Pepper Spray
LitePricingContactGet it

Privacy

Last updated: 31 October 2026 · Covers Pepper Spray and Pepper Spray Lite, on Android and iPhone.

The short version

  • Your data stays on your device. We have no accounts and no app servers. The only online checks are a public list of cancelled licence keys and a one-device activation (key + device code only).
  • No analytics, ads, tracking or crash-reporting tools.
  • We only see what you choose to send us (a contact message or payment confirmation).

What’s stored on your device

The items, doses, schedules, notes, vial and injection-site details and settings you enter. On Android it’s in the app’s private storage; on iPhone it’s in Safari’s storage for this website. Uninstalling the app, removing the Home Screen app or clearing website data deletes it – so export a backup first.

Backups

Export writes a file to wherever you choose. Who can see it after that is up to you and that storage provider. Import only reads the file you pick.

Reminders

On Android, reminders are local notifications scheduled on your phone. Nothing is sent anywhere.

Contact form and feedback

The contact form (and the in-app feedback option) sends your message through a form service called Web3Forms, which delivers it to us by email. We get what you type, your email address so we can reply, and – for bug reports – basic details like the app version. We use these only to reply and to manage your subscription, and delete them when they’re no longer needed.

Payments and keys

Payment is in Bitcoin, sent from your own wallet. We see the transaction ID you give us. A licence key contains only an ID, the plan and its dates. The app checks the key itself on your device. Licence check: when you’re online, the full app downloads a public list of cancelled keys (peppersprayapp.com/licence/revoked.json) when it starts and about every 12 hours, and also talks to peppersprayapp.com/api so each key works on one device only. That call sends your licence key and a random device code (on Android, derived from the phone’s app-scoped ID – not your name, email, contacts or health data). No account is created. Your tracking data never leaves the phone. Like any web request, our host may see your IP address in standard server logs (see “This website”).

This website

This site has no cookies or analytics. Our host (Cloudflare) may keep standard server logs, such as IP addresses, for security.

Health information

What you log may be health-related. It never leaves your device unless you export or send it yourself. The app doesn’t give medical advice.

Children

For adults 18 and over.

Questions

Use the contact form.