Privacy policy

Effective date: 8 August 2026 · Last updated: 27 September 2026

This policy explains how the Pekan website, the free local Pekan Desktop application, and the hosted Pekan Cloud service handle personal data.

1. Who is responsible

Pekan is currently provided under the trading name Ejstrup Development by Martin Ejstrup, an individual operator based in Denmark. The verified contact details are available on the Legal & contact page. For privacy questions or requests, email hello@ejstrup.dev.

No Data Protection Officer or EU representative has been appointed because neither role is currently required. This statement must be reassessed if the product, organization, or processing changes.

2. The public website

The public website does not have accounts, contact forms, a waitlist, advertising, analytics, session replay, or third-party tracking. It sets no cookies and uses no browser storage. Fonts and other page assets are served from the same site.

The website host, Vercel, processes delivery, request, and security information such as IP address, approximate location derived from IP, request time, requested URL, user-agent, system configuration, and error information. Vercel makes runtime logs available to the operator for up to one hour on the Hobby plan. Vercel may retain other service-generated information for longer where needed to operate, secure, and improve its services; its privacy notice does not state one fixed deletion period for all such information.

Cloudflare provides authoritative DNS for the pekan.cloud domain, including the Pekan Cloud subdomains described in section 12. Its Free plan provides up to eight days of historical DNS analytics. Cloudflare is not currently intended to proxy the marketing website's HTTP traffic; this statement must be rechecked against the live DNS proxy setting before publication.

External sites receive information only after you choose to follow an outbound link. Their own privacy policies then apply.

3. Data in Pekan Desktop

Pekan Desktop is a local application. It does not require a Pekan account. Using Pekan Desktop on its own does not involve Pekan Cloud; the two are described separately in this policy because they store and process data differently.

The application can access and store the information you choose to manage with it, including:

• projects, boards, columns, tasks, comments, plans, workflows, notifications, and activity history;
• attachments, linked project folders, repository paths, worktrees, and file metadata;
• application settings, recovery snapshots, backups, agent-run records, terminal sessions, and local usage aggregates; and
• provider settings and secrets that you choose to configure.

This information is stored on your Windows device in Pekan's application-data and user-selected project locations. It is not uploaded to or accessible by the Pekan operator unless you separately connect that board to Pekan Cloud (section 12). Secrets that Pekan persists, such as an optional OpenAI API key, use operating-system-backed encryption when it is available. Pekan disables storage of that key when secure storage is unavailable.

4. Local integrations and AI providers

Pekan includes a loopback HTTP and MCP server so software on your computer can work with your board. When you explicitly connect a coding agent or another local tool, that tool can read or change the board and project information allowed by the integration. Local access should be granted only to software you trust.

Pekan can launch separately installed third-party coding-agent command-line tools. Before a provider run, Pekan identifies the selected provider and the relevant context or files. The provider may process prompts, project information, file contents, account identifiers, and generated output under its own terms and privacy policy. These are user-selected services, not services the Pekan operator uses to receive or analyse your project data. Pekan does not receive their prompts or responses.

You use those providers under your own account and your own agreement with them. For that flow the Pekan operator is neither a data processor nor a joint controller: it runs no server that receives your prompts, files, audio, or the responses, and it has no access to your provider account. Deciding what to send, and on what legal basis, is yours.

This matters most when a project contains other people's personal data. Sending a folder to a coding agent can send the file contents with it, including customer records, colleagues' details, or anything else that happens to sit in the repository. Before you do that, satisfy yourself that your agreement with that provider allows it, including any data-retention or training terms, and that you have a basis for the transfer. If you handle such data professionally, check your own organisation's rules first.

The optional Voice feature is disabled until you configure it. If you enable it and provide your own OpenAI API key, recorded audio is sent directly from the application to OpenAI for transcription. Pekan keeps the audio in memory for the transcription request and does not write the audio to disk. The resulting text can be stored locally when you insert, confirm, or save it. OpenAI processes the request under the terms associated with your API account. See the OpenAI privacy policy.

