Percher — Privacy Policy

Effective date: 19 April 2026 Last updated: 10 August 2026 Version: 2.1

*This document is drawn up in English, which is the authoritative version. A Swedish translation is available at percher.app/sv/privacy. In the event of any discrepancy, the English version prevails; this does not limit rights you have under mandatory law.*

This Privacy Policy explains how Percher ("we", "us", "our") collects, uses, stores and protects your personal data when you use our websites percher.app and percher.run, the associated CLI tool, MCP server, APIs and dashboard (the "Service").

We are required to protect your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act (2018:218) and other applicable data protection legislation.

1. Controller

We have not currently appointed a data protection officer (DPO), as the scope of the business does not meet the thresholds in GDPR Art. 37. If this changes, we will update this policy.

2. What personal data we collect

2.1 Data you provide to us

As account data we collect only your email address — we do not collect your name, address or phone number. App data, logs and technical data (see Sections 2.2–2.3) may contain personal data depending on how you and your end users use the Service.

2.2 Data we collect automatically

The visitor statistics described above (visitor country, transient visitor identifier, device category, referring website, requested address) are collected in the same way for the websites we operate ourselves — percher.app (the dashboard and marketing pages), the percher.run marketing root, and our api, docs and MCP hostnames — with us as the recipient instead of an app owner. The pipeline is the same one: the same pseudonymous daily identifier, the same deletion deadlines and retention periods, no cookies. These first-party statistics are visible only to Percher's administrators and are not shared with anyone.

2.3 CLI telemetry (not account-bound)

Percher's CLI tool (bunx percher) collects non-account-bound technical usage statistics:

The telemetry message never contains:

• Your email address, username or anything else that identifies you
• File names, folder names, source code or project structure
• Environment variables, API keys or other sensitive information

IP addresses are not stored in the telemetry table, but may be processed separately by the infrastructure (rate limiting, access logs) in accordance with Section 2.2.

Opt-out: Set PERCHER_NO_TELEMETRY=1 or DO_NOT_TRACK=1 as an environment variable. The CLI shows a one-time notice on first run.

2.4 Abuse reports

Third parties can report abuse involving Applications via our abuse-report feature. Such reports may contain:

• The reporter's email (optional) — for follow-up
• The reporter's IP — abuse protection for the report feature itself
• Target URL — the address of the reported Application
• Reason and details — a description of the reported abuse

Legal basis: Legitimate interest (Art. 6.1.f) — protecting the integrity of the Service and enforcing the AUP.

2.5 Data we do NOT collect

• We do not collect location data (GPS) beyond what is apparent from the IP address.
• We derive country level only from visitors' IP addresses — no city or finer geolocation, and no IP addresses are stored in the visitor statistics. A visitor's IP is used transiently to compute a country and a daily-rotating salted hash, and the visitor-statistics pipeline discards it immediately afterwards; it remains only in the web server's operational access log (Section 6).
• We do not use tracking cookies for marketing.
• We never sell your personal data.

The Service uses only necessary cookies and functional local storage in the browser — e.g. a session cookie for login, a temporary GitHub OAuth cookie and a theme preference in the browser's local storage. See our separate Cookie Policy for complete information.

3. How we use your personal data

We never use your data to:

• target advertising,
• sell or share data with third parties for marketing,
• train AI models on your source code.

4. Sharing with third parties

4.1 Sub-processors

We share personal data with the following third-party providers, which process data on our behalf and under our instructions:

OpenRouter is not a sub-processor and receives no data. It was previously listed here for two purposes — as a selectable alternative provider for crash diagnostics, and for the optional *managed inference* feature (the capsule lane). Both are switched off as of 30 July 2026. No crash log and no application prompt is sent to OpenRouter, and it will only be listed again if we enable the feature and have first documented the transfer safeguards described in Section 5.

Scaleway is the intended EEA sub-processor for managed inference, but production processing is not yet approved. The replacement is implemented against Scaleway Generative APIs in Paris, France. Scaleway receives no Application prompt until the separate credential, processing-approval, and emergency-stop gates all permit it. Before activation Percher must complete the evidence, impact-assessment, and advance-notice steps in the vendor and transfer-evidence registers. When activated, the conditional description below applies without changing the data path.

4.2 Independent recipients

When you make a purchase, Polar processes personal data under its own terms and its own privacy policy. When you connect GitHub, GitHub processes personal data under its own terms and its own privacy policy. Percher then uses GitHub solely for the integration you have chosen to enable.

