Pendit01Optional usage analytics
Usage analytics is off by default and starts only after you opt in. Google Analytics for Firebase receives screen categories, app interactions, subscription checkout outcomes, app/device metadata, an app-instance identifier and a pseudonymous library identifier. Analytics also derives approximate country/region information from masked IP addresses; this does not use precise device location. This helps us understand how features lead to subscriptions. Writing, titles, search terms, audio, receipts and payment credentials are excluded. Advertising identifiers, Google signals and advertising personalization are disabled.
You can decline without losing app features and change your choice in My → Privacy & analytics. Withdrawing consent stops future collection and resets analytics data on this device. It does not automatically delete records already processed by Google; those records follow the Analytics property retention settings. Contact pendit@wekiko.com for deletion enquiries.
02Request account and data deletion
Pendit creates an anonymous technical account for your library without asking for a username or password. To request deletion of this server account and its associated data, email pendit@wekiko.com with the subject “Pendit account deletion”. Include your Support ID shown in My and say whether you want the entire server account or only specific data deleted. Do not send payment passwords, API keys, recovery secrets or writing content. We may request limited proof of ownership before acting.
After ownership is verified, we process the request under applicable law. Deletion covers the server identity, sessions, recovery bindings, AI usage and associated service records, subject to legal retention and security requirements. Transaction/dispute records may be retained for the statutory periods shown below (where applicable, five years for payment/contract records and three years for consumer disputes); operational records follow the retention table. We explain any applicable retention when responding.
Local writing and personal Google Drive/iCloud copies are managed separately by you. Requesting server-account deletion does not cancel an Apple or Google subscription; manage cancellation in the store. You can also request deletion of specific personal data without deleting the entire server account at the same contact.
03Scope and principles
This policy covers the Pendit app and related web services operated by WeKIKO. Contact pendit@wekiko.com. Applicable privacy laws govern our processing.
We do not sell personal information or use it for advertising or marketing. We do not collect your contacts, precise location, advertising identifier or general drive files. Basic writing does not require your name, email or phone number.
04Information stored on your device
Writing, library items, notes, resources, snapshots and preferences are stored on your device by default. Pendit does not centrally collect your entire library.
Choosing drive synchronization, AI or public sharing adds the processing described below. Manage local items in the app. Uninstalling can delete local data.
05Information processed by feature
No sign-up does not mean that no technical identifiers are processed. Information is handled when needed for the relevant feature.
| Feature | Information | Purpose and location |
|---|---|---|
| Service access | Internal account/library IDs, device ID, hashed authentication tokens, session timestamps | Authentication, entitlements and security / service servers |
| Drive connection | Provider, provider account ID, recovery binding; encrypted Google refresh credentials for some connections | Connection and recovery / device and service servers. Not a database copy of library text |
| Purchases | Store/product/transaction IDs, amount and currency when supplied, purchase/expiry/refund/subscription status, verification records | Validation, entitlement and restoration / store and service servers. We do not directly collect card numbers or payment passwords |
| Voice input | Microphone audio, selected recognition language and recognized text | User-initiated speech-to-text / device and OS speech provider. Raw audio is not uploaded to Pendit servers |
| AI | Submitted prompt, context and conversation; model, request/token counts and technical identifiers | Responses / server to OpenAI. Usage metadata stored on service servers |
| Public sharing | Encrypted copy of selected writing; link-token hash, ownership and expiry metadata | Link sharing / object storage and service servers. Not your unshared library |
| Support and operations | Support email/message; request time/path/status/IDs, IP and network information; limited enabled error diagnostics | Support, API delivery, security and troubleshooting / support systems, servers and diagnostic services |
06Google Drive and Apple iCloud
Synchronization runs between the app and your selected personal drive: Pendit’s app-specific Google Drive space or its private iCloud CloudKit area. We do not fetch general drive files for analysis or store library text on service servers.
Provider identifiers and authentication/recovery information are processed separately. Some web/desktop Google connections use server-side authorization-code exchange and encrypted refresh-token storage. A provider-supplied email may be used to display the connected account.
Drive connection is optional. Disconnecting does not delete drive copies. Manage stored copies and access permissions through the provider as needed.
07Voice input and microphone permissions
Voice input starts only when you press the microphone in the editor. Android requests microphone access; iOS and macOS request microphone and speech recognition access. Declining permission does not prevent basic writing.
iOS and macOS use Apple speech recognition; Android uses the speech recognition service installed on your device. Depending on the selected language, device and service availability, audio may be processed on the system provider’s servers, such as Apple or Google. The current voice input feature does not guarantee offline processing. The provider’s privacy policy applies.
