1. Who we are
Pegham is developed and operated by Digital Puzzles - Private Limited (“Pegham”, “we”, “us”). We are responsible for the information we process to provide Pegham. For privacy questions, data rights or account deletion, contact hello@dpuzzles.com.
Pegham is a messaging app for iOS and Android currently in development. Features and availability may vary by version. This policy covers the Pegham service and pegham.app.
2. Information we handle
Account and profile information
When you sign in with an available identity provider, such as Google or Apple, Firebase Authentication processes your provider identifier, authentication tokens and the account information the provider supplies, which can include your email address and display name. We assign a Pegham account identifier and record the account creation time. Profile details you choose, such as your name, about text and avatar, are stored on your device and can be shared with your verified connections through encrypted updates.
Messages, files, Moments and backups
Messages and attachments are encrypted on your device for delivery to intended recipients. The service stores and relays ciphertext, encrypted delivery and read/view events, and encrypted call signaling. Shared media can include photos, GIFs, videos, documents and voice notes. Moments are sent to the verified contacts you select. The service does not receive the message or file decryption keys used for this content.
Conversation history, private cryptographic keys, trust decisions and settings are held in protected device storage. If you create a history backup, the app produces an encrypted file that you save to a destination you choose. The backup recovery secret is yours to keep; Pegham does not store it on its servers. Other apps or storage services you choose for exports have their own policies.
Service and connection metadata
To authenticate users and route activity, we process account and device identifiers, public cryptographic identity keys and invitations, conversation routing records, group membership and public group events, delivery acknowledgments, timestamps, encrypted-object sizes and hashes, quota records, device push tokens, notification preferences and conversation mute/block controls. Encryption does not hide this metadata.
When calls are used, connection providers process network details such as IP addresses and connection timing. WebRTC connections may reveal your IP address to the other participant. Relay providers can process traffic volume and network metadata when relaying calls. A call uses the microphone, and video calls also use the camera.
Support and technical information
If you contact us, we receive your email address, message and information you choose to include. Hosting, authentication, messaging and network providers may process IP addresses, request times, device or browser information, error information and security logs needed to run and protect the service. Please do not send private messages, passwords, recovery secrets or cryptographic keys in support requests.
3. How we use information
- Authenticate you, create and maintain your account, and protect access to it.
- Connect verified users, route encrypted messages and files, manage groups and deliver optional notifications or call signaling.
- Apply your privacy choices, handle blocks and muting, prevent abuse, enforce limits and investigate technical failures.
- Respond to support, privacy and deletion requests and comply with applicable legal obligations.
We do not sell your personal data or use the contents of your private conversations for advertising. The app does not include advertising or third-party behavioral analytics SDKs in its current version.
Where applicable law requires a legal basis, we process information as necessary to provide the service you request, for our legitimate interests in securing and operating it, to comply with legal obligations, or with your consent for optional permissions and features. You can withdraw optional permission consent in device settings.
5. Security and device permissions
Pegham uses transport encryption, encrypted message and file payloads, protected device key storage and authenticated encrypted local records. Verify device fingerprints through a trusted channel. The composed application has not received an independent security audit, and no service or device can guarantee absolute security.
- Camera: for scanning invitation QR codes, taking photos/video and video calls, when you choose those actions.
- Microphone: for voice notes, video recording and calls when you choose those features.
- Photos and files: for selecting content to share, saving files or importing/exporting an encrypted backup through platform pickers.
- Notifications: optional activity alerts. Push payloads use generic private-activity notices; supported iOS previews may be decrypted locally. Incoming call controls are separate.
Pegham does not request address-book access or precise location permission. You can deny or revoke permissions in your operating system settings; the related feature may then be unavailable. Files you choose to share can themselves contain personal information, location or other embedded metadata visible to recipients.
6. Retention and deletion
- Account and service records: retained while needed to operate your account, until deletion or the relevant feature’s cleanup process. Delivery acknowledgments remove delivered envelopes from the recipient inbox; undelivered encrypted envelopes may remain until acknowledged or account cleanup. Some delivery, group and routing records remain for service operation.
- Shared files: published one-to-one encrypted files remain on the service until the owner deletes their account. Deleting a message locally does not remove its hosted file. Unpublished reservations expire after 24 hours and scheduled cleanup retries removal; some tombstones are kept to prevent cancelled uploads from returning. Group and Moment files follow their applicable lifecycle and cleanup rules.
- Moments: expire in the app after 24 hours. Expiry is not a guarantee that every recipient copy, queued ciphertext or infrastructure record disappears at that exact time.
- Device history: kept in the app’s protected storage until you delete the relevant content or account, or remove application data. Exported files and recipient copies are separately controlled.
- Support and technical records: retained for as long as needed to resolve a request, operate and protect the service, or meet an applicable legal requirement. We do not promise a fixed deletion period for all provider logs.
Deleting your account
Use Settings → Account → Delete account in Pegham and confirm your sign-in when asked. You can also request deletion without the app by emailing hello@dpuzzles.com. See the account-deletion page for instructions.
Deletion disables account access and removes the authentication account, identity mapping, owned account data and owned encrypted media through the cleanup process. Group membership and owned group data are handled by group cleanup. If a cleanup step fails, the request remains pending for retry and is not reported as complete. We verify ownership before acting on an email request and reply with its status.
We cannot remotely erase content already received or exported by another person, backups you saved outside Pegham, or separately retained recipient records. Information necessary for a specific legal, fraud-prevention or security obligation may be retained only for that purpose and as long as needed; contact us for details applicable to your request.
7. Your rights and choices
Depending on where you live, you may have rights to access, correct, export or delete your personal information, restrict or object to certain processing, withdraw consent, or complain to your local data protection authority. Contact hello@dpuzzles.com to make a request. We may need proportionate information to confirm that the account is yours; never send your password or recovery secret.
You can edit profile details, adjust read/view receipts, notification and incoming-call preferences, manage contacts and groups, export supported encrypted history, and request account deletion in the app. Not all local encrypted content can be retrieved by us because we do not hold its decryption keys.
8. Children
Pegham is not directed to children under 13, or a higher minimum age required in their country. We do not knowingly collect personal information from children below that age. If you believe a child has provided information to Pegham, contact us so we can investigate and take appropriate action, including deletion where required.
9. This website
pegham.app is a public informational website. It does not require a Pegham login, set advertising or analytics cookies, use tracking pixels, or load third-party marketing analytics. Fonts and app artwork are hosted with the website. Our hosting provider processes ordinary web requests and may keep access and security logs including IP address, request time, requested URL and browser information.
Following an external link or emailing support takes you to that provider’s service. That service’s privacy policy applies there. Illustrative app previews contain fictional people and conversations.
10. Changes and contact
We will update this page when our practices change and revise the date above. Where a change materially affects your rights or requires consent, we will provide an appropriate notice or request consent as required.
Digital Puzzles - Private Limited
Pegham privacy and support
hello@dpuzzles.com
https://pegham.app