AI-generated material is labelled in the application. If you choose to report AI output, Pekan processes the contact details, description, provider and feature metadata that you submit. Generated output or project information is included only when you explicitly choose to include it.

5. How the application is distributed

Pekan Desktop is currently a public alpha distributed as a direct download from GitHub Releases. It is not distributed through Microsoft Store or any other app store.

When you download a build, GitHub processes the request under its own terms and privacy statement. This ordinarily includes your IP address, the time of the request, and the file requested. The operator can see aggregate download counts per release. No Pekan account is involved in the download, and the operator does not receive your GitHub identity from a download.

The application does not update itself during the alpha, so it does not contact a release server after installation. Alpha builds are not code signed, and each release publishes SHA-256 checksums you can use to verify a download before running it.

6. Information the operator receives

The operator receives personal data only through the limited channels below, plus the Pekan Cloud processing described in section 12:

Pekan does not sell personal data, build advertising profiles, or use local desktop content for product analytics or AI-model training.

7. Recipients and international transfers

Website delivery and service-generated request data is processed by Vercel, and authoritative DNS queries are processed by Cloudflare. Support and privacy correspondence is routed through Cloudflare Email Routing and stored using Google's Gmail service. GitHub acts under its own terms for the distribution of desktop downloads. Section 12 names the additional subprocessors used to run Pekan Cloud.

User-selected coding-agent providers and OpenAI voice transcription receive information only following the choices described in section 4. Their locations, retention, and transfer safeguards are governed by the provider and your account agreement with that provider.

The operator-selected services described in this policy, including those in section 12, include providers established in the United States, so some personal data is transferred outside the EU/EEA. Those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the Commission's standard contractual clauses together with the provider's data processing agreement. You can ask which basis applies to a given provider using the contact details above.

8. Retention

• Local desktop data remains on your device until you delete it. Backups and exported copies remain where you placed them until you remove them.
• Vercel Hobby runtime logs are available to the operator for up to one hour. Vercel retains other service-generated request information for as long as it considers necessary for the purposes described in its privacy notice, without publishing one fixed duration for every category.
• Cloudflare Free authoritative DNS analytics provide up to eight days of historical data. If Cloudflare's HTTP proxy is enabled later, this retention statement will be reviewed before the change goes live.
• Routine support, privacy, legal, and AI-report correspondence may be deleted earlier and is deleted no later than 24 months after the matter is closed. It is kept longer only where needed for an active dispute or legal obligation.
• Pekan does not retain voice audio. The retention applied by OpenAI is governed by your OpenAI API arrangement.
• Pekan Cloud account and workspace data is retained as described in section 12.6.

9. Your controls

You decide what to put in Pekan, which folders to link, which local tools to connect, and whether to configure an AI or voice provider. You can cancel a proposed sharing action, disable Voice, remove provider credentials, delete board content, create backups, export data, and remove Pekan's application data from Windows.

Because local desktop content is not held by the operator, the operator cannot inspect, export, correct, or recover it for you outside of a connected Pekan Cloud workspace. Your own backups are the recovery mechanism for purely local data.

10. Your data-protection rights

For personal data held by the operator, you may have rights to access, correction, erasure, restriction, objection, and portability. Where processing relies on consent, you can withdraw it without affecting earlier processing. For a Pekan Cloud account, you can exercise erasure and portability directly and immediately from your account page (section 12.7); for anything else, contact hello@ejstrup.dev. We normally respond within one month.

You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, or to the supervisory authority where you live or work. See datatilsynet.dk.

11. Security

Pekan Desktop keeps your work in local storage and binds its API and MCP servers to the loopback interface, so they are not reachable from your network. It uses operating-system protection for persisted secrets where available, and requires an explicit action from you before any optional provider transfer. You remain responsible for securing your Windows account, device, repositories, backups, API accounts, and connected local software. Pekan Cloud's own security measures are described in section 12.8.