Pendit does not retain raw audio files or send voice input audio to its own servers or OpenAI. Recognized text, including provisional results, is inserted at the cursor during dictation and saved on your device through the ordinary writing flow. If you subsequently choose drive sync, AI or public sharing, the relevant feature’s processing applies.
Recognition stops when you cancel voice input, leave the editor or send the app to the background. You may revoke microphone or speech recognition access in your device’s app permissions or privacy settings at any time. Saved writing and records held by the system provider are managed separately.
08AI, sharing and diagnostics
Invoking AI sends the prompt, included context and relevant conversation for response generation. Check the scope before submitting sensitive or confidential material. Pendit’s usage tables store model and usage metadata rather than request text.
Public sharing concerns only selected content. Recipients with the link and required decryption information can read it. Revocation cannot retrieve saved copies.
Limited error diagnostics may run in configured release environments, including unexpected payment, local saving and synchronization failures. These reports include the app version, platform, operation and sanitized error code, without writing content, audio, receipts or authentication tokens. Current Sentry settings disable screenshots, session replay, automatic performance tracing and default personal-information collection. Website fonts are served from Pendit’s website, without font-loading requests to Google Fonts.
09Grounds and service providers
Authentication, purchase verification and requested features rely on applicable grounds such as contract performance. Processing requiring separate consent relies on that consent. Mandatory records are retained under applicable law.
We do not disclose information for independent advertising purposes. Disclosure outside the stated purposes requires a valid basis such as your selected sharing/connection, a lawful request or separate valid consent.
Google and Apple login, personal drives, store payments and OS speech recognition are external services you choose to use, subject to each provider’s privacy policy.
| Provider | Service |
|---|---|
| Neon | Service information storage and management |
| Amazon Web Services | Server hosting and file storage |
| OpenAI | AI response generation |
| Google Analytics for Firebase | Optional usage and subscription conversion analytics, with consent |
| Sentry | Error diagnostics, where enabled |
| Expo | App update delivery |
10International processing and choices
Providers including Google, Apple, OpenAI, Neon, AWS, Sentry and Expo may process feature-related information on overseas infrastructure. Categories correspond to the tables above. Transfers occur through encrypted network connections when connecting, using a feature or making a server request, subject to provider contracts and retention rules.
Avoid optional features or disconnect a drive to stop additional transfers for that feature. Declining essential authentication or purchase verification may limit online or paid functionality. Contact pendit@wekiko.com about transfers or rights requests.
Actual storage countries/regions, contracting entities and subprocessors depend on operational contracts. Where law requires a separate international-transfer notice or consent, the relevant details and required process must be provided for the feature.
11Retention and deletion
Information no longer needed is deleted or irreversibly destroyed. You manage device and drive copies. Server deletion, local deletion, drive deletion and store-subscription cancellation are separate actions.
| Information | Retention and cleanup |
|---|---|
| Device writing/resources and drive copies | Until you delete them, subject to app trash/backup settings and provider policies |
| Account and drive bindings | While needed for service/connection; reviewed for removal on disconnection or deletion request, subject to legal obligations |
| Expired/revoked sessions and bootstrap deduplication records | Current server cleanup window: 30 days each |
| Revoked recovery credentials | Current server cleanup window: 90 days after revocation |
| Daily AI usage | Current server cleanup window: 90 days. Completed/released request reservations are cleaned after expiry |
| Processed payment events / detached minimal purchase evidence | Current cleanup windows: 400 days from event creation / 400 days after detachment on account deletion. Distinct from statutory transaction records |
| Legally required transaction/dispute records | Where applicable, 5 years for contracts/withdrawals and payment/supply records; 3 years for consumer complaints/disputes, or another mandatory period |
| Support, operational logs and diagnostics | As needed for support, security and troubleshooting, followed by deletion under infrastructure/diagnostic retention settings |
12Rights and safeguards
Subject to applicable law, request access, correction, deletion, restriction or withdrawal of consent at pendit@wekiko.com. We verify identity using only necessary information and explain legal limitations. Authorized representatives may provide evidence of authority.
Safeguards include protected transport, restricted access, hashed authentication tokens, encrypted Google refresh credentials and minimized error collection. Keep devices and recovery methods secure.
Pendit is not designed to collect children’s personal information. Where consent-based processing for a child under 14 requires representative consent, that consent is required. If processing without required consent is discovered, appropriate steps including deletion will be taken.
13Contact and changes
Privacy and service enquiries: pendit@wekiko.com. Operator: WeKIKO. Privacy lead: EJ Xierra Jeon. Use the same contact for rights requests and privacy incidents.
Changes and their application dates will be posted here. Material changes will be announced through the app or website, with consent obtained when required. Last updated: October 20, 2026.