Reference

Privacy and your data

The short version, and where the full one is.

A password typed into a third-party sign-in is used once and never stored.
Sessions that let the next scan skip a login are encrypted at rest.
Reads happen only for the services you connected, only during a scan you started.
Card details go to Stripe. Peltify never sees them.
Two cookies: one keeps you signed in, one remembers that this browser proved your email. No analytics, no advertising pixel.
Public posts, reviews and comments are public. Messages and pelts go only to the person you sent them to.
Export everything from Settings. Delete everything from Settings — thirty-day undo, then gone.