Privacy Policy

1. Who We Are

Peakabu is operated by Peakabu, LLC, an Oregon limited liability company. For users in the European Economic Area and United Kingdom, Peakabu, LLC is the data controller for the personal information described in this policy.

Contact: report@peakabu.app
Mailing address: Oregon, USA [street address pending]

2. The Short Version

3. Information You Give Us

Account information. A username and a password — no email address is required. Passwords are stored only as a bcrypt hash. Because we don't collect an email address, password recovery is only possible if you've linked a Discord account.

Linked accounts. If you connect Discord, we receive your Discord user ID, username, avatar, and (where you grant it) server membership information used to sync your roles. We do not receive your Discord password or read your messages.

Payment information. Subscriptions are processed by Stripe, which collects your billing details — including a billing email address, for receipts — directly at checkout. We never see or store your full card number. Stripe passes us a customer ID, subscription status, the card's last four digits and brand, and billing country — and, for a recurring subscription, your billing email as well, so we can link the subscription to your account and reach you about billing issues. One-time code purchases (see below) are not linked to an account, and we don't store their billing email.

Codes bought on peakabu.app. Peakabu Mobile plans and event passes are sold on our website through Stripe Checkout and delivered as a redemption code; no account is needed to buy one. Stripe's checkout page asks for an email address for its own receipt, and Stripe keeps that as the payment processor. On our side we record only the code, what it grants, and the Stripe checkout ID it was issued for.

Optional code delivery by email. When you buy a code you may enter an email address, before checkout or on the confirmation page, and ask us to send the code there. We use that address only to send that message (through our email provider, see Section 9). We do not save it to your account or any database, add it to a mailing list, use it for marketing, or share it with anyone else. We keep only a count of how many times a code was emailed, so the feature can't be abused. If you leave the field blank, your code is shown on screen only and we never receive an address from you.

Redemption codes and subscriptions. If you redeem a crowdfunding, promotional, or purchased code, we record which code was redeemed, by which account, and when. If you buy on peakabu.app while signed in and leave "Save the codes I buy to my account" on, we also record which account bought the code, so it appears under My codes; we keep that link on our servers and do not send your username to Stripe. For a monthly subscription, we store Stripe's subscription and customer IDs with the account that redeemed its code (and the account that bought it, if different), so renewals and cancellations update the right plan.

Card fingerprint (to keep closed accounts closed). For each purchase, Stripe gives us its card fingerprint: a one-way code Stripe makes for a card, so the same card always gives the same code. It is not your card number and can't be turned back into one. We keep it with the codes from that purchase, and with the account that redeems one. We use it only to recognise a card that paid for an account we closed for breaking our Terms, so that person can't buy their way back in on a new account.

Support and correspondence. If you email us or report a bug, we keep the message and any logs, screenshots, or files you attach.

User-entered content. Session names, clip titles, notes, and similar text you type into the Service.

4. Your Recordings

4.1 The local buffer

While capture is active, the Peakabu application continuously records your selected game window and audio into a rolling local buffer on your own computer. This buffer never leaves your device unless you save a clip; older segments are continuously overwritten, and the buffer is cleared when capture stops.

4.2 What gets uploaded

When you or a Session Host saves a clip — including one saved automatically by Auto-Highlight — the captured segment is encoded and uploaded to our storage provider so it can be synced with other participants' points of view and played back in the web player. A saved clip may contain video of your selected window, your microphone audio (if enabled), your desktop/system audio (if enabled, which can include voice chat from your party), and anything else visible in the captured window. You control what's captured through the app's window and audio settings.

4.3 Other people in your recordings

Multi-POV capture inherently records other people. You are responsible for obtaining any consent required by law before recording anyone — recording laws vary by state and country. If you appear in someone else's Peakabu recording and want it removed, contact report@peakabu.app; we will work with the account holder to address the request.

4.4 We do not watch your clips

We do not review, monitor, or manually inspect your recordings, except when you explicitly send us a clip for support, when responding to a specific abuse report or legal request, or when required by law.

