Pearl Privacy Policy

The Pearl browser, the Pearl Pass app and extension, Pearl Shield, PerliDownload and the Pearl sync service

This policy explains what data the Pearl browser app, the Pearl Pass app for Android, the Pearl Pass, Pearl Shield and PerliDownload browser extensions and the Pearl sync service at browser.perlicom.com handle, why, where it goes and how long it is kept. It is written against what the software actually does. Where a feature is optional, the policy says so and says what happens when it is off.

1. Who we are and what this policy covers

Perlicom Systems Ltd, "Perlicom", "we" or "us", is the data controller for the products below. It is a company registered in Ireland, company number 546999, VAT number IE3281342GH. You can contact us at support@perlicom.com.

This policy covers:

the Pearl browser app for Linux, Windows, macOS and Android;
Pearl Pass, a password manager, as an app for Android phones, as an extension and built into Pearl, including verification codes relayed from your phone to your browser;
Pearl Shield, an ad and tracker blocker, as an extension and built into Pearl;
PerliDownload, a download manager extension;
the Pearl sync service (browser.perlicom.com), which Pearl, the extensions and other Perlicom apps use for the optional Perlicom account and end-to-end encrypted sync.

It applies however you installed the product: from Google Play, from the Chrome Web Store, from Microsoft Edge Add-ons, from Perlicom's own update channel, or bundled inside the Pearl browser.

2. The short version

Pearl works without an account. Your history, bookmarks, tabs, downloads and settings stay on your device unless you turn on sync.
Sync is optional and end-to-end encrypted. If you sign in with Google, our server stores your Google account identifier and email address, and encrypted data that it cannot decrypt.
Your master password never leaves your device and we cannot recover it.
On your phone, Pearl Pass keeps your vault on the phone, fills logins in other apps only when you choose one, and never presses Log in for you.
Phone verification codes are end-to-end encrypted before they leave your phone and are deleted from our server within minutes.
Fingerprint and face unlock stay on your phone. We never receive your fingerprint or a picture of your face.
Pearl Shield and PerliDownload extensions collect nothing. They work entirely inside your browser.
Server logs are kept for 30 days. Like any website, our servers record the IP address, time and address of each request. We use these logs only for security and troubleshooting, and delete them after 30 days.
Adverts in the Pearl app for Android only, and never on a web page. The Android app shows a Google AdMob banner at the foot of the new-tab page, Settings, Downloads and History. No advert is ever placed on or over a web page or on a Pearl Pass screen inside Pearl, and there are no full-screen adverts. Google may use your device's advertising ID; in the EU, EEA and UK you are asked for consent first. Section 3.9 explains this in full. The desktop app and the extensions contain no advertising.
No analytics and no tracking in the extensions. The Pearl apps, like every Perlicom app, send us daily counts of which screens and features are used, linked to your account, as a condition of use (section 7); never pages, sites, searches, logins or anything you type. We do not sell data, and we never use your browsing, your vault or your synced data for advertising, profiling or credit decisions.

3. The Pearl browser

3.1 On your device

Pearl stores your browsing history, bookmarks, open tabs, download list, site settings and preferences in the app's own storage on your device. You can clear them in Settings. Web pages you visit are loaded directly from those websites, and what you type into the address bar as a search goes to the search engine you have chosen (for example Google, Bing, DuckDuckGo, Brave Search, Startpage or Ecosia); their own privacy policies apply.

3.2 Sync: optional, end-to-end encrypted

If you sign in to Pearl with Google (section 4.5 describes the account), Pearl can sync your bookmarks, history, open tabs, settings, Pearl Shield settings and Pearl Pass vault between your devices. Everything is encrypted on your device before upload, under a key protected by your master password. Our server stores the encrypted items and the organising information described in section 4.5, and cannot read the contents. Some settings are deliberately kept per device and are never synced.

3.3 Update checks

Pearl checks for new versions by downloading a small update manifest from browser.perlicom.com, and the Pearl Pass app does the same from assistant.perlicom.com. This happens however you installed the app, including from Google Play. The request does not contain your account, a device identifier or anything about your browsing. Security updates can be required: an out-of-date app asks you to install the update before continuing. Copies installed from Google Play are then updated through Google Play; copies installed from our website download the update from our server. Like any web request, our server sees your IP address and the app's request, which may appear in our request logs.