12. Pekan Cloud

12.1 What Pekan Cloud is

Pekan Cloud is a hosted, multi-user version of Pekan reached at accounts.pekan.cloud and api.pekan.cloud. Creating a Pekan Cloud account lets you and, if you choose, other people access the same workspace (an "organization") over the internet, instead of storing boards only on one device. This section applies once you create a Pekan Cloud account; it does not apply to using Pekan Desktop on its own.

12.2 Data we collect

Signing up for Pekan Cloud requires a name, an email address, and a password (stored only as a salted cryptographic hash, never in plain text). Creating or joining an organization records your role in it (for example owner or member) and, if you invite someone, the email address you invite. Using the service creates the workspace content you and your organization choose to store: projects, boards, columns, tasks, comments, attachments, and related activity history. Operating the service also generates technical data: sign-in timestamps, IP addresses tied to authentication and rate-limiting, and session/access-token identifiers.

12.3 Legal basis

Account and workspace data is processed to perform the contract formed when you create a Pekan Cloud account and agree to the Pekan Cloud Terms of Service (GDPR Art. 6(1)(b)). Security measures such as login throttling, session revocation, and abuse prevention rely on legitimate interests (Art. 6(1)(f)) in keeping the service and other users' data safe. Pekan Cloud does not currently send optional marketing communications; if that changes, it will rely on your separate, freely given consent (Art. 6(1)(a)), kept apart from acceptance of the Terms of Service.

12.4 Who processes Cloud data on our behalf

Pekan Cloud runs on infrastructure operated by named subprocessors, each acting on the operator's instructions and none of them independent controllers of your data:

• DigitalOcean: hosts the server that runs the Pekan Cloud application code and, until cloud object storage is enabled, any file attachments you upload.
• Supabase: hosts the managed PostgreSQL database that stores Pekan Cloud account, organization, and workspace content.
• Resend: delivers transactional account email (sign-up verification and password-reset messages) sent from accounts@pekan.cloud. It does not receive workspace content.
• Cloudflare: provides authoritative DNS for the pekan.cloud domain, including the Cloud subdomains (see section 2).

Pekan Cloud does not otherwise share your account or workspace data with third parties, and does not sell it or use it to train AI models.

12.5 International transfers

DigitalOcean, Supabase, and Resend are established in, or transfer data to, the United States. Those transfers rely on the same mechanism described in section 7: the EU-US Data Privacy Framework adequacy decision where the provider is certified under it, and otherwise the European Commission's standard contractual clauses together with the provider's data processing agreement.

12.6 Retention

• Account and workspace data is kept for as long as your account or organization exists.
• Deleting your account (section 12.7) permanently removes your identity and any organization where you are the only member; a shared organization continues for its remaining members.
• Access tokens normally expire 30 days after they are issued. Logging out revokes the token used for that session immediately; in a suspected compromise, the operator can immediately invalidate every token for an account on request.
• Security and operational logs (sign-in attempts, rate-limiting records, audit records of operator actions on an account) are kept for accountability and abuse-prevention purposes and are not used for any other purpose.

12.7 Your rights and self-service tools

From your Pekan Cloud account page you can, without contacting support:

• Export your data: download a JSON copy of your account, organization memberships, and each organization's project/task/comment data (GDPR Art. 20 portability).
• Delete your account: permanently remove your identity, active sessions, and any organization where you are the sole member (GDPR Art. 17 erasure).

For access, correction, or a request affecting a shared organization you do not solely own, contact hello@ejstrup.dev. The general rights and complaint route in section 10 apply equally to Pekan Cloud.

12.8 Security measures

Passwords are hashed, never stored or logged in plain text. Traffic to Pekan Cloud is encrypted in transit. Sign-in and account-creation attempts are rate-limited per account and per network address. Each organization's data is isolated at the database level so one organization cannot read or write another's. Access tokens can be individually or entirely revoked, including by the operator in response to a suspected compromise. You remain responsible for the strength and secrecy of your own password and for who you invite into your organization.

13. Changes

This policy will be updated when Pekan's processing changes. The date at the top will show the latest revision. Material changes will be communicated where required.