4.5 Automated processing

Where enabled at your tier, the Service may analyze clips to generate highlight reels, previews, or thumbnails. Depending on the feature and tier, this runs on your own device, on our servers, or through Anthropic's Claude API. Where Claude is used, your clip data is sent to Anthropic solely to generate your output; Anthropic's commercial API terms state customer inputs and outputs are not used to train their models and are deleted from their systems within 30 days of processing. We do not perform facial recognition, voiceprint identification, or any biometric identification on your recordings.

4A. Peakabu Mobile

Peakabu Mobile lets a host run a session that guests join by scanning a QR code with their phone's browser.

• Hosts sign in with their Peakabu account. Your username and password go straight to our main server to sign you in; the mobile server keeps only the resulting sign-in token in a cookie on your browser. To enforce the free plan's daily hosting time, we keep a per-account count of minutes used, for today and yesterday only.
• Guests don't need an account. We store the display name you type, the times you were filming or paused, and which Swing card (area QR code) you joined from, if any.
• Recordings. Your phone keeps a short rolling buffer in its own memory. It is only uploaded when someone in the session taps PEAK, and only the part covering that moment. Photos you take with the in-app shutter are uploaded when you take them. Clips and photos may include anyone and anything your camera sees and hears.
• Safety checks. If the host lists the session publicly, its clip thumbnails, a still from every couple of seconds of each clip, and its photos go through the same automated checks as PC clips before anyone outside the session can see it (see Section 10). Private sessions are not scanned.
• Phone ID. m.peakabu.app gives each phone or browser a random ID in a cookie. It isn't tied to your name, number, or the phone's own identifiers. A one-way hash of it is used to make blocks and closed-account rules stick to a person rather than a display name, and the app sends that hash to our main server when you sign in.
• Age range (Android app). The Peakabu Mobile app asks Google Play for your age range. We never ask for your birth date, and we keep only which range you fall in (under 13, 13 to 17, or 18 and over) for that phone, for up to 30 days. It's used only to give teens a safer experience in the app: no adults-only sessions, no public posts, joining Peak Spot parties only through an adult's Share QR. It isn't shared with anyone or used for ads.
• Blocks. If you block someone, we keep that you blocked them, as hashed IDs plus the display name shown at the time, so it can be enforced and you can undo it.
• Adults-only sessions. If a host marks a session 18+, guests confirm they are 18 or older to join. We record that they confirmed, not their age.
• Moderation log. Safety actions (reports, blocks, footage pulled from public view, removals, sessions made public or 18+, legal holds) are logged with session IDs and hashed person tags, never names or footage, and kept for 2 years. Daily counts (sessions, joins, reports and so on) are kept for 400 days.
• Who can watch. By default, only members of the session, or people the host gives the watch link to. If the host makes the session public, anyone with the link can watch. If the host also lists it on Peakabu public sessions, its saved peaks can appear on peakabu.app/browse and in Peak Roulette for anyone to find.
• Peak feed and Peak Moments. The app's Peak feed plays saved peaks from publicly listed sessions. If you're signed in, you can give a peak a Peak Moment. We store which account gave which Peak Moment, so each account counts once and you can take it back; everyone else only sees the total, never who gave it. Peak Moments make a peak come up more often in the Peak feed and in Peak Roulette. Which peaks you've already watched is kept only on your phone. If you report a peak from the feed, the mobile server sends us a one-way hashed code made from your network address, not the address itself, so repeat reports from one phone count once.
• Retention. Sessions, clips, photos, and comments are permanently deleted 45 days after the session ends (60 days for sessions made before October 27, 2026). The host can also delete footage sooner; anyone whose footage is deleted is told.
• Cookies. m.peakabu.app sets a few essential cookies: a guest pass that keeps you in a session you joined, a host pass for the browser that started it, the host's sign-in token, and the random phone ID above. They are HttpOnly, used only by m.peakabu.app, and are not used for analytics or advertising.