3.4 Pearl Shield filter list updates

The ad and tracker lists built into Pearl are refreshed about once a week, and when you choose Update lists now, by downloading the public lists directly from their publishers: easylist.to (EasyList and EasyPrivacy), raw.githubusercontent.com (uBlock Origin's unbreak list) and secure.fanboy.co.nz (Fanboy's Cookie Monster list). These are plain downloads; nothing about you or your browsing is sent. Those servers can see your IP address.

3.5 PerliSentinel (home DNS filter): optional

PerliSentinel is a separate DNS filter that runs on a computer on your own home network. If you enter its address in Pearl, Pearl reads its status and blocklist directly from that computer over your local network. No Perlicom credential is ever sent to that address.

The option Use PerliSentinel away from home relays the same two read-only requests through browser.perlicom.com. It is off by default, and our server serves it only to the owner of the home filter it is connected to, which is Perlicom's own household; for any other account the server refuses the request without contacting the filter and records the refusal in the security log (section 11). No filter data from anyone else's home passes through our server.

3.6 Log files and crashes

Pearl writes a diagnostic log file on your device so problems can be investigated. Sign-in codes and tokens are removed from each line before it is written, the file is readable only by your user account, and it is capped at about 4 MB with one older copy. Pearl has no crash reporter and never uploads its log. If you send us a log in a support request, we use it only to handle that request.

3.7 Usage counters

Pearl counts how often its screens and features are used (never which pages, sites, searches or logins) and sends those daily counts to us, linked to your account. This is a condition of using Pearl, not an optional setting. Section 7 describes exactly what is sent and how long it is kept.

3.8 Eircode address lookup

When you are signed in and look up an Irish Eircode while filling in an address, the Eircode is sent to our server as described in section 4.7.

3.9 Advertising in the Android app

The Pearl app for Android is supported by advertising supplied by Google AdMob. The desktop versions of Pearl (Linux, Windows and macOS) and the Pearl Pass, Pearl Shield and PerliDownload extensions contain no advertising SDK and show no adverts, and no adverts are shown on Android TV. The separate Pearl Pass app for Android has its own advertising, described in the Pearl Pass Privacy Policy at browser.perlicom.com/privacy; this section is about the Pearl browser.

Where an advert can appear, and where it never can. A browser shows you other people's pages, so the placement is deliberately narrow:

a banner at the foot of Pearl's own screens: the new-tab page (only while it is the tab you are looking at), Settings, Downloads and History, and nowhere else;
never on or over a web page. No advert is injected into, placed over or shown between the pages you visit;
never on a Pearl Pass screen: the vault, a lock or master-password prompt, a verification code, a revealed password or autofill. When a Pearl Pass sheet or any dialog is open, the banner under it is hidden;
no full-screen adverts. Pearl shows no interstitial or other full-screen advert at any point.

When Google has no advert to show, the same space may show a link to another Perlicom app instead. That link is drawn by the app itself and sends nothing to anyone unless you tap it.

The adverts can be personalised. The app includes Google's standard advertising permissions, so Google's ad SDK can read your device's advertising ID (com.google.android.gms.permission.AD_ID, and on newer Android versions the Privacy Sandbox ACCESS_ADSERVICES_AD_ID and ACCESS_ADSERVICES_TOPICS). Where you have agreed to it, and where you have not deleted that ID or switched off ad personalisation on your phone, Google may use it to choose adverts that match your interests. That profile is Google's and is built from Google's own sources, never from what you do in Pearl.

What Google receives. To choose, deliver and measure an advert and to prevent ad fraud, Google may process your device's advertising ID, coarse device and app information (model, Android version, app version, language), your IP address, from which an approximate, city-level location is derived, and whether an advert was shown, seen or tapped, plus diagnostics from the ads SDK itself. Google does this as an independent controller, under its own policies (policies.google.com/privacy).

We give Google nothing from your browsing or your vault. The pages you visit, your searches, history, bookmarks, tabs and downloads, your Pearl Pass logins, identities, cards, notes and codes, your master password and your encrypted synced data are not shared with Google's ad SDK, with any advertiser, or with anyone else for advertising. An advert request carries no page address and no keywords. No advert is targeted using anything you do or keep in Pearl.

