Privacy, in plain words.

The desktop apps (Mac, Windows, Linux)

They collect nothing. No accounts, no analytics, no advertising, no tracking. Your settings, tasks and stats (breaks, stretches, eye rests, water and focus time) stay on your computer. The one exception is a team you choose to join, below.

Calendar (Mac, optional). If you turn on "Ring the bell before meetings", the Mac app asks to read the calendars on your Mac and reads today's meetings (times, titles and video-call links) to ring a bell before each one. They're read on your Mac only, never stored, sent or shared. Turn it off, or remove Pendling in System Settings → Privacy & Security → Calendars, at any time.

To remove that data after uninstalling, delete Pendling's app data folder:

• Windows: %LOCALAPPDATA%\com.karthikanbarasan.pendling
• Linux: ~/.local/share/com.karthikanbarasan.pendling
• macOS: ~/Library/Preferences/com.karthikanbarasan.pendling.plist, and any charm pictures you added in ~/Library/Application Support/Pendling

The apps go online only for these:

• Pendling Pro. On the Mac App Store, the store handles the purchase and tells the app whether Pro is unlocked. Everywhere else (Mac, Windows and Linux from this site, and the Microsoft Store version), activating a licence key sends the key and your computer's name to Dodo Payments to check it, and the app re-checks about once a week while online.
• Your calendar link, in the Windows and Linux apps, only if you add one for the bell before meetings: every ten minutes the app downloads your calendar from that link (only your calendar's own server, such as Google's, sees the request) and reads today's meetings on your computer. The link stays on your computer; nothing is sent to us.
• Pendling for Teams, only if you join your company's team with its code (Settings → Team). The app then sends us, about once an hour, just that day's number of breaks, minutes of focus and stretches, under a random number made on your computer. No name, email, apps, windows, what you work on or times of day. Your team's admins see only totals for the whole team, and only on days when at least three people use Pendling. We keep each day for 90 days. Leaving the team stops it and deletes your days.
• Updates, for the apps downloaded from this site only (the stores update their own copies). The Windows and Linux apps ask GitHub for the latest version number shortly after starting and then every six hours; the Mac app downloaded from this site reads pendling.app/mac/latest.json about once a day. Nothing about you or your use of Pendling is sent; like any web request, the server sees your IP address. Updates are only installed when you choose to.

This website (pendling.app)

We use Google Analytics to see how many people visit pendling.app, which pages they read and where they came from (a search, a link, an ad), so we know what's useful. It records the pages you visit, roughly where you are (country and city, from your IP address, which Google doesn't keep), your browser and device, and the site that sent you. It sets cookies (_ga) to tell a returning visitor from a new one.

• In the EU, the UK and Switzerland, no analytics cookies are set: Google gets only an anonymous signal that a page was viewed.
• No advertising: we don't use it for ads, remarketing or ad personalisation, and we don't share it with advertisers.
• Your choice: block it with your browser's privacy settings or Google's opt-out add-on. The site works the same without it.
• It's only on pendling.app itself: never in the desktop apps, and never in the widget on websites that use Pendling.

We also use Minilytics (analytics.onemactools.com), a simple visitor counter: it records the page you visit, the site that sent you and your screen width, with two first-party cookies (ml_vid, a random visitor number kept for a year, and ml_sid, a 30-minute session) so a returning visitor isn't counted twice. No advertising, and it's only on pendling.app; block it with your browser's privacy settings and the site works the same.

Pendling for websites (the dashboard)

When you sign up to put Pendling on your website, we keep what's needed to run your account:

• Your account: your email address (and your name, if you sign in with Google).
• Your websites and campaigns: names, addresses, campaign settings, team members and their roles.
• Sign-in: a cookie that keeps you signed in to the dashboard. Only a scrambled (hashed) copy of it is stored on our side, and sign-in links work once.
• Billing: your plan and subscription status. Card details go to our payment provider, never to us.

