Privacy notice

Last updated: 19 July 2026

peekstack is an infrastructure sketchpad. This page explains, in plain language, what personal data it handles and why. The short version: we store what you draw and who you are when you sign in, we run no analytics or advertising, and you can delete everything yourself.

Who is responsible

peekstack is operated by Peekstack (peekstack.io), based in Ireland, which is the data controller. For anything privacy-related, contact [email protected].

What we store, and why

• Account. Signing in with Google gives us your name, email address, profile photo URL and a Google account identifier. We use these to operate your account (legal basis: performance of a contract).
• Your boards. The diagrams you draw — services, connections, zones, board names — stored so you can come back to them. A board is private to you (and your team) unless you explicitly enable its share link, which makes it viewable by anyone who has the link.
• Teams and invites. Team names, who is a member, and the email addresses you invite. Invited addresses are stored until the invite is accepted, declined, or the team is deleted.
• Live presence. While you have a board open, your first name, profile photo and current selection are shared with others viewing the same board. These heartbeats expire within about a minute of closing the tab.
• Browser storage. Sign-in state, theme choice, recently used tiles and display toggles live in your browser's local storage. We set no advertising cookies; the session-replay tool below stores an identifier so it can group your session.
• Session replay (LogRocket). On peekstack.io we use LogRocket to record how the interface behaves during your visit — interactions, console errors and performance data — so we can find and fix bugs. If you're signed in, the session is linked to your account (name and email) so we can help when something goes wrong for you specifically (legal basis: legitimate interest in keeping the product working). Replay runs only on the production site, never on text you type into password fields.
• Purchases. If you buy the Pro unlock we store your plan, an export counter, and the Paddle transaction and customer identifiers, so the unlock survives sign-outs and we can match refunds (legal basis: performance of a contract). Payment details — card numbers, billing address — go to Paddle, never to us.
• Server logs. Standard technical logs (IP address, request path, timestamp) kept briefly for security and abuse prevention (legal basis: legitimate interest).

What we don't do

• No advertising, no ad-tracking pixels, no cross-site tracking.
• No selling or sharing of your data with third parties for their purposes.
• No profiling or automated decision-making.

Who processes data for us

Authentication and storage run on Google Firebase (Google Ireland Ltd). Google may process data on servers outside the EU/EEA, including the United States, under the EU–US Data Privacy Framework and standard contractual clauses. Your profile photo is loaded directly from Google's servers as part of the sign-in service. Session replay is processed by LogRocket, Inc. (United States, under standard contractual clauses); replay data is retained on a rolling short-term basis. Payments for the Pro unlock are processed by Paddle.com Market Ltd as merchant of record — Paddle is the seller on your receipt and handles your payment data under its own privacy policy. The web application itself is hosted by us.

How long we keep things

Everything lives until you delete it: boards until you delete them, your account until you delete it, invites until resolved. Presence data expires within about a minute. Server logs are rotated on a short schedule.

Your rights

Under the GDPR you can ask for access, correction, erasure, portability, restriction, or object to processing. Most of it you can do yourself: edit or delete any board, leave teams, and use Delete account & data on your dashboard, which removes your boards, your team memberships and your account in one step. For anything else, email us. You also have the right to complain to a supervisory authority — for us that is the Irish Data Protection Commission (dataprotection.ie), or your own local authority.

Children

peekstack is not directed at children under 16.

Changes

If this notice changes materially, we will update the date above and note it on the dashboard.