Your choices.

In the EU, EEA and UK the app asks for your consent before showing adverts, through Google's certified consent flow (the User Messaging Platform). If you do not consent, the app requests no adverts at all, not even non-personalised ones. Because the free app is paid for by adverts, in these regions it then asks you to accept Google's consent message to keep using it for free. Pearl has no paid version, so accepting is the only way to keep using the Android app in these regions; the desktop app is not affected. If Google's consent message cannot be shown (for example, with no connection), the app stays usable, requests no adverts and asks again next time.
You can change or withdraw your answer at any time in Settings > Advertising > Privacy & ad choices, which appears wherever Google's consent flow applies. Withdrawing consent stops advert requests straight away.
On Android, wherever you are, you can reset or delete your advertising ID and switch off ad personalisation in Settings > Privacy > Ads (on many phones: Settings > Security & privacy > Privacy > Ads, or Settings > Google > Ads). Deleting the ID stops Pearl's adverts being personalised. You can also manage Google ad settings at myadcenter.google.com.
How Google uses data from apps that use its services is described at policies.google.com/technologies/partner-sites.

4. Pearl Pass

4.1 On your device

Your vault (logins, identities, payment cards, notes and one-time-password secrets you choose to save) is stored in the storage of the extension or of Pearl, encrypted with AES-256-GCM under a key derived from your master password with Argon2id. The unlocked key is held only in memory and is cleared when you lock the vault, when auto-lock runs, or when the browser closes.

Your master password is never sent to Perlicom or to anyone else. Perlicom cannot read your vault and cannot recover a forgotten master password.

To do its job, Pearl Pass reads the web pages you visit, on your device only. On http and https pages it looks for sign-in, sign-up, address, payment card and verification-code fields; shows its icons in those fields; offers to save a login when you submit a form; and fills saved details. A saved login is only ever offered on the exact site it was saved for. Filling a single matching login, or your default identity's address into empty fields, as a page loads can be turned off in the extension's settings; payment cards are never filled without a click. Page content, form contents and the list of sites you visit are not collected, stored on our servers or sent anywhere.

Site icons shown beside saved logins come from your browser's own icon cache; no request is made to fetch them.

4.2 The Pearl Pass app for Android

The vault on your phone. The app keeps your vault in its private storage on the phone, encrypted in the same way (AES-256-GCM under a key derived from your master password with Argon2id). The app blocks screenshots and screen recording of its screens, and it is excluded from Android's cloud backup, so your vault is never copied to Google Drive by the phone.

Permissions and setup. Before you first use the app, it shows each permission it needs, explains what it is for, and takes you to the Android setting to turn it on:

Autofill service: lets Pearl Pass offer your logins in other apps and in browsers (section 4.3).
Notification access: lets Pearl Pass find verification codes in notifications (section 4.8).

The camera and biometric prompts are requested only when you use a feature that needs them.

4.3 Autofill in other apps

When Pearl Pass is your autofill service, Android shows it the structure of the screen you are filling: which fields are user name, password, address or card fields, the app's package name, and the website domain if the screen is a web page in a browser. Pearl Pass uses this on the phone only, to offer matching logins and to offer to save a login you have just typed. It fills only: it never presses Log in or submits a form for you. A login is offered to an app only if it was saved for that app and signed with the same app signing certificate, and a website login only inside a real browser, so a lookalike app cannot receive it. Screen contents are not stored and are not sent to us or anyone else.

When you copy a password or code, the app marks it as sensitive, so Android does not show a preview, and clears the clipboard after 45 seconds if it still holds what was copied.

4.4 Fingerprint, face unlock and the camera

Fingerprint (and other strong biometrics) is handled entirely by Android. Pearl Pass only receives "confirmed" or "not confirmed", and uses that to release a key stored in the phone's secure hardware (Android Keystore). We never receive or store your fingerprint.

Face unlock is optional and off until you set it up. It uses the front camera to build a face template that is stored only on your phone. It is never synced, never uploaded, and never unlocks the vault on its own; it only confirms it is still you, for example before showing a password in an already unlocked vault. You can delete it in Settings at any time.

