Processing may take place outside the United States. Resend states that its stored customer data, including email content and delivery logs, is held in the United States. An initial US app release is not a promise that all processing stays in the US.

Questions and requests

For help with access, export, correction, or deletion, email support@pepperwork.app from your account email when the request concerns Cloud. We may need to confirm ownership. Never send passwords, sign-in codes, or payment details. Tell us which workspace or record your request concerns.

No paid plan or public App Store download is offered by this website or the current beta. If Apple subscriptions become available, deleting a Pepper account will not cancel them; manage cancellation through Apple’s subscription settings.

Chat and capture: private-beta additions

Effective November 2, 2026. These additions describe the private beta; they do not announce a public app release.

Pepper is operated by John Nesgoda in Texas, United States of America. Contact support@pepperwork.app for privacy questions or help with your data. These additions cover John's private, US-English iPhone/iPad beta and supplement the privacy policy on this page. Feature availability depends on separate enablement and verification.

What you choose to share

For an enabled Cloud Chat session, Pepper sends your message, up to six recent user/assistant messages, and the context you selected to OpenAI only when sharing is on and you tap Send. Context can include selected saved-note excerpts and record references, actions, Today information, and reviewed text attachments. It does not automatically send your whole workspace. You can inspect, change or remove selected context before sending. Today can show a limited view rather than every action; AI replies must not be treated as a complete account of your work.

Preparing or refreshing selected context uses Pepper Cloud to read the selected Cloud records and check their current versions. Attaching reviewed text, including text from a scan or speech capture, sends that text to Pepper Cloud to prepare context before Send. This is separate from sharing it with OpenAI. Simply recording, scanning, reviewing text, or preparing context does not itself request an OpenAI reply.

Existing note summaries remain a separate choice: for a saved Cloud note, enable sharing and tap Generate to send that selected note's title and body. Leaving sharing off permits continued manual notes and actions. Turning sharing off later does not recall a request already sent or erase provider records.

Camera and speech capture

When available on your device, Scan uses Apple's on-device text recognition; Record uses on-device speech recognition only. Pepper does not use a server speech/OCR fallback. If on-device speech is unavailable, you can type instead. Camera, microphone and speech permission requests follow your explicit capture action; permission does not mean a Chat message has been sent.

Pepper does not save an audio recording or the raw scanned pages. They are temporary capture resources. You review and edit the resulting text before using it in a note or Chat. Use in a note opens the editor; saving is a separate action in the workspace you chose. Insert into Chat opens text review; attaching it sends reviewed text to Pepper Cloud, and OpenAI sharing still requires sharing on plus Send. Unfinished capture may be discarded when you leave the flow or change workspaces. This does not promise instant removal from device memory, Apple-managed copies or backups.

Replies, saved work and request records

Saved notes, summaries, follow-up drafts and accepted actions remain until you delete them. Accepting a Chat proposal saves a note change or action only after your review and confirmation. Once saved, that work is not deleted merely because a Chat reply expires. Pepper does not send messages, apply proposals or carry out external actions automatically.

The private-beta Chat policy permits retrieval of reply text, unsaved proposals and source-reference content from Pepper Cloud for up to 24 hours. Expired content is hidden from later Cloud reply/history reads; the backend removes those fields when its owner-access cleanup runs. There is no verified scheduled physical-erasure deadline. Content may remain stored after logical expiry until cleanup occurs, and provider records/backups follow separate rules. We do not promise physical deletion from every copy within 24 hours.

Text already displayed in the app is held in memory without a 24-hour expiry timer. It may remain until you clear the conversation, change workspace/account or end the app session; older messages can also drop out as the recent-history limit advances. Notes or copies you save, share or export follow their own lifetimes, not the Cloud reply-retrieval limit.

Account, conversation and request identifiers, request/context digests, outcome/coverage and usage records are kept to resolve uncertain work, prevent duplicate requests and enforce limits until confirmed Cloud data or account deletion. These account-linked records are not anonymous merely because they omit the original prompt text. The device also keeps a small unfinished-request record containing identifiers and whether a close was attempted, rather than Chat text. It may remain if cleanup cannot be confirmed.

Clear conversation clears the current Chat view and draft; it does not erase server request records or cancel an unresolved request. Check the original request's status when the result is uncertain. Closing an uncertain request discards access to its possible reply; it is not proof that OpenAI stopped processing it. Pepper does not silently send it again.

OpenAI's separate handling

Pepper requests store:false for API responses. OpenAI says API data is not used for training by default unless the customer opts in. Standard abuse-monitoring logs may include prompts and responses for up to 30 days, with longer retention for law or harm prevention. Encrypted prompt-cache state may last up to 24 hours. Disabling response storage does not eliminate these separate records. This beta does not promise Zero Data Retention. See https://developers.openai.com/api/docs/guides/your-data and https://developers.openai.com/api/docs/guides/conversation-state.

Deletion and existing controls

Use confirmed Cloud data deletion to remove the account's Pepper work and associated personal request/usage records while keeping the sign-in account, or use the separate confirmed account-deletion flow to remove that account and its associated Pepper data. Operator-level aggregate spending/attempt totals without account identifiers remain consumed; deleting personal data does not restore that shared budget. An unconfirmed deletion or local cleanup remains a warning or pending record rather than a claim of success.

Device and Cloud work remain separate. Account deletion does not erase Device notes, user-made copies/exports, other devices, support correspondence or provider-held copies. The rest of this policy explains sign-in, Keychain, hosting/Supabase operational records, support, provider logs/backups and Apple beta handling. No new complete Cloud-export/snapshot feature or on-device generative model is promised by these additions. For help, contact support@pepperwork.app.