Privacy

Pelican is an AI assistant for iPhone. Pelican stores your chats on your iPhone, and the developer of Pelican never receives them.

Chats and sign-ins

Pelican stores your conversations and the files and photos you attach on your iPhone, and stores your account sign-ins and API keys in the iPhone's Keychain. Spotlight search for your chats uses an index on your iPhone.

Your AI service

To reply, Pelican sends your messages and attachments from your iPhone to the AI service you connect, such as OpenAI, Anthropic or Google, using your own account or API key. When Pelican uses a capability, what the capability returns goes to the AI service too, as part of the chat: for example a web page, a calendar event, or your location. The AI service handles that data under its own terms and privacy policy.

Capabilities

You turn each capability on or off in Settings, under Capabilities.

• Location: Pelican reads your location when a reply needs it, as precisely as you choose, and doesn't track it.
• Apple Maps: Apple receives the place searches and routes Pelican asks for.
• Weather: Apple Weather receives the places Pelican asks about.
• Calendar and Reminders: Pelican reads and changes events and reminders only in the calendars and lists you allow. Changes sync through your calendar and reminders accounts, as changes made in the Calendar and Reminders apps do.
• Contacts: Pelican searches your contacts by name when a reply needs it, and looks up one person's phone numbers, email addresses or postal addresses at a time, only for what you asked, and for a few people per message. What it finds goes to your AI service as part of the chat. You choose which contacts Pelican can see in iOS Settings.
• Private Photo Access: your photos never leave your iPhone. Pelican analyzes them on your iPhone with Eye, an on-device model by Desert Ant Labs, and keeps what it finds there, out of backups: what's in each photo, and when and where it was taken. When you ask about your photos, that information goes to your AI service as part of the chat, but the photos never do; the photos Pelican shows you are shown only to you. You choose whether Pelican knows where photos were taken and whether it includes sensitive photos, and which photos it can see in iOS Settings. To name the places your photos were taken, Pelican asks Apple Maps once for each area about 2 km across where you've taken photos (the area's middle, never a photo or when it was taken), only while you let Pelican know where photos were taken. Pelican downloads the model once from Hugging Face. When the model loads, it tells Desert Ant Labs about once a month, with a random identifier made on your iPhone, so they can count how many people use it; it never sends your photos or what it finds in them. Turning Private Photo Access off deletes everything Pelican found, and the model.
• Mail: Pelican signs in to the email accounts you add straight from your iPhone, with an app password kept in the Keychain on your iPhone, and reads, searches, marks and moves your email there only when a reply needs it. What it reads for you goes to your AI service as part of the chat. Emails Pelican writes wait in the chat, and are sent from your account only when you tap Send. Removing an account deletes its password from Pelican; nothing in the account changes.
• Alarms and Timers: alarms and timers stay on your iPhone.
• Messages and Mail: Pelican fills in a draft in Apple's Messages or Mail composer, and you decide whether to send it.
• Browser: websites receive the requests Pelican makes, as they would from Safari. Each chat keeps its own browser cookies and sign-ins on your iPhone.
• MCP servers: the servers you add receive the requests Pelican makes to them.

Crash reports

When Pelican crashes, Pelican sends a report to the developer: the code that was running, error messages, the app and iOS version, the device model, and a list of the app's recent actions, such as "opened a chat" or "sent a message". Crash reports don't contain your messages, replies, chat titles, websites or account details.

Usage statistics

Pelican sends anonymous usage counts to the developer: for example how many people use Pelican each day, which AI services and models are connected, how many messages are sent, which features are used, and how long replies take. Pelican groups the counts under a random identifier made on your iPhone, which changes if you reinstall Pelican. The identifier isn't tied to your name, an account or your contact details, so the statistics aren't linked to you. The server works out your approximate country from your internet address and doesn't store the address. Usage statistics never include what you write or read.

Pelican Pro

Apple handles payment for Pelican Pro, and Apple never gives the developer your name, email address, Apple Account or payment details. The App Store tells the developer's server about each subscription: the plan, the price, the country of your App Store, and renewals, cancellations and refunds. Pelican also sends the server the purchases it sees, with the same random identifier as the usage statistics, so the developer can tell which offers work. Like the usage statistics, this information isn't linked to you.

Feedback

The feedback form, and Help in Pelican's Settings, send the developer your message, and your email address if you give one so the developer can reply. The server also stores your approximate country and your browser's or app's name, and counts messages from each sender to stop spam without storing internet addresses.

Feedback sent from Pelican also includes Pelican's version, the iOS version, the device model, your language, your Pelican Pro plan, your default AI model, and the random identifier of the usage statistics, so the developer can look into problems with your usage statistics and purchases. If you give your email address, the developer can connect them to you. Feedback never includes your chats.

Advertising and tracking

Pelican has no ads, doesn't track you across other apps or websites, and doesn't sell or share your data.

Keeping and deleting data

The developer deletes crash reports once the crash is fixed, and keeps usage statistics and subscription records to see trends over time. Deleting Pelican removes everything Pelican stored on your iPhone. To ask about your data or have it deleted, use the feedback form.