The camera is used only while you are scanning a QR code (for example to add a one-time-password secret) or setting up or using face unlock. Camera frames are processed on the phone and are never stored or sent anywhere.

4.5 The optional Perlicom account and sync

Sync starts only when you click Sign in with Google. Google authenticates you (Google's own privacy policy applies to that step) and gives us a signed sign-in token. From it we store:

your Google account identifier, your email address, and the display name and profile picture address Google provides;
when the account was created and last signed in, and which Perlicom app you signed in from, on which kind of platform, with a count of sign-ins.

For each signed-in device we store a session: a random device identifier created by the app or extension, a platform label, and when the session was created, last used and expires. Sessions expire 30 days after they were last refreshed, and in any case 90 days after you signed in, when you sign in with Google again. The session token itself is stored only as a one-way hash.

Your synced data is end-to-end encrypted. Vault entries, browser data and settings are encrypted on your device before upload. The key that encrypts them is stored on our server only in wrapped (encrypted) form, under a key derived from your master password, together with the salt, the key-derivation settings, an encrypted verifier and a hash of an authentication proof. None of this lets us decrypt your data.

Our server does see, and stores in readable form, the information it needs to organise and sync your encrypted items: a random item identifier, which collection it belongs to (for example "vault" or "bookmarks"), timestamps, whether it was deleted, its size, the device and app that wrote it, and your account email address.

We keep a security log of account events (sign-in, token refresh, sign-out, key changes, resets, account deletion, and refused or rate-limited attempts) with the time and IP address. Entries are deleted after 90 days (section 11).

4.6 Breach check: optional, off by default

If you turn on Check passwords against known breaches in the Pearl Pass extension, it computes a SHA-1 hash of a password on your device and sends only the first five characters of that hash to the Have I Been Pwned "Pwned Passwords" range service (api.pwnedpasswords.com). The comparison against the list that comes back happens on your device. Your password and its full hash are never sent. Perlicom receives nothing from this check. Like any web request, the service can see your IP address.

4.7 Eircode address lookup

When you are signed in and look up an Irish Eircode while editing an identity, the Eircode is sent to our server, which asks the public Eircode finder service for the matching address through our lookup proxy and returns it to you. Only the Eircode is sent, never your name or other details. Like any request, it may appear in our server's request logs.

4.8 Verification codes from your phone

The Pearl Pass app can pass one-time verification codes that arrive on your phone (for example by text message or in a banking app notification) to Pearl Pass in your browser, so you do not have to type them. In the Pearl Pass app this is on by default: during setup the app explains exactly what it reads and asks you to grant Android's notification access, and it works only once you have granted it. The PerliSmart app offers the same feature, off by default. You can turn it off at any time in the app's Settings, or by removing notification access in Android's settings.

When it is on, the app reads the text of incoming notifications on the phone itself to find a verification code. Notification text is not uploaded, stored or sent anywhere. Notifications without a code are ignored and nothing about them is kept. When a code is found, the phone sends one record to the Pearl sync service, end-to-end encrypted with your account key, so Perlicom cannot read it. The record contains:

the code;
the name and Android package name of the app that showed the notification;
the notification's title, which is usually the sender's name or number (at most 40 characters);
the website domain, if the message names one;
whether the message mentions a payment, and whether it came from a recognised messaging app;
when it was received, and an expiry five minutes later.

There is only ever one such record per account: each new code replaces the previous one, and when you use a code, Pearl Pass replaces the record with an empty encrypted marker. Our server deletes the record automatically once it is 10 minutes old (the clean-up runs every five minutes, so a record never stays longer than 15 minutes), or with your account. Pearl Pass in your browser asks for a code only while a verification-code field is showing on an https page. If the message names a domain, it offers the code only on that site. It fills the code only when you click Use this code.

5. Pearl Shield

The Pearl Shield editions in the Chrome Web Store and Microsoft Edge Add-ons open no network connections, have no account and collect no data. The filter lists are built into the extension. The count of blocked requests is worked out inside your browser and shown in the popup; it is never sent anywhere. Your settings (on/off, filter lists, sites where blocking is paused) are stored only in your browser.

The Pearl Shield edition bundled with the Pearl browser or delivered through Perlicom's own update channel additionally offers optional, end-to-end encrypted sync of Shield's own settings through the account described in section 4.5. Inside the Pearl browser app, Shield also refreshes its filter lists as described in section 3.4.

