Privacy policy

Last updated 4 November 2026

The short version

Peka sends a note about a web page to your own Claude Code session. A note leaves the page only when you send it.
Without an account, notes stay on your computer, and we never receive them. If you sign in to Peka cloud, notes go through our servers, stored in the EU.
Notes through Peka cloud are end-to-end encrypted by default. We can’t read what’s in them unless you turn that off, but we can see details around them, such as project folders and computer names.
Console output and screenshots can hold whatever was on the page. Keep that in mind before you send a note from a page with secrets or personal data.
We don’t sell your data, show ads or use analytics on this site.

What a note holds

A note is what you write plus what Claude needs to find the code. It can hold:

your comment, and later Claude’s questions and summary and your answers;
the element or elements you pointed at, or the area you dragged out: their text, HTML, attributes, computed styles, selector and position;
component names and source file paths, where the page’s framework exposes them;
the page’s title and address, its window size and scroll position, your browser’s user agent, and whether it is in light or dark mode;
console output: up to 50 recent errors and warnings;
screenshots of the visible page and of the element;
the project folder and Claude session the note is going to.

Nothing is captured until you send a note. So that a note can include errors from before you started it, the extension keeps the last 50 console errors and warnings in the page’s own memory: from page load on localhost addresses, and from when you start Peka on any other site. They aren’t saved or sent anywhere unless you send a note, and they are gone when the page closes.

Console output and screenshots can hold whatever was on the page, such as access tokens, customer records or other people’s personal data. Peka doesn’t filter them. If a page shows something that shouldn’t leave it, don’t send a note from there.

Where a note goes

Without Peka cloud: To the Peka hub on your own computer (127.0.0.1), which saves it as files in the .peka folder in your home directory. We never receive it.
With Peka cloud: If you signed in, to Peka cloud on Cloudflare. The note is stored in a database for your account and its screenshots in file storage, both set to Cloudflare’s EU jurisdiction. A signed-in browser can also be switched to send through the hub on your computer.
Then to Claude: From either hub to the Claude Code session you picked. See “Anthropic” below.

What Peka cloud can read

Encrypted by default. Each of your devices makes its own key pair, and its private key never leaves it. A note’s comment, screenshots, captured page details and console output are encrypted before they leave your browser, as are Claude’s replies, your answers, session titles and first prompts. We store them, but our service can’t read them.

What we can still see. Your account, your devices’ names and public keys, note ids, statuses, times and sizes, which note goes to which session, project folder paths, session and computer names, Claude session ids, and which session each site’s notes go to, which includes the site’s address. We need these to route notes.

Notes that aren’t encrypted. These are notes sent with encryption turned off on the extension’s setup page, and notes sent before encryption was added or from a version of the extension without it. They’re stored in a form our service can read, so they could be read by someone with access to our systems. We don’t look at them as a matter of routine. We only do so if you ask us to, if it’s needed to investigate a security problem or abuse, or if the law requires it.

The limits. Encryption protects your notes from someone reading what we store. It wouldn’t stop a Peka cloud altered to work against you, because Peka cloud is what tells your browser which devices are yours: it could add a device of its own and read notes sent after that. Your browser says when a new device joins, on the extension’s setup and history pages, so a device you don’t recognize is worth a look. A computer that Claude connects through the connector waits until you allow it in your browser, unless you turn that off. A new device can’t read notes from before it joined, and if you lose all your devices, we can’t recover your encrypted notes.

Anthropic

A note reaches your own Claude session, and so Anthropic. Claude Code sends what it reads to Anthropic under your own agreement with them, and Anthropic’s terms and privacy policy apply from there. It can also stay in that session’s transcript. We don’t control any of that, and deleting a note from Peka doesn’t remove it from Claude.

If you connect Peka to Claude on claude.ai, Claude signs in to your Peka account through OAuth. To connect a computer, Claude passes the connector a hash of a token that computer made, and the computer finishes joining by itself. We store only hashes of those tokens.