4.3 Infrastructure that does not constitute separate sub-processors

The following open-source components run on our own Hetzner server. No data leaves the server through them:

• Caddy — reverse proxy and TLS certificate management
• DB-IP Lite — a local database used to derive a visitor's country from their IP address (country level only). The lookup happens locally on the server; no IP address is sent to DB-IP or any other third party. The product includes IP-to-Country data created by DB-IP (https://db-ip.com), licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
• Forgejo — deploy history and version control of Applications
• Percher build pipeline — automatic build process for Applications (Node/Bun via our own Dockerfile, Nixpacks for other runtimes, or your own Dockerfile with runtime = "docker")
• Docker — containerisation and isolation of Applications

We may also use limited operational tools for internal monitoring and incident notification. Such tools must not be used for customer content, secrets or raw logs. External ops notifications are redacted or scrubbed before they are sent so that email addresses, domains, app names, URLs and secrets are not included.

4.4 Important information about crash logs and AI

Crash logs sent to the AI provider for diagnostics are automatically scrubbed of secrets (environment variables, API keys) before they leave the server. The active provider is Anthropic Claude, and it is the only one; the provider for your instance is shown in the opt-in area of the app settings. Crash logs may contain technical information such as file paths and error messages. Under Anthropic's commercial API terms, inputs and outputs via the API are not used to train models, so crash logs are not used for model training.

Managed inference is approval- and runtime-gated. OpenRouter was disabled on 30 July 2026 because Percher had not documented the safeguards for its US/downstream-provider chain. It remains withdrawn. The replacement uses Scaleway-hosted models in Paris and is disabled until the production gate described above is complete. The authenticated GET /capabilities response reports the actual state for an instance; when unavailable, new builds receive no endpoint URL and the proxy returns 503 without contacting a provider.

When operational, your Application sends text and its user's app-scoped PocketBase session to Percher. Percher verifies the session, strips the session credential from the provider request, enforces limits, and sends the text over TLS to Scaleway in Paris. Scaleway states that model creators do not receive prompts, inputs/outputs are not used for training or model improvement, and standard requests have zero prompt retention by default. Its published exception permits temporary access to and storage of full HTTP request content for up to two weeks to investigate rare unexpected service errors, harmful operation, or suspected abuse. Aggregated anonymised API metadata excluding prompt content may be retained for up to six months. Percher stores token-cost accounting, not prompt or completion content. You remain controller for prompt content and must have a lawful basis and give your users the required notice.

4.5 Other sharing

We do not share personal data with third parties beyond what is stated above, except for:

• Legal requirements: where we are obliged to by law, court order or government request.
• Protection of rights: where necessary to protect our rights, property or safety.
• Business transfer: in the event of a merger, acquisition or sale of the business. You will be notified in advance in such a case.

5. International transfers

5.1 Transfers outside the EEA

Some of our sub-processors are based in the USA. When transferring personal data to countries outside the EEA, we use an applicable transfer mechanism under the GDPR:

We state the mechanism we rely on, not one we have not verified. Transfers to these three providers take place under the data processing terms each provider publishes and applies to its customers. We are in the process of obtaining, verifying and retaining our own copy of those terms, of the applicable transfer mechanism under Chapter V of the GDPR, and of a transfer risk assessment for each provider. Until that is complete, this policy does not assert that a specific executed instrument is held for a specific provider, and we do not offer to send you a copy of one. If this matters to a decision you are making, write to legal@percher.app and we will tell you exactly where each provider stands.

Where we could not document the safeguards, we switched the processing off rather than continue it. OpenRouter and the managed inference feature were disabled on 30 July 2026 for that reason (Section 4.1). The three providers above remain in use for narrower purposes: Anthropic only for crash diagnostics, and only for Applications whose owner has switched that feature on; Cloudflare to keep sign-up reachable and free of bots, and to answer DNS for percher.run; Resend to deliver the emails the Service sends you. Your Applications themselves run on Hetzner, inside the EEA (Section 5.2) — no third-country transfer is involved in running them.

The intended managed-inference replacement is processed by Scaleway in Paris, France, and therefore does not create a third-country transfer. It still remains disabled until the Art. 28/DPIA/notice production gate in Section 4.1 is complete.

All third-country transfers are protected with encryption in transit (TLS).

5.2 Hetzner (within the EEA)

Our server infrastructure at Hetzner is located in Germany and Finland, within the EEA. No third-country transfer takes place for stored data.

6. Data retention and deletion

Upon account closure your personal data is deleted within 90 days, except for data we are required to retain by law (e.g. accounting records in the event of a future payment).

6.1 Data retention upon shutdown of the Service

If Percher shuts down, you will receive at least 60 days' notice. Your data remains available for export for at least 30 days from the effective shutdown date, and is permanently deleted no earlier than 90 days after the shutdown. The final deletion is performed manually and never automatically. See Section 15.5 of the Terms of Service.

7. Your rights under the GDPR

As a data subject you have the following rights:

7.1 How to exercise your rights

Contact us at legal@percher.app from the email address linked to your account. We will respond to your request within 30 days. If we cannot identify you, we may request additional verification.