6. PerliDownload

PerliDownload works entirely inside your browser. To find the video, audio and files on a page, it observes, but does not change, the responses of pages you visit and reads the page's media elements when you open its popup. It downloads what you choose directly from the site you are on, as that page would. Your download list, detected media and settings stay in your browser. PerliDownload sends nothing to Perlicom or to any third party, has no account and contains no analytics. It does not circumvent DRM.

The edition bundled with the Pearl browser can also connect to an optional helper program that you install and run yourself on your own computer. That connection stays on your computer (127.0.0.1), or goes to a helper address on your own network that you enter, and never reaches our servers. The Chrome Web Store and Edge Add-ons editions do not include it.

7. Analytics

None of the extensions contain analytics, telemetry, advertising or third-party scripts. The Pearl browser contains no third-party analytics; it sends us only the usage counts described below (section 3.7). The Pearl app for Android shows adverts from Google AdMob, as described in section 3.9; the ads SDK sends Google the information listed there, and nothing about your browsing.

Every Perlicom app counts which of its screens and features are used and sends those counts to this service, linked to your account. This is part of how the apps work and a condition of using them, not an optional setting: we need it to see which features are used, fix what is not working and decide what to build next. What is sent: the account it belongs to, the app, its version and build, the platform (for example Android or Linux), a random install identifier, and for each day how many times each screen or feature was used, with the first and last time that day. What is never sent: page or message content, passwords, vault entries, file names, search terms, anything you type, precise location or your advertising ID. Counts are kept for 13 months (395 days), then deleted automatically, and at once if you delete your account.

Suggest a feature. If you send a suggestion from an app's Settings, we store what you wrote, the category you chose, the app, its version and platform, the time, and your account's name and e-mail address so we can follow it up. Suggestions are grouped with similar ones so we can see which are common. They are kept for 24 months, then deleted automatically, and at once if you delete your account.

8. Why we use data, and our legal bases

To provide the app, account and sync you asked for: update checks, autofill, storing your account, sessions and encrypted data, Eircode lookups and relaying phone codes (performance of a contract, GDPR Article 6(1)(b)).
Face unlock, which uses biometric data on your phone only, relies on your explicit consent (Articles 6(1)(a) and 9(2)(a)), given when you set it up and withdrawn by deleting it. Perlicom never receives this data.
To keep the service secure and working: the security log, rate limiting, abuse prevention and troubleshooting (our legitimate interests, Article 6(1)(f)).
Usage counts in Perlicom apps (section 7), a condition of using the apps: our legitimate interests (Article 6(1)(f)) in keeping the apps working and improving them. The counts are minimal, contain no content and are not used for advertising. You can object at any time by writing to us; because the apps cannot work without them, the way to stop them entirely is to stop using the apps and delete your account.
Feature suggestions you send (section 7): our legitimate interests in answering and acting on them (Article 6(1)(f)).
Personalised advertising in the Pearl app for Android (section 3.9), which uses your device's advertising ID: your consent (Article 6(1)(a)) in the EU, EEA and UK, given through Google's consent flow and withdrawn at any time in Settings > Advertising > Privacy & ad choices.
Non-personalised advertising, ad measurement and fraud prevention in the Pearl app for Android: our legitimate interests (Article 6(1)(f)) in funding a free browser and keeping it working and secure. Where local law requires consent before anything is stored on or read from your device, adverts are requested only once you have given it.
Legal obligations, where the law requires us to keep or disclose information (Article 6(1)(c)).

We do not sell your data, build profiles of you, or use your browsing, your vault or your synced data for advertising, and we do not let people read your data except where you ask us to (for example in a support request), where it is needed for security, or where the law requires it. Your synced content is encrypted, so it cannot be read in any of these cases.

9. Chrome Web Store user data and Google API Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements, and to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: the only data we receive through Google sign-in is your account identifier, email address, name and profile picture. We use it only to create and identify your Perlicom account for the features described above. We do not transfer it to others except as necessary to provide or secure those features, to comply with the law, or as part of a merger or acquisition with notice to you. We do not use it for advertising, and we do not use it to determine creditworthiness or for lending.

