Privacy, plainly.

Your account

When you sign in with Google, we store your account identifier, email address, and name to identify your account. Where Apple sign-in is available, we use the identifier, name, and email Apple provides, which may be a private relay address. We do not request access to Gmail, Drive, Calendar, or your contacts.

On the website, a necessary session cookie keeps you signed in for up to 30 days. It is not used for advertising. The native mobile app uses Firebase Authentication and device-held sign-in credentials instead of that browser cookie. Google and Firebase handle identifiers and sign-in information. Their authentication services may receive technical data such as IP addresses, device or SDK information, and diagnostics to operate and protect sign-in. Google’s sign-in SDK may use an IP address to estimate a device’s general location for fraud prevention. The app does not request GPS or location access. Read Google’s sign-in data information.

What you save here

Pipwild stores the content you save, including journal entries, notebook photos, tasks, habits, focus blocks, reviews, conversation text and cited passages, and settings. An optional profile can hold preferences you choose to share with the app. Unsaved text drafts may remain in browser storage on that browser, separated by account. They do not become synced journal entries until you save them.

The native mobile app keeps unsaved text and pending saves in encrypted recovery files on that device, separated by account. Its encryption key is held in device secure storage. Selected photo originals can remain in the app’s private storage while a draft or recovery copy needs them; those photo files are not encrypted by the draft encryption layer. Signing out clears that account’s local copies on the current device. Saving a note syncs it to your account. Local recovery is not a backup service; keep an export of anything important.

Dictation puts recognized words into your current text box. In the public app, stopping the mic sends that recording to ElevenLabs. Pipwild removes its temporary server copy when the request ends. Dictation does not create a journal entry or send a conversation until you choose Save or Send.

Dictation audio stays temporarily in memory while we turn it into text. If that fails, you can retry the current attempt. Inserting the words, dismissing the attempt or closing the page releases that audio. In the native app, leaving the recording screen or putting the app in the background also discards the attempt. We do not save new dictation recordings in your account, browser storage, or app files. Talk uses the same flow. You can edit its words before sending them to Pip.

Photos you save remain attached to your notes and sync across your signed-in devices. An original photo may include embedded details such as the date it was taken, the camera model or a location. We keep those details with the original, including in exports. A selected photo can keep an account-specific browser recovery copy until you upload or discard it. Existing attachments saved before this dictation update remain in your account until you delete them.

This is a hosted service. Account records are stored in Google Cloud Firestore, and original attachments are stored in a private Google Cloud Storage bucket. Google Cloud Run operates the service. Your content is associated with your account so you can open it from another signed-in device.

Private habit controls conceal the habit name in the interface. They do not remove the habit from account storage or from an export you choose to download.

When an AI provider receives content

Provider requests happen when you choose dictation, capture reading, organizing, or a conversation action. When you organize a journal entry, Anthropic receives the selected text. Optional context for organizing can include your profile preferences and a summary of activity counts. For photo reading, we turn a copy upright, reduce its size if needed and remove embedded metadata. Anthropic receives this JPEG copy without profile context. Your saved original stays unchanged. ElevenLabs receives microphone audio for speech transcription. In conversation mode, Anthropic receives the message you send, the conversation context needed to reply, and any optional journal context you choose to enable. If profile context is on in Settings, conversation requests also include your profile name, preferences, interests, and available minutes. Profile context starts turned on, and you can turn it off. When you choose to hear a reply aloud, or enable spoken new replies, ElevenLabs receives the reply text to create spoken audio. Spoken replies are off by default. Generated reply audio is played for the conversation and is not saved as a journal attachment.

These providers receive the content needed for the action. The app does not monitor other apps, read your messages in the background, or send all of your account content just because you signed in.

AI results can be wrong. You can review recognized text and edit proposed tasks before accepting them. Providers have their own data policies and retention rules, which may differ from ours.

In the native app, you can report a Pip reply from the conversation. The report sends the selected reply and your reason to Pipwild, with your account identifier and the conversation and reply identifiers. It does not submit your whole notebook. Reports are available to the operator for reviewing problems and improving safeguards. They are included in your account export and kept until account deletion. Deleting the conversation does not remove its separate report copy; contact us if you want that report removed sooner.

Anthropic API retention information ElevenLabs privacy information Google privacy information

Optional journal memory

Journal memory starts turned off. If you enable it, the app can use relevant passages from your saved journal and the memories you approve to help with a request. This can include older entries. Selected context is sent to Anthropic with that request. Your other accounts and other people’s notebooks are not part of it.

You can inspect saved memories and their source passages, forget individual passages, exclude an entry, clear saved memories, or turn memory off. Clearing memories also turns memory off. Forgetting a passage prevents its use in future retrieval, and excluding an entry removes its saved memories. Turning it off stops its use in future AI requests. It does not erase an earlier provider request or the journal entry it came from. Delete an entry separately if you want to remove that source from your account.

Deleting a journal entry also removes memories linked to it. Editing an entry invalidates remembered quotes that no longer match its text. Forgetting a passage, clearing memories, deleting an entry, or changing its cited words also replaces affected saved AI replies with a removal notice. This does not erase content already sent to an AI provider. Deleting a conversation removes that chat; it does not delete the journal passages it referred to.

A remembered passage records something you wrote at a point in time. It may be incomplete or out of date. You can correct your journal or remove a memory, and you should check a reply’s cited sources before relying on it.

Why we use this information

We use account information and saved content to provide the app, keep each person's data separate, perform the actions they request, and respond to support requests. Technical service records may include request times, network information, and errors needed to operate the service and limit abuse. Routine service logs are kept for 30 days.

