Last updated 24 October 2026
Perron is built to hold as little about you as possible. You are anonymous by default, and you can use every part of the app that way. This policy explains what Perron does and does not collect — and, if you choose to sign in, the little that changes.
You don't have to create an account, and no feature is behind one. Your device holds an anonymous identifier used only to attribute your own messages to you within a room. It carries no name, no email and no phone number, it is not linked to your identity, and it never leaves the app as one.
Signing in exists for exactly one reason: your passport lives on your phone, so it would be lost with the phone. An account backs it up and carries it — and Perron+, if you have it — to another device. Nothing else is behind it.
If you sign in with Apple or Google, we store the stable identifier that provider gives us, plus an email address if the provider supplies one. Apple's Hide My Email is fully supported and we never see your real address. If you sign in with an email address, we send a six-digit code to it and store the address once you prove you can receive mail there; the code itself is stored only as a one-way hash, is usable once, and dies within ten minutes.
That is the whole of it: an identifier and an address. No name, no photo, no contacts, no social graph, and no password — Perron has none to store, and none to lose. We never ask a provider for anything beyond identity, and signing in does not change what is collected anywhere else in this policy.
If you buy Perron+, we record the store's purchase identifier (Apple's transaction identifier, or Google Play's purchase token) so the subscription can be recognised on your other devices. We do not receive or store your payment details — Apple or Google handles that and does not share them with us.
Perron is location-based: it uses your device location to check whether you are at a railway station and to open that station's chat. Location is used in the moment and then discarded. Perron does not store a history of where you have been, and never records a coordinate trail. Your exact coordinates are not attached to your messages.
If you switch on arrival alerts, Perron also uses your location in the background, even when the app is closed or not in use, to tell you when you arrive at a station and to count the stations on your ride. The same rule applies: Perron keeps only the station and the time, never your coordinates. The app explains this and asks before it requests background access, and switching arrival alerts off stops it.
Messages you post to a chat, wall or Q&A are stored so others in that place can read them, and are removed when the room or post expires (chat and disruption rooms are ephemeral; wall posts decay on their own). Content is anonymous — shown with a chosen display name, not your identity.
To keep stations safe, everything posted publicly — chat, wall, Q&A, lost & found — is checked by an automated moderator shortly after it appears, and anything that breaks the rules (threats, harassment, hate, doxxing, illegal sales and the like) is removed. The check is done by AI models running on Cloudflare (Workers AI) or on Perron's own server; your text is not sent to any other company, and no AI provider trains on it.
To make the moderator better over time — including training Perron's own moderation model — we keep a record of what was checked: the text, the verdict, the station and a pseudonymous key in place of your identifier, so the record carries no name, account or location. These records are deleted after 180 days. When you erase this device, your key is marked as erased and your records are excluded from any training from then on; they expire with everything else at the 180-day mark.
Perron keeps aggregate, privacy-preserving usage counts (for example, how many people opened a station screen or checked in) to understand how the app is used. These are counts only — they carry no user identifier and no location. To estimate how many distinct devices use the app, an irreversible one-way hash of the anonymous device id is counted and swept on a short retention; it cannot be traced back to a person or a device.
If you enable notifications, your device's push token is stored so we can send you messages from rooms you are in and disruption alerts for the station you are currently at — once you leave, those alerts stop. You can turn notifications off at any time in the app or your device settings.
Station, departure and disruption information comes from open (CC0) public transport data. Using Perron does not share your travel with any transport operator.
The app talks only to Perron's own servers (on Cloudflare) and, if you enable notifications, the push services that deliver them: Expo's push service, which hands each notification to Apple (iPhone) or Google (Android). It does not include third-party advertising or tracking SDKs.
The website you are reading now, not the app, uses Microsoft Clarity to understand how people use its pages: which links get clicked, how far pages are scrolled, and anonymised recordings of visits. It runs without cookies, masks anything typed into forms, and only sees what happens on this website. Microsoft processes this data for us under the Microsoft Privacy Statement. Nothing from the app is sent to Clarity.
Erase this device, in the Profile tab, deletes everything Perron holds for you: your passport, your cosmetics and settings, and — if you signed in — the account, the provider identifier and the email address with it, and any of your posts still waiting for the moderator. Where you signed in with Apple, Perron also asks Apple to revoke the sign-in, so the app stops appearing under your Apple ID rather than merely being forgotten on our side. Nothing is held back, and there is no waiting period — the one exception is the pseudonymous moderation record described above, which is excluded from training at once and expires at 180 days.
You can also simply sign out: Perron carries on working anonymously, which is its normal state. To request removal of a specific message, contact us.
Perron is not directed at children under 13 and does not knowingly collect information from them.
If this policy changes, we'll update the date above.
Questions about privacy? Email perron@thenextbeacon.com.