10. Who else handles data

Google: signs you in if you choose Sign in with Google.
Our hosting provider, Hetzner Online GmbH: runs the servers for browser.perlicom.com in data centres in the European Union, under contract, as our processor.
Google Play: if you install the Pearl or Pearl Pass app from Google Play, Google handles the download, updates and any crash reports you choose to share with developers through Android, under Google's privacy policy.
Google AdMob: serves the adverts in the Pearl app for Android (section 3.9). It receives your device's advertising ID and the device and IP information Google needs to deliver, personalise and measure an advert, never anything from your browsing or your vault.
Have I Been Pwned: only if you turn on the breach check, and only receives five characters of a password hash.
The Eircode finder service: only receives an Eircode you look up.
Filter list publishers (easylist.to, GitHub for uBlock Origin's list, fanboy.co.nz): serve the list downloads in section 3.4 and see only an ordinary download request.
Websites and the search engine you choose: Pearl connects to them directly when you browse or search, as any browser does.

We share nothing else, except where the law requires it. Where a provider such as Google processes data outside the European Economic Area, it does so under its own legal safeguards, such as the European Commission's Standard Contractual Clauses.

11. How long we keep data

Data on your device (Pearl's browsing data, extension storage, log files) stays until you delete it, clear it in Settings, or uninstall. Removing an extension deletes its storage.
Your account, encrypted data and wrapped key are kept while your account exists.
Sessions expire 30 days after they were last refreshed, and at most 90 days after sign-in.
A relayed phone code becomes unusable five minutes after it was received. The encrypted record is replaced by the next code, cleared when used, and deleted from our server once it is 10 minutes old (at most 15 minutes, as the clean-up runs every five minutes), or with your account.
Usage counts are kept for 13 months (395 days), then deleted automatically.
Feature suggestions, with the name and e-mail address they came from, are kept for 24 months, then deleted automatically.
Security log entries are kept for 90 days and then deleted automatically, including entries not linked to an account, such as refused or rate-limited sign-in attempts. Entries linked to your account are deleted earlier if you delete your account. The record that an account was deleted contains no account identifier and no IP address.
Server request logs (IP address, time, the address requested, the response and the app or browser's user agent) are kept for up to 30 days for security and troubleshooting, then deleted automatically. They are not used to track you, are not combined with your vault, and are not shared except with our hosting provider as our processor or where the law requires it.
Backups: our server makes a nightly backup of the sync database and keeps it for 14 days. Your synced content is in it only in end-to-end encrypted form. When you delete your account, its data disappears from backups as they are replaced, within 14 days, and is never restored into the live service.

12. Your choices and your rights

You can use the Pearl browser, Pearl Pass, Pearl Shield and PerliDownload without an account.
You can sign out of one device, or of every device at once.
If you forget your master password, Reset erases your key and every item you have synced. It asks you to sign in with Google again first.
To delete your account, you can request deletion in the app (Settings > Request account deletion) or at browser.perlicom.com/delete-account; we process requests within 30 days and e-mail you when done. Processing removes your account record, key document, sessions, every synced item, any waiting phone code, your app sign-in history, your usage counts, your feature suggestions and the security log entries linked to you. Your request is checked against the Google account you are signed in with; a request from anyone else is refused. You can also email support@perlicom.com from the address you signed in with.
Uninstalling the Pearl Pass app, or removing an extension, deletes the data it kept on that device.
Adverts in the Pearl app for Android: change or withdraw your consent in Settings > Advertising > Privacy & ad choices, and reset or delete your advertising ID in Android's settings (section 3.9).

Under the GDPR you have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. For synced content we can only provide the encrypted form; your own devices hold the readable copy, and Pearl Pass can export your vault. To exercise a right, email support@perlicom.com. You also have the right to complain to the Data Protection Commission in Ireland (www.dataprotection.ie) or to the supervisory authority where you live.

13. Security

Synced data is encrypted end-to-end before it leaves your device. Connections to our servers use TLS. Session tokens are stored hashed, sessions end after at most 90 days, sign-in is rate-limited, and destructive actions (resetting your sync key, deleting your account) need a fresh Google sign-in from the last ten minutes. No system is perfectly secure: choose a strong master password and keep your devices protected.