The Community

If you share a charm in the Community, we keep the picture, the name you give it and your Instagram username, linked to your Pendling account (your email address, which is never shown). Once approved, the picture, its name and your username are public on pendling.app. Delete a charm from your share page and it's removed.

Asking for a charm. When a brand asks for its own mascot or to license a Community charm, we keep what they typed (brand, email, website and message) to answer it. For a licence, we email it to the charm's artist, who chose to offer it; replies go straight to the brand, and the artist's address isn't shown unless they reply.

When someone likes or reports a charm, we keep only a scrambled (hashed) copy of their IP address mixed with that charm, so each person counts once, and the reason they chose for a report. No cookies; the page remembers which charms you liked in your own browser.

Visitors to websites that use Pendling

The widget on a website is built to know as little as possible about the people who see it:

• No cookies and no tracking across websites.
• Counts, not people: views, touches, clicks, coupons copied and similar events are stored as daily totals per campaign, and per source: where the visit came from, read from the landing page's address (its utm_… tags or an ad's click id) or the site that linked to it, such as "instagram" or "direct".
• What visitors choose to type: if a campaign has a form or poll, we store what the visitor enters (including an answer they write themselves), with the page, where the visit came from and their country. The website's owner decides what to ask and is responsible for those leads.
• Abuse protection: to limit repeated form sending and page views counted by scripts, we keep a scrambled (hashed) copy of the visitor's IP address (for IPv6, its network), mixed with the website and the day, for two days only. On Pro shops with one-time discount codes, a scrambled copy mixed with the website is kept with the prize and code a visitor drew, for up to 31 days, so each visitor gets one draw.
• In the visitor's own browser: the widget remembers small things locally (for example that they closed a charm, which A/B version they saw, or that they already answered a poll), and ?pendling_reset=1 clears it. Only one of these leaves the browser: on shops using the Shopify app or WordPress plugin, a note of the last campaign the visitor saw in the past 7 days (which campaign and version, whether they touched it, and where the visit came from) is passed to the shop's own checkout, so an order can be linked to that campaign (see Shop orders).
• Shop orders: with the Shopify app or WordPress plugin, we keep only orders connected to a campaign: the order number, total, currency and where the visit came from.
• Ad pixels: if a website owner turns on pixels, events go to the tools they choose (such as Meta or Google), following their cookie banner.

Who helps us

• Cloudflare hosts the website, the dashboard and its database.
• Google Analytics and Minilytics count visits to pendling.app (see This website).
• GitHub hosts the desktop app downloads and answers the downloaded apps' update checks.
• Push services (Apple, Google, Mozilla or Microsoft, depending on your browser) carry an empty wake-up to devices where you turned on notifications. Your device then fetches what's new from us, signed in: no lead's details pass through them.
• Wix, if you use the Pendling app for Wix: Wix tells us your Wix site's name, address and owner email (to make your account), your plan, and orders' totals and coupon codes.
• Resend sends sign-in emails and alerts.
• Anthropic (Claude) writes campaign words when you use Write it for me: it receives your brief, your site's name and address, what the campaign does and its languages. Nothing about your visitors.
• Dodo Payments is our reseller (merchant of record) for website plans and Desktop Pro: it takes the payment, handles any sales tax (included in our prices), and issues receipts and licence keys.
• Razorpay handles payments for some website plans.
• Google serves the fonts on pendling.app and the dashboard (Google Fonts, which sees your IP address and browser like any web request), and signs you in, only if you choose to sign in with Google.
• Shopify, Apple and Microsoft, for purchases made through their stores.

We don't sell data, and we don't use it for advertising.

Your choices

You can delete campaigns, leads and websites from the dashboard at any time. To delete your account, or to ask what we hold about you, write to us and we'll do it.

Pendling isn't meant for children and doesn't knowingly collect anything from them.

Contact

Questions about privacy: email us. If we change what we collect, we'll update this page first.