7.2 Supervisory authority

In Sweden the supervisory authority is:

Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) Website: imy.se Email: imy@imy.se Postal address: Box 8114, 104 20 Stockholm, Sweden

8. Data security

We take appropriate technical and organisational measures to protect your personal data (GDPR Art. 32), including:

• Encryption: All communication takes place over HTTPS/TLS. Environment variables are encrypted with AES-256-GCM. Passwords are hashed with bcrypt.
• Session security: Session cookies are set with HttpOnly, Secure and SameSite.
• Access control: API tokens are stored hashed (SHA-256). Authentication on every protected route.
• Containerisation: Applications run in isolated Docker containers with CapDrop ALL, no-new-privileges, ReadonlyRootfs and resource limits.
• Network isolation: Application containers have no direct outbound internet access — all outbound traffic is routed through a controlled HTTP proxy (egress proxy) that blocks internal hosts (metadata services, the control plane) and can rate-limit or cut off abused traffic. The control network is separated from the app network.
• Audit logging: Security-relevant events (auth failures, deploys, admin actions) are logged.
• Automatic updates: OS security patches are installed automatically (unattended-upgrades).

9. Personal data breaches

9.1 Notification to the supervisory authority

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours of becoming aware of it, in accordance with GDPR Art. 33.

9.2 Communication to you

If the breach is likely to result in a high risk to your rights and freedoms, we will inform you directly without undue delay, in accordance with GDPR Art. 34. The communication will include:

• a description of the breach,
• contact details for further information,
• the likely consequences,
• the measures we have taken or plan to take.

10. Automated decision-making and AI

10.1 AI-generated crash diagnostics

The Service uses an AI-based service — Anthropic Claude, the only provider in use — to analyse crash logs and provide remediation suggestions. The provider for your instance is shown in the opt-in area of the app settings. This processing involves:

• automatic analysis of crash logs when apps crash,
• generation of explanations and remediation suggestions,
• classification of error severity.

We do not make automated decisions within the meaning of Art. 22 GDPR that produce legal effects or similarly significantly affect you. The AI diagnostics provide recommendations — it is always you as the user who decides whether and how the suggestions are used.

10.2 Managed inference

When the runtime reports it operational, managed inference produces text at the request of an authenticated Application user. Percher does not make a decision from that text on behalf of the user and does not use it for an Art. 22 decision. Outputs may be inaccurate, biased, or unsafe; the Application owner decides how they are shown or used.

10.3 Automated platform decisions

The Service makes automated decisions that affect your Applications:

• Auto-sleep: Inactive Applications on the free plan are automatically put to sleep.
• Inactivity warning: Applications with no activity for 90+ days receive a warning and may be suspended.
• Crash-loop prevention: Applications that crash repeatedly are stopped automatically.
• Tarball scanning: Uploaded archives are automatically scanned for security risks.
• Account suspension: In the event of serious AUP violations, accounts and apps may be suspended (see Section 14 of the Terms of Service).

We assess that these decisions do not normally produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. In the event of significant account or app measures (suspension, permanent termination), you have the right to appeal the decision and request human review in accordance with our AUP (Section 10).

11. Data protection impact assessment (DPIA)

We have carried out a data protection impact assessment (DPIA, GDPR Art. 35) for the processing that involves transferring crash logs to an AI provider outside the EEA (Anthropic) for Crash Diagnostics. It covers risk analysis and technical safeguards: automatic scrubbing of secrets from crash logs before transfer, encryption in transit with TLS, containerisation and network isolation.

Its treatment of the legal safeguards is not yet complete. The assessment refers to a transfer mechanism and an accompanying transfer risk assessment which we are still obtaining, verifying and retaining (Section 5); until that is done we do not claim those documents are in place.

A separate managed-inference DPIA engineering draft covers the Scaleway/Paris design, including app-owner controller responsibility, no Percher content persistence, the provider's two-week incident/abuse exception, authentication, cost controls, and emergency shutdown. Its privacy/legal approval and the related account documents and customer notice are not yet recorded, so production processing remains disabled. We do not reuse the crash-diagnostics DPIA because the data and controller roles differ.

The impact assessment focuses on the risks to the rights and freedoms of data subjects and includes planned measures to address those risks. We update the impact assessment upon material changes to the processing or the provider chain.

12. Children's personal data

The Service is not directed at minors and must not be used by persons under 18. We do not knowingly collect personal data from persons under 18.

If we have reasonable grounds to believe that a user is under 18, we may request additional verification, restrict the account or delete the data without undue delay.

13. Changes to this Privacy Policy

We may update this Privacy Policy. In the event of material changes (e.g. new data categories, new sub-processors, changed purposes) we will notify you by email at least 30 days in advance. The current effective date is always shown at the top of this document.

14. Contact

*Last updated: 10 August 2026* *© 2026 Percher — percher.app*