13a. Your US state privacy rights

This section applies if you live in a US state with a general consumer privacy law: California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and any state with a similar law. It adds to the rest of this policy.

What is collected

In the last 12 months these categories of personal information were collected through Pearl. Each is used only for the purposes, and kept only for the periods, described earlier in this policy.

By us: identifiers: if you sign in, your Google account identifier, e-mail address, display name and profile picture address; a random device identifier for each signed-in device; and IP addresses in our security log (90 days) and request logs (30 days).
By us: internet or other network activity: when you signed in, from which app and kind of platform, your sessions, and the organising details of your synced items (identifier, collection, timestamps, size, which device wrote it).
By us: your synced content, which reaches us only end-to-end encrypted: we store it but cannot read it.
By us: usage counts: daily counts of which screens and features are used, with the app, version, platform and a random install identifier, linked to your account (never which pages, sites, searches or logins); and any feature suggestion you send, with your name and e-mail address.
By Google's ads SDK in the app: identifiers (advertising ID, app set ID, IP address); internet or other network activity (adverts shown and tapped, SDK diagnostics); and approximate location worked out from the IP address.

Sensitive personal information: none that we can read. Your vault (including passwords and payment cards) and relayed verification codes reach our server only end-to-end encrypted, under a key we never have, and nothing from them is ever passed to Google's ads SDK.

Selling and sharing

We do not sell personal information for money, and we do not give it to data brokers. But the Pearl and Pearl Pass apps for Android show Google AdMob adverts, and where those adverts may be personalised Google receives your advertising ID, IP address and which adverts you saw or tapped. Under California law that counts as "sharing" for cross-context behavioural advertising. Under the other state laws it is "targeted advertising", and some of them may also call it a "sale". Google is the only recipient. We do not knowingly sell or share the personal information of anyone under 16.

How to opt out ("Do Not Sell or Share My Personal Information")

On your phone (this is what actually stops it). Android: Settings > Security & privacy > Privacy > Ads > Delete advertising ID (on some phones Settings > Google > Ads). Without an advertising ID, Google shows that device only non-personalised adverts. More in section 3.9.
By e-mail: write to support@perlicom.com with the subject "Do Not Sell or Share". Adverts are requested by the app on your phone and we do not hold your advertising ID, so we cannot switch this off from our side; we will confirm your request and send you the steps above.

Global Privacy Control (GPC). GPC is a browser setting, so the app itself cannot receive it. Our web pages carry no advertising or cross-site tracking, so there is nothing there for GPC to switch off. If a browser sends GPC to any of our web services, we treat it as a valid opt-out of sale and sharing.

Your rights

Know and access: what we hold about you, where it came from, why we use it and who receives it, and a copy you can take elsewhere.
Delete it — request deletion in the app (Settings > Request account deletion) or at browser.perlicom.com/delete-account; we process requests within 30 days and e-mail you when done.
Correct anything that is wrong.
Opt out of sale, sharing and targeted advertising (above), and of profiling that has legal or similarly significant effects (we do none).
Limit the use of sensitive personal information: we already use it only to provide the feature you asked for, and never to infer things about you; you can still ask.
No discrimination: using any of these rights will not change the price, quality or features you get.

How to make a request

E-mail support@perlicom.com with the subject "US privacy request", saying which right you want to use and which state you live in. Please write from the e-mail address your account uses, so we can match it to you. We answer within 45 days. If we need longer, we tell you why within those 45 days and may extend once by up to another 45 days. An authorised agent can make a request for you with your signed permission; we may ask you to confirm your identity with us directly.

Appeals. If we turn a request down, reply with the subject "Appeal" and we will answer within 45 days. If you are still not satisfied, you can contact your state Attorney General.

14. Children

These products are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

15. Summary of our lawful bases

The sections above describe in detail what Pearl collects and why. In summary, and where the detailed sections above are more specific they apply:

Contract (GDPR Article 6(1)(b)): to provide Pearl and your account, and to do what you ask the app to do.
Legitimate interests (Article 6(1)(f)): to keep Pearl and our servers secure, prevent fraud and abuse, fix faults, measure how the app is used through the usage counts described above (a condition of using the app, not an optional setting), improve our apps, create anonymised or aggregated statistics, and send marketing e-mails about our own apps under the soft opt-in described in "Marketing emails" below (you can opt out at any time). You can object to processing based on legitimate interests at any time (see your rights above).
Consent (Article 6(1)(a)): for personalised advertising, for any other marketing (for example by text message or about other companies' products, which we do not send today), and for anything else where we ask you to agree. You can withdraw consent at any time, without affecting what was done before.
Legal obligation (Article 6(1)(c)): to keep records the law requires, and to answer lawful requests from authorities.