5. Information Collected Automatically

5.1 Device and application data

• Operating system and version, CPU/GPU information, screen resolution
• Peakabu application version
• Capture engine in use and encoder settings
• Locale and time zone

5.2 Running application detection

To populate the capture-target picker and label session history with the game being played, the application reads the names of windows and processes running on your computer. This runs locally — we transmit only the identified game name (e.g. "Apex Legends") to our servers, not a full list of your running applications. We do not read the contents of other applications, your files, your keystrokes, or your clipboard.

5.3 Connection and security data

• IP address and approximate region derived from it
• Login timestamps, success/failure, and account identifiers
• Socket connection events and session join/leave activity
• Rate-limiting and anomaly-detection signals used to detect credential stuffing, abuse, and quota circumvention

5.4 Crash and error reports

We use Sentry for automated crash and error reporting on both the desktop application and our server. A report may include the error and stack trace, application state at time of failure, OS/device/app version, file paths (which on Windows commonly contain your account name), session and clip identifiers, and your Peakabu user ID where the error occurred while signed in. We configure Sentry not to capture authentication tokens or passwords.

5.5 Update checks

The application periodically contacts our servers to check for updates, transmitting its current version and platform.

5.6 Website and web player

We do not run analytics or advertising scripts on peakabu.app, m.peakabu.app, or in the web player. peakabu.app and the web player set no cookies of our own (Peakabu Mobile's essential cookies are described in Section 4A). The site and player use browser local storage only for interface preferences — your selected theme, panel layout, comment display settings, and which clips you've already viewed — which stays on your device and is never transmitted to us. Authentication in the web player uses a bearer token held in memory for the session, not a cookie.

Some pages embed YouTube videos. Loading an embedded video can allow YouTube (Google) to set its own cookies and collect data under Google's privacy policy, independent of anything Peakabu does. We do not control this third-party behavior.

6. What We Do Not Collect

• We do not require an email address to create an account, and we do not store the email address you give us for code delivery
• We do not capture your screen outside the window or region you've selected
• We do not upload buffered footage — only clips you or Auto-Highlight have saved
• We do not log keystrokes, read your clipboard, or scan your files
• We do not read the contents of other running applications
• We do not collect precise geolocation
• We do not perform facial or voice recognition
• We do not sell or rent personal information
• We do not serve advertising or share data with ad networks
• We do not train AI models on your recordings

7. How Long We Keep Things

The Service is not a backup or archival service. Clips expire on schedule and are not recoverable — download anything you want to keep.

8. Legal Bases for Processing (EEA / UK)

9. Who We Share With

We also disclose information when you direct us to (e.g. sharing a session link), when legally required (a valid subpoena, court order, or law enforcement request), to protect rights and safety, or as part of a business transfer — in which case we'll notify you before your information becomes subject to a materially different policy. We do not sell personal information or share it for cross-context behavioral advertising.

10. Share Links Are Public By Design

Anyone with a Session's share link can watch that Session's clips in the web player without an account. Share links use long, randomly generated identifiers that are impractical to guess, but they are not secret, and once shared you cannot control who it gets forwarded to. Clips remain reachable by link until they expire under your tier's retention period. Treat anything you capture and share as potentially public.

Public listings. A host can also list a session on Peakabu public sessions (peakabu.app/browse and Peak Roulette), on PC or Peakabu Mobile. A listing shows the session's name, the host's username, a preview image, and its saved peaks to anyone, without a link. The host can unlist it at any time. Anyone can report a listing; reported listings may be hidden while we review them.

Safety checks before a listing goes public. Before a session appears in public listings, and again whenever new footage is added, we run automated checks on its clip thumbnails (and, for Peakabu Mobile, its photos): a match against known child sexual abuse material using Cloudflare's CSAM Scanning Tool, and a content classifier (OpenAI's moderation API) that flags sexual or graphically violent images for a person on our team to review. Only listed sessions are checked, and only still images, not full videos. Images sent to the classifier are used to return a result and are not used to train models. A match against known abuse material is preserved and reported to the National Center for Missing & Exploited Children (NCMEC) as the law requires.

