Privacy notice
What we collect, why, where it lives and what you can ask us to do with it.
The short version. On your computer, Pip works without an account and what you write stays on your device. The browser version asks you to sign in, and on Free what you write still stays in that browser. On Free, nothing you write is uploaded, your notes included, with one exception: a shared project you join is uploaded, so everyone in it sees the same tasks. With Pro, your tasks and notes are stored in Frankfurt so your devices can share them. They’re encrypted at rest but not end to end, so we could technically read them. We don’t, except to keep the service running or when you ask us for help. No data is sold, there are no ads, and this website sets no cookies. It counts visits with Cloudflare Web Analytics, which doesn’t follow you to other sites or build a profile of you.
1. Who is responsible
The controller of your personal data is Catalin Vintila, an individual developer based in the United Kingdom. For anything about privacy, write to hello@pipdot.app.
2. Free: what you write stays on your device
On the free plan, Pip keeps your tasks in a small database on your computer and your notes as Markdown files in the Pip Notes folder you chose. Your name, if you give one, and your settings are stored locally too. None of this is sent to us, except a shared project you join (see Shared projects).
The browser version keeps the same things in the browser’s own storage on your device, notes included. It needs an account (below), so we hold your email address, your name if you give one, and your plan; on Free, your tasks and notes are not uploaded, except a shared project you join.
Signing out or deleting your account doesn’t wipe the device. When you sign out, Pip asks whether to keep your tasks and notes on that computer or in that browser, or remove them. Deleting your account leaves them there too. On a shared computer, choose to remove them when you sign out, or clear the browser’s data for app.pipdot.app.
The apps don't send analytics or crash reports to us. On the iPhone, if you have chosen to share analytics with app developers in your iPhone's settings, Apple passes us anonymous crash reports and usage figures; you can turn that off in Settings › Privacy & Security › Analytics & Improvements. If Pip ever collects anything itself, it will be off until you turn it on, and this notice will be updated first.
3. What we process, why, and for how long
| What | Why and legal basis | Kept for |
|---|---|---|
| Account: your email address, your name if you give one, your plan and until when it runs, an account ID, one-time sign-in codes, sign-in times | To create your account and let you sign in: required in the browser version, and for Pro on any device. Contract (GDPR art. 6(1)(b)). | Until you delete your account. Sign-in codes expire within minutes. |
| Synced tasks: task titles, notes on tasks, checklists, dates, projects, areas, tags, and the device IDs needed to sync | To keep your tasks the same on all your devices. Contract. | Until you delete them or your account. Deleted data leaves backups within 30 days. |
| Synced notes (Pro): the Markdown files in your Pip Notes folder, their names and folders | To keep your notes the same on all your devices, including iPhone and the browser. Contract. | Until you delete them or your account. Deleted data leaves backups within 30 days. |
| Shared projects: a project you share or join: its title, notes, colour, deadline, status and headings; its tasks’ titles, notes, checklists, deadlines, repeats, completion and order; who is in it (each person’s account ID, name or initial, and role); the invitation links, stored only as a one-way hash; and, for an email invitation, the address it was sent to | To keep a shared project the same for everyone in it. Contract. Sending an invitation to the address the owner types: the owner’s legitimate interest in inviting someone (art. 6(1)(f)). | The project, while it exists. The record of who was in it (each person’s account ID, role, and when they joined and left) until that person deletes their account. An email invitation, with its address, until the owner deletes their account or you delete yours, or sooner if you ask us. What a member added stays in the project after they leave or delete their account. A one-time link stops working after its first use or 7 days, an email invitation after 14 days, a reusable link when the owner turns it off. |
| Plan and purchases: plan, subscription status, order ID, country, and the email you bought with (from Lemon Squeezy). If you buy on the iPhone, the Apple transaction record: the transaction IDs, the product, the purchase, renewal and expiry dates, and whether it was a real or a test purchase. Never your payment details | To give you Pro and help with billing questions. Contract. Keeping sales records is a legal obligation (art. 6(1)(c)). | For as long as you have Pro, then as long as UK tax and accounting law requires. |
| Waitlist: your email address, when you signed up and confirmed, which form you used, and the consent sentence you agreed to | To send you one email when Pip is ready. Your consent (art. 6(1)(a)), which you can withdraw at any time. | Until we have sent that email or you leave the list. Sign-ups that are never confirmed are removed after 30 days. |
| Waitlist abuse protection: a salted, one-way hash of your IP address (never the address itself) and a count of sign-ups from it | To stop one person or a bot flooding the list. Legitimate interest (art. 6(1)(f)). | Deleted within a day. |
| Emails you send us: your address and what you write | To answer you. Legitimate interest in helping our users (art. 6(1)(f)). | As long as needed to help, and at most 2 years after the conversation ends. |
| Emails we send you: your address and the message, such as a sign-in code, an account notice, or an invitation to a shared project that someone sent to your address | To sign you in, tell you about your account, and deliver an invitation. Contract; for an invitation, the inviting owner’s legitimate interest. | Delivery logs at our email provider for up to 30 days. |
| Website requests: IP address, browser and page requested | To deliver this website and protect it from abuse. Legitimate interest. | Short-lived logs at our hosting provider. |
| Website visits: the page you open (without anything after the “?” in its address), the site that sent you, your country, your browser and device type, and how fast the page loaded. Counted by Cloudflare Web Analytics, which sets no cookies and stores nothing on your device | To see which pages people read, as totals. Legitimate interest (art. 6(1)(f)). | We only ever see totals. Cloudflare keeps the underlying data under its own retention rules. |
On Free, your notes folder is not uploaded by Pip. If you keep it in OneDrive, iCloud Drive, Dropbox or a similar service, that service syncs it under its own terms, on your computers only. With Pro notes sync, Pip uploads your notes so it can sync them to all your devices, as listed above.