16. Advertising only with your consent

Accepting the Pearl terms of use is not consent to personalised advertising. In the EU, the EEA, the UK and Switzerland, adverts in Pearl are personalised only if you agree in the Perlicom EU consent message (Google's consent tool), and you can change your choice at any time from the app's privacy options, as described above.

17. Marketing emails

We send e-mails with news and offers about Perlicom Systems Ltd's own apps and services. We never send offers from, or on behalf of, other companies, and we never share your e-mail address with anyone for their marketing.

Default and choice. When you create an account, the "Emails from Perlicom" box is ticked, and you can untick it right there before you continue. If you close the question without continuing, nothing is recorded and we send no marketing e-mails.
Legal basis. A "soft opt-in" for our own similar products under S.I. No. 336 of 2011, Regulation 13(11), with our legitimate interest in telling customers about our apps (GDPR Article 6(1)(f)). You have an absolute right to object to direct marketing at any time (GDPR Article 21(2) and (3)); once you object we stop, and a refusal is never switched back on unless you turn it on yourself.
How to opt out. Turn off "Emails from Perlicom" in the app's About or Settings screen, use the one-click unsubscribe link in any marketing e-mail, or e-mail support@perlicom.com. One choice covers every app of ours that uses your account.
What we record. Your choice, the exact wording you saw and its version, the app, the source (sign-up, settings or unsubscribe link) and the date and time, kept as a history of changes so we can show what you agreed to. We keep it while you have an account and for up to 6 years after, as evidence of your choice.
Service messages about your account, security, purchases or changes to our terms are part of the service and are not marketing.

18. Content you publish or share

Under the Pearl terms of use you keep ownership of your content and give us a licence to use content that you publish (for example publicly or with a public link), including in marketing and promotion of our apps. Content that you keep private, including anything protected by end-to-end encryption, and content you send privately to particular people (such as messages, calls, meetings, recordings or files sent to named recipients) is used only to provide Pearl. That licence does not change how we handle personal data: any personal data in your content is used only as this policy describes. We will not feature content that identifies you or anyone else in marketing unless that person has agreed, and you can ask us not to feature your content at all by e-mailing support@perlicom.com with the subject "Do not feature my content".

19. Anonymised and aggregated information

We may turn information into anonymised or aggregated statistics that do not identify you or anyone else and cannot reasonably be linked back to a person (for example, how many people use a feature in a month). Such information is not personal data. We own it and may use, publish, share, license or sell it. We will not try to re-identify anyone from it, and anyone we give it to must agree not to try either. We do not sell your personal data for money. Some US state laws treat sharing data with advertising partners for personalised adverts as a "sale" or "sharing" of personal data; we do that only with your consent, and you can withdraw it at any time as described above.

20. If we withdraw Pearl

If we withdraw Pearl or shut down the servers behind it (see the Terms of Use), we will tell you in advance where practicable, and where Pearl lets you download or export your content you can do so during the notice period. After the shutdown we delete the personal data and content kept on our servers for Pearl, including from our backups as they expire, except anything the law requires us to keep (for example purchase and tax records) and anonymised or aggregated information. Data kept only on your own device stays there until you delete it.

21. Changes to this policy

We will update this policy when Pearl or the law changes, and change the effective date (and version, where shown) at the top. If a change materially affects how your personal data is used, we will tell you in the app, by e-mail or on the store listing before it takes effect, and where the law requires it we will ask for your consent again.

22. Contact and complaints

Perlicom Systems Ltd (company number 546999, Ireland) is the data controller. E-mail: support@perlicom.com. We reply within one month.

You have the right to complain to the Irish Data Protection Commission (www.dataprotection.ie) or to the supervisory authority where you live or work. See also the Pearl Terms of Use.