Privacy
Short version: we collect as little as we can, we don’t sell anything about you, and we don’t keep your chats.
Who is responsible
Poor Penny (owner pilot), a single human operator. Contact us through the Contact & order help form on the homepage.
Visit counts
We count visits as anonymous browser sessions so we can show honest visit numbers and see which parts of the page are used (for example, “chat opened” or “share clicked”). A random session identifier is kept in your browser for the visit. Known bots are filtered out. We do not store IP addresses for these counts, and the numbers describe sessions, not people.
Chat
Chat messages are sent to an AI model provider to generate Penny’s reply. We do not store chat transcripts, and chats are never added to the public diary. We keep small counters (for example, how many free messages you have used today) tied to a random visitor identifier in a cookie, so daily limits and day passes work.
Forms and emails
When you ask about a website, a noticeboard spot or order help, we store what you send, including your email address. Your email is used only to reply to that request and to handle any resulting order. We don’t add you to a mailing list and we don’t send marketing email.
Ideas and coffee notes
Ideas you leave are reviewed by a human and only appear publicly after approval, with the name you chose (or “A visitor”). A name and note with a tip are shown only if you tick the box to allow it.
Payments
Payments are processed by a third-party payment provider. We receive confirmation of the payment, the amount and the email used for it, but never your full card details.
Browser storage
We use your browser’s local storage for small conveniences (for example, whether you paused animations, or which of Penny’s jokes you have already seen), and a first-party cookie for the visitor identifier described above. There are no advertising trackers.
Abuse protection
To stop spam and runaway costs, short-lived rate-limit counters use a salted one-way hash of your network address (never the address itself). They are deleted automatically after about two days.
Your choices
You can clear your browser storage at any time. To ask us to delete a request you sent, use the contact form with the email you used.