Shared projects
With Pro, you can share a project by link or by email, with up to 8 people in it, you included. The people you invite join free, with a Pip account. A shared project is kept in the EU (Supabase, Frankfurt) like the rest of sync, and it is uploaded for everyone in it, Free members too.
- Who sees what. Everyone in a shared project sees its tasks and headings, and each other’s name (or “Someone” for a person who hasn’t given one). The owner also sees the current members’ email addresses; the members never see each other’s. Anyone who has a working invitation link can see the project’s title, the owner’s name and how many people are in it, on the join page.
- What stays yours. When you plan to do a task, its tags and its reminder stay your own and are not shared. Your notes are never part of a shared project.
- Email invitations. When the owner invites someone by email, that address is sent to Resend to deliver one email, and kept with the invitation until the owner deletes their account or you delete yours (write to us to have it removed sooner). The invitation works only for that address, for 14 days.
- Leaving and removing. A member can leave, and the owner can remove a member. From then on nothing is shared with them; they keep their own copy of the project, archived, on their devices. If the owner stops sharing or deletes the project, the members keep an archived copy in the same way. If the owner’s Pro ends, sharing pauses until it comes back, and nothing is lost.
- Deleting your account. What you added to someone else’s shared project stays in that project, and passes to its owner, like edits to a shared document. Projects you owned stop being shared.
The waitlist
If you leave your email in a "Tell me when it's ready" form, we store it in the EU (Supabase, Frankfurt) as not yet confirmed and send you one email with a confirmation link (through Resend, from its EU region). Only after you click it are you on the list. We then send one email when Pip is ready, and nothing else: no newsletter, no sharing, no tracking pixels.
Every email we send has an unsubscribe link. To leave the list, use it, or write to hello@pipdot.app. We delete your address from the list straight away. If you never confirm, your address is deleted after 30 days. Confirmed addresses are kept until we have sent the launch email or you unsubscribe.
We don't use your data for advertising, we don't sell it, and we don't make automated decisions about you that have legal or similarly significant effects.
4. Who helps us
We use a small number of providers who process data for us under data processing agreements:
- Supabase (Supabase, Inc.): accounts, the waitlist, the sync database and, with notes sync, your synced notes. Data is stored in the EU, in Frankfurt, Germany.
- Resend (Resend, Inc.): sends sign-in codes, account emails, shared-project invitations and waitlist emails from its EU region (Ireland).
- Cloudflare (Cloudflare, Inc.): hosts this website and its domain, and counts visits to it (Web Analytics, without cookies).
Lemon Squeezy (Lemon Squeezy, LLC) is the merchant of record for Pro. When you buy, you give your payment and billing details to Lemon Squeezy directly, and it handles them as an independent controller under its own privacy policy. We receive only what we need to give you Pro, listed above. If you buy Pro inside the iPhone app, Apple is the seller and handles your payment under its own privacy policy. We receive the Apple transaction record listed above, so we can give your account Pro, and never your payment details.
5. Transfers outside the EU
We keep your synced data in the EU. Some of our providers are US companies and may access data from outside the EU, for example for support or security. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
6. Security
Data travels encrypted (TLS) between your devices and our servers, and is encrypted at rest by our database provider. Access rules in the database mean only your account can read your synced tasks and notes. Synced tasks and notes are not end-to-end encrypted, so they are technically readable by our systems. Only we have administrative access, and we use it only to keep the service running or when you ask us to help.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, export it in a common format, restrict or object to how we use it. Write to hello@pipdot.app and we'll answer within one month. You can also delete your account yourself in Pip's settings, which deletes your account and your synced tasks and notes. What you added to other people’s shared projects stays there (see Shared projects), and the tasks and notes on your devices stay until you remove them.
If you think we've handled your data wrongly, you can complain to the UK Information Commissioner's Office, ICO, or to the data protection authority in the EU country where you live. We'd be grateful for the chance to fix it first.
8. Children
Pip is not meant for children under 16, and we don't knowingly create accounts for them.
9. Changes
If we change this notice in a way that matters, we'll tell you by email or in the app before the change applies. The date at the top always shows the latest version.