Your email address

Signing in: When you ask for a sign-in code, our website sends your address and the code to Resend, which delivers the email. Today, Resend is used for sign-in codes only. We keep only a hash of the code.
Google or GitHub: If you sign in with Google or GitHub instead, they tell us the email address on your account, whether it’s verified, and your name. We keep only the email address, to find or make your account, and we don’t read or post anything on your behalf there. Which of the two you used isn’t stored.
Invites: peka is invite-only, so we keep a list of invited addresses and when they were added. An invite doesn’t send an email automatically. We tell you ourselves, for example from the address below.
Waiting list: If you try to sign in with an address that isn’t invited, we keep it and the date on our waiting list. No email is sent then. We may write to you once when there’s a spot, and the address leaves the list when you’re invited.

We don’t send marketing email, and we use your address only for these purposes and to contact you about your account. You can always ask to be removed at hello@getpeka.com.

What else Peka cloud keeps

Your account: its id, your email address, a name taken from the first part of that address, and when it was created.
Your devices: the name of each computer or browser, its kind, when it was added and last seen, its public key, and a hash of its token. We never store the token itself. We also keep a keyed hash of the network each device was last seen on, so we can tell you whether a computer asking to join is on the same network as one of yours, without keeping the address.
Computers asking to join: the name the computer gives, roughly where it is (city and country, as Cloudflare places its address), and when, until you allow it or the request ends.
Your Claude sessions: id, project folder, computer name, which Claude app they run in, process id, title, and for a session with no title, the first 200 characters of what you first asked it. The title and those characters are encrypted, unless the session’s peka plugin is too old to encrypt them.
Which session or project each site’s notes go to, with the site’s address.
Abuse limits: for sign-in, your email address and a hash of your IP address, with a count of requests.
Technical logs: Cloudflare and Vercel record requests, including IP addresses, as part of running the service.

What the Chrome extension stores

In your browser’s storage: your settings, which session each site’s notes go to, your Peka cloud address and token if you signed in, the browser’s encryption keys, and your 60 most recent notes with their comment, page address and status, without screenshots. It stays in your browser unless a feature above sends it. Removing the extension removes it.

The extension runs on localhost and 127.0.0.1 addresses, and on another site only when you press a shortcut or its button there. If you turn on the optional permission for all sites in its setup page, Alt+click and screenshots work on any site without pressing a shortcut first. It captures nothing more than described above.

Voice notes

With a Peka cloud account, you can press the mic button and say a note, also one that stays on your computer. The recording runs only from the press that starts it to the one that stops it, a minute at most, in the extension, and is sent to Peka cloud, where Whisper on Cloudflare Workers AI turns it into text. The recording isn’t stored: it’s read once and discarded, and only the text goes on, into the note, encrypted like the rest of it. Peka cloud keeps a count of how many seconds each account had transcribed per day, to cap it at an hour. Chrome asks for the microphone once, on the extension’s setup page, and you can take that permission back in Chrome’s site settings at any time.

Chrome Web Store Limited Use

Peka’s use of information received from Chrome extension APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use this data only to deliver your notes to your Claude session and show you what happens to them. We share it only with the providers listed here, as needed to do that, or where the law requires it. We don’t sell it, use it for advertising, or use it to decide creditworthiness or lending, and people read it only in the cases listed under “What Peka cloud can read”.

Cookies and this website

This site sets one cookie, peka_session, when you sign in. It keeps you signed in for 30 days or until you sign out, and it holds your account id and email address, signed so it can’t be altered. It is needed for signing in, so there’s no cookie banner. The site serves its own fonts and has no advertising.

Visits to this website

We count visits with Umami, running on our own server at stats.getpeka.com, so nothing about your visit goes to an analytics company. It sets no cookie and keeps no IP address: it records which pages are opened, from which country and kind of browser, and, with its session recordings, where on a page you clicked and scrolled, so we can see where the site is unclear. The recordings are masked: the text on the page and anything you type are left out, so they show where you went, not what you read or wrote. This runs on the public pages and the signed-in account pages alike, and it isn’t used for advertising or shared with anyone.

Who handles data for us

Cloudflare: Runs Peka cloud and stores accounts, notes and screenshots, set to its EU jurisdiction. Its Workers AI turns voice notes into text.
Vercel: Hosts this website. Your email address and IP address pass through it when you sign in.
Resend: Delivers sign-in codes, so it receives your email address and the code.
Our email host: Receives what you send to our contact address.
Paddle: Handles payments for Pro, as merchant of record. See below.