11. Security

• HTTPS/TLS for all traffic between the application, the web player, and our servers
• bcrypt password hashing with a work factor of 12
• JWT bearer tokens with server-side token versioning so credentials can be invalidated
• OS-level encryption of stored tokens on your device via Electron's safeStorage
• Server-side authorization checks on every request
• Content Security Policy and origin restrictions on the web player
• Secrets held in environment variables, never in source code
• Automated anomaly detection on authentication and usage patterns
• SSH key–only access to production servers

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and any required regulators within the timeframes the law requires. To report a vulnerability, email report@peakabu.app.

12. Your Rights and Choices

12.1 Everyone

• Access — request a copy of the personal information we hold about you
• Correction — fix inaccurate information
• Deletion — delete your account and associated data
• Export — download your clips at any time before they expire
• Withdraw optional consents — unlink Discord, disable microphone capture, opt out of optional features
• Mobile footage — if you appear in a Peakabu Mobile session and want something removed, ask the host or email us with the session name and time

To exercise any of these, email report@peakabu.app. We will respond within 30 days.

12.2 EEA / UK residents (GDPR)

You additionally have the right to restrict or object to processing, the right to data portability, and the right to lodge a complaint with your national supervisory authority.

12.3 California residents (CCPA / CPRA)

You have the right to know the categories and specific pieces of personal information collected, the sources, the business purpose, and third parties it's disclosed to; the right to delete; the right to correct; and the right to opt out of sale or sharing. We do not sell or share personal information as defined under the CPRA, and we do not knowingly collect or sell the personal information of consumers under 16. You may designate an authorized agent to make a request on your behalf.

12.4 Other U.S. states

Residents of Oregon, Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, portability, and opt-out. We extend these rights to all users regardless of location.

12.5 Deleting your account

You can delete your account yourself: sign in at peakabu.app/account (the Peakabu Mobile app links there too) and choose Delete account. You're signed out everywhere straight away, and the account is deleted 7 days later; signing back in before then cancels it. Deletion removes your account, the clips and photos you recorded, comments, Peak Moments, passes and Swing card sets. Sessions you hosted stay until they expire, so your guests keep their clips, with the host shown as "Deleted account"; stars you gave and codes you redeemed stay without your name. Can't sign in? Email report@peakabu.app with your username so we can verify it's your account. Backups cycle out within 30 days; we retain payment and tax records as legally required, and may retain a minimal record of banned accounts to enforce our Terms. A summary is at peakabu.app/delete-account.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. In the Peakabu Mobile Android app, if Google Play reports a user as under 13, the app closes to them and we keep only that range for that phone (see Section 4A). In the EEA, UK, and other jurisdictions with a higher digital-consent age, the minimum age is 16 without verifiable parental consent. If you believe a child has provided us personal information, contact report@peakabu.app and we will delete the account and its data.

14. International Transfers

We are based in the United States, and our infrastructure providers process data in the United States and at global CDN edge locations. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data protection laws than your country. For transfers from the EEA or UK, we rely on Standard Contractual Clauses with our processors, or their participation in the EU–U.S. Data Privacy Framework where applicable.

15. Do Not Track and Global Privacy Control

We do not track users across third-party websites, so there is no cross-site tracking to opt out of. If we ever add analytics or cross-site tracking in the future, this section will be updated first, and GPC will be treated as a valid opt-out signal where California and Colorado law require it.

16. Changes to This Policy

We may update this policy. If we make a material change — such as collecting a new category of information or sharing with a new type of recipient — we will notify you by email (where we have one on file) and/or in-app notice at least 30 days before it takes effect, and update the "Last Updated" date above. Continued use after the effective date means you accept the updated policy.

17. Contact

If you are in the EEA or UK and are unsatisfied with our response, you may complain to your local data protection authority.