Legal
Privacy Policy
How MyPerchi collects, uses and keeps data from this website, the reservation form, the dashboard and the devices, with retention periods and deletion.
Last updated 2026-09-19. Questions: support@myperchi.com.
This policy is version 1.0, published on 19 September 2026. It covers myperchi.com, the reservation form, the MyPerchi dashboard, and the Perchi and Perchi Matrix devices. The short version: this website sets no tracking cookies and shows no ads, the reservation form asks only for what an invoice and a delivery need, and the devices send health numbers and app state, never your Wi-Fi password, your pairing code or raw touch readings.
Who we are
MyPerchi makes Perchi, a silent desk companion and phone stand, and Perchi Matrix, an LED desk display. We are a small company in India; our registered office and grievance contact are on the Contact page, where the full address, GSTIN and officer's name are published before checkout opens. For the purposes of the Digital Personal Data Protection Act, 2023, MyPerchi is the data fiduciary for the data described here.
Questions about this policy, requests about your data and privacy concerns go to security@myperchi.com. Complaints go to grievance@myperchi.com, the grievance officer address on the Contact page; we acknowledge them within 48 hours and resolve them within one month.
What this website collects
Visits. We count page views with Plausible, a service that uses no cookies, stores no personal identifiers and cannot follow you across sites. There is no advertising pixel, no fingerprinting script and no consent banner, because nothing on the site needs one. Our web server keeps standard request logs for a short period to detect abuse.
The reservation form. When you reserve a Perchi or a Perchi Matrix we ask for:
| Field | Why we need it |
|---|---|
| Name | For the reservation and, later, the GST invoice |
| Email address | To confirm the reservation, send batch updates and the checkout link |
| Country | India ships first; outside India you join the global waitlist |
| Product and quantity | What we set aside for you and in which batch |
| Phone number (optional) | Only if you type one into the optional "WhatsApp or phone" field on the reservation form; used for dispatch and delivery updates and passed to our courier partner for those updates |
| A note (optional) | Gift messages, team orders, anything you want us to know |
We also record the network address and browser string of the submission to stop abuse of the form. One required box consents to email about this reservation under the reservation terms; it is not consent to marketing, and we send no newsletters unless you ask for them.
Email. Reservation emails (confirmation, batch updates, the checkout link, shipping) are sent through an email delivery provider that sees your address and the message. Marketing email is sent only with your separate consent.
What the dashboard collects
You need a dashboard account to pair a device and install apps. The account holds your email address, your passkeys or the emailed sign-in codes you use, optional two-factor secrets, your workspace settings and the apps, connections and automations you create.
Sign-in and sessions. Passkeys are the default; passwords are off unless a server operator turns them on. The dashboard sets one secure session cookie after you sign in. Sign-in codes are stored only as hashes. Session network addresses are kept in full for 30 days and then shortened.
Connected accounts. When you connect a provider (a Stripe key, a Razorpay webhook, a YouTube handle, a Google sign-in), the secret is encrypted per record with AES-256-GCM, bound to your workspace, masked whenever it is shown again and decrypted only inside the process that fetches your data. Every server-side fetch goes through a guarded egress path that reaches only the provider's allowed hosts.
Public links. If you turn on a public link (message my desk, pixel guestbook, hype button), visitors' messages pass a human check (Cloudflare Turnstile) and a wordlist moderation filter, and by default wait for your approval. Visitors' network addresses are stored as hashes only. An optional AI moderation step exists on the hosted service; it sees the message text and nothing about the visitor.
What the devices send
Perchi and Perchi Matrix talk to the server over one signed, encrypted connection. They send:
- the device's identity: a fingerprint of the key it generated itself, a four-character short id, its model and firmware version, and a capability report (screen size, fonts, effects, serial number);
- hourly health numbers: memory, Wi-Fi signal, frame rate, refresh errors and disconnects, kept for 30 days;
- the state needed to show your apps and to confirm that a firmware update took;
- on Perchi, focus block events: started, paused, resumed, completed or partial, the planned and focused minutes and the project kind. Reports never carry timestamps finer than a minute.
They never send your Wi-Fi password (it travels from your browser to the device and is not stored on the server), the pairing code (checked on the device itself), raw touch or phone-presence readings, or anything a focus room or a Perchi link partner is doing beyond the state idle, working or done for the day. Neither device has a camera or a microphone. Record my Perchi clips are drawn from the events above, never from a camera.
Who else processes your data
| Processor | What for | Data involved |
|---|---|---|
| Plausible | Website visit counts | No personal data |
| Email delivery provider | Reservation and account emails | Email address, message |
| Razorpay | Payment when your checkout link arrives | Name, email, phone, amount; card and UPI details go to Razorpay, never to us |
| Shopify | Order records once the store opens | Name, address, email, order |
| Shiprocket and its courier partners | Delivery and tracking | Name, address, phone, parcel |
| Cloudflare Turnstile | Human check on public links | Visitor's browser signals |
| Backup storage | Encrypted nightly backups of the platform database | Everything above, encrypted |
| The providers of the apps you connect | Fetching your own numbers | Only what that app needs, through your key or sign-in |
We do not sell personal data, we do not share it with advertisers, and we do not use it to train anything.
How long we keep it
| Data | Kept for |
|---|---|
| Reservation details | Until the reservation is fulfilled or cancelled, then as long as tax law requires for the invoice |
| Website request logs | A short rolling window used only to detect abuse |
| Session network addresses | 30 days in full, then shortened to the network prefix |
| Sessions | 14 days idle, 90 days at most; rows removed 30 days after they expire |
| Device health telemetry | 30 days |
| Device commands | 7 days; any secret argument is cleared as soon as the device confirms it |
| App value history | 90 days by default; app events 30 days |
| Public-link messages | Text removed after 30 days, record deleted after 90 days |
| Share clips and Record my Perchi GIFs | 30 days |
| Webhook deliveries | 7 days |
| Pairing sessions and display codes | 30 days after they complete or expire |
| Audit log of account actions | 365 days |
Your rights
You can ask us what we hold about you, correct it, or ask us to delete it by writing to security@myperchi.com; we answer within the time the DPDP Act allows and usually much sooner.
Deleting your account. From the dashboard: confirm your identity, type your email, and every session is signed out at once. The account is scheduled for deletion after a 30-day grace period, and you receive an email with the date. Connected accounts can be revoked and their data scrubbed individually at any time. Deletion requests that Meta sends for Instagram and Threads connections are honoured automatically.
Marketing email. Every marketing email has an unsubscribe link; reservation emails about your own reservation are not marketing and continue until the reservation is fulfilled or cancelled.
Children. Perchi and Perchi Matrix are not designed for children under 8, and dashboard accounts are for adults. We do not knowingly collect personal data from children; if you believe a child has created an account, write to us and we will remove it.
Security
Sign-in uses passkeys first, secrets are encrypted per record, firmware updates are signed, and the local API on your LAN is off until you turn it on. The Security page describes what ships today and what has not been done yet, and how to report a vulnerability to security@myperchi.com.
Changes to this policy
When this policy changes we update the version number and the date at the top, and for any change that affects what we collect or how long we keep it we email dashboard account holders before it takes effect. Older versions are available on request.