Anthropic isn’t on this list because a note reaches it through your own Claude account, not on our behalf. We may also disclose data where the law requires it.

Payments

Pro is sold through Paddle, which acts as merchant of record: Paddle takes the payment, handles tax and invoices, and is responsible for the payment and billing details you give it, under its own privacy notice. We’ll receive what we need to run your subscription, such as your name, email address, country and what you bought, but not your full card details.

Outside the EU

The EU setting above covers what Peka cloud stores. Cloudflare, Vercel, Resend and Paddle operate internationally, so sign-in email, logs, billing details and the transcription of voice notes may be processed outside the EU and EEA, including in the United States. Where that happens, we rely on the safeguards the law provides, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses in those providers’ terms.

How long things are kept

Notes and screenshots in Peka cloud: There’s no time limit. Each account keeps its newest 1,000 notes, and older ones are deleted with their screenshots as new ones arrive. They also go when your account is deleted. Marking a note done, cancelling it or disconnecting a device doesn’t delete it.
Claude sessions: Forgotten after 14 days without being seen, and at most 40 per account.
Account and site settings: Until your account is deleted.
Devices: Until you disconnect them on your account page, or your account is deleted.
Sign-in codes: A code works for 10 minutes, once, and for 5 tries. Its hash is removed when it’s used, when the tries run out, or at a later sign-in request once it has expired.
Abuse limits: About an hour.
Connecting a computer: A request that waits for approval lasts up to 15 minutes, or 30 when Claude connected it through the connector. One you denied, or that peka stopped, is shown for 24 hours. Claude’s connector sign-in lasts 24 hours and renews for up to 180 days, until it expires.
Invites and waiting list: An invite stays until it’s taken back or you ask us to remove it. A waiting list entry stays until you’re invited or you ask us to remove it. Neither expires by itself.
Notes on your computer: Until you delete them. The hub keeps them on disk with no time or number limit.
In the extension: Your 60 most recent notes, until you remove the extension.
Logs: For as long as Cloudflare and Vercel keep them, under their own policies.
Billing records: For as long as accounting law requires, once there are paid plans.

How to delete things

Your account and everything in Peka cloud: there’s no button for this yet. Write to hello@getpeka.com from your account’s address, and within 30 days we’ll delete your account, devices, notes, screenshots, sessions and settings. Copies may remain in our hosting provider’s recovery systems for a short time after that.
A single note in Peka cloud: write to us with the note, in the same way.
A device: disconnect it on your account page. Its token stops working at once. Its notes stay until they are deleted as above.
An invite or waiting list entry: write to us.
Notes on your computer: delete the feedback folder inside the .peka folder in your home directory.
The extension’s data: remove the extension.
What reached Claude: manage that through Claude Code and your Anthropic account.

Why we may use your data

Contract: Running your account and delivering your notes, because you asked us to.
Legitimate interests: Keeping Peka secure, limiting abuse, keeping the invite and waiting lists, and answering you when you write to us.
Legal obligation: Keeping accounting records and answering lawful requests.

We don’t make decisions about you by automated means alone. If your notes contain other people’s personal data, it’s up to you to have a right to share it. If your organisation needs a data processing agreement, write to us.

Your rights

Under the GDPR you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Write to hello@getpeka.com, and we’ll answer within a month. You can also complain to the Swedish Authority for Privacy Protection (IMY), or to the authority where you live.

Security

Sign-in codes, device tokens and connector tokens are stored only as hashes, each account’s notes are kept apart, and connections to Peka cloud are encrypted in transit. No service is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires.

Children

Peka isn’t meant for anyone under 18. If you think someone under 18 has given us personal data, write to us and we’ll delete it.

Who we are

Peka is provided by Varghav Solutions AB, Swedish organisation number 559493-4027, Mältargatan 5, 753 18 Uppsala, Sweden, which is the data controller for the Peka cloud service, Peka accounts and this website. Questions and requests go to hello@getpeka.com.

Changes to this policy

We’ll post changes here and update the date at the top. If a change matters to how your data is used, such as a new kind of data or a new provider, we’ll email account holders before it applies. See also our terms.