There are no ads or payments in Pipwild. We do not sell your journal content or use it for advertising. Server-side usage limits help keep the free service available. Each account has 2,000 MiB of original-file storage (about 2 GB), with up to 20 MiB per file. Reusing a saved original counts it once.

Optional mobile usage counts

Usage sharing in the native mobile app starts off. You can turn it on or off in the native app’s Settings. This choice belongs to your account and applies across its native app sessions. It is separate from your website analytics choice.

If you allow it, we keep daily counts of fixed action types, whether they succeeded or failed, broad error categories, and which rooms you opened. A daily flag records opening the app. A one-way code tied to your Pipwild account connects these counts across days. The record contains no writing, task or habit names, note or conversation identifiers, photos, audio, advertising identifier, persistent device identifier, IP address, or user-agent string.

We use these counts to see which features work and whether people return. The operator can read aggregate reports. The records stay in Pipwild’s private Google Cloud database; no external analytics SDK or advertising service receives them. We keep up to 30 UTC days of summaries and the first recorded active day. The whole record expires 30 days after its last allowed activity. Expired records stop appearing in reports immediately and are removed by scheduled database cleanup, typically within another 24 hours.

Turning this choice off removes the native usage record and stops future collection. Requests made under your earlier permission cannot add the counts back. Account deletion also removes the record. Your account export includes the consent choice and any current usage counts. Restricted recovery copies can remain for up to seven more days. Turning native usage sharing off does not change a separate website analytics choice.

Optional website analytics

Analytics starts off. If you choose Allow analytics, Pipwild uses a first-party cookie to connect visits in this browser for up to 30 days. A separate activity-session cookie lasts 30 minutes after activity. Your allow or deny choice is also stored in this browser so it can be remembered. These cookies are separate from the necessary cookie that keeps you signed in. The current account-and-campaign disclosure requires a new Allow choice; an earlier analytics choice does not allow this collection.

We count named pages, landing-page sections, buttons, free-tool copies and downloads, rooms, and whether a feature succeeded or failed. Campaign links can provide a source, format, and campaign from a fixed list. Your browser can also classify a referring search or social site into a fixed source name; the full referring address stays in your browser. We do not save full URLs, search queries, referring URLs, writing, email addresses, names, task or habit titles, conversations, photos, recordings, or screen replays in analytics. There are no advertising trackers.

With analytics allowed and a Google account signed in, we also count days when you successfully save work in the app. A separate one-way code made from the account combines activity across browsers where you allow analytics. This code is not added to browser events, and reports contain totals only. Visits and settings changes do not count as active use. The record keeps up to 30 UTC active dates and its first observed active day. Older daily dates are trimmed when another active day is recorded. The whole record expires after 30 days without a recorded active day. Account deletion removes its active dates; an empty deletion marker can remain for 30 days to stop a late write.

On the first saved action we record for an account, we may also attach the source, format, and campaign from its first accepted page view in the current consenting session. These are labels from the fixed list, never a full link or referring address. This separate account association has a fixed 30-day expiry from that observation. Returning to Pipwild does not extend it, and later campaign visits do not replace it. A missing or expired association is shown as “Not attributed,” separately from an observed direct visit. We do not fill missing associations from later visits or try to match accounts to browser records by email, timing, or IP address. Deleting an account removes its campaign association along with its active dates.

Two optional cookies carry the temporary campaign context and keep it separate when you sign out or switch accounts. They are only used after the current Allow choice. Each has a fixed 30-minute lifetime; browser activity does not extend that lifetime. After expiry, opening a new page can start a new period.

The site owner can read reports of these counts. Visits describe browsers that opted in; active use describes consenting accounts. Campaign reports group first recorded saved actions and count accounts that save again on the next day (D1) or seven days later (D7), using UTC dates. A return day must finish before its accounts enter the rate calculation. These counts do not tell us where someone first found Pipwild or prove that a campaign caused their activity. These do not include all visitors or exact people. Demo and internal test activity is excluded. Individual analytics events and browser identifiers expire after 30 days. Anonymous daily quota totals can remain for 32 days. Recovery copies can remain for up to seven more days. You can say No thanks as easily as you allow them, then change your choice in any public-page footer or in Settings. Withdrawing clears the analytics cookies in this browser and stops future collection. Existing counts expire on their normal schedule. Global Privacy Control and Do Not Track signals keep optional analytics off.

Free tools and optional email

The journal prompts and return-note worksheet work without an account or email address. Text you type stays on that page unless you choose to continue in Pipwild. That choice keeps a temporary copy in the same browser tab so you can review and edit it after Google sign-in. The copy is available for two hours. After you save or discard, the app tries to remove the temporary copy. If your browser blocks that change, it asks you to close the tab. It becomes part of your account only when you choose Save entry. The demo does not open this note. Copying, downloading, or printing puts a separate copy where you choose.

When email delivery is available, you can ask for a resource by email. We use your address to confirm the request and send the resource link. Getting-started emails require a separate choice. Account reminders also start off and have their own switch and time in Settings. Signing in or using a free tool does not subscribe you to either.

Email records are separate from the notebook. They include your address, selected resource, consent date and version, confirmation status, email choices, timezone, and delivery status. Account email choices are linked to your account so deletion and changed preferences stop queued messages. We use limited activity counts to skip steps you have already tried and reminders you do not need. Journal entries, task and habit names, photos, and recordings do not appear in campaign emails.

Resend sends these emails and receives the recipient address, message, and delivery information. We keep open pixels and per-recipient click tracking off. Ordinary campaign links use fixed tags; website analytics still requires its separate consent. Read Resend’s privacy policy.

Each optional email includes a link to stop all Pipwild emails without signing in. Settings also lets you turn them off. Unsubscribing cancels queued messages; a message already handed to the provider may still arrive. A request awaiting confirmation expires after seven days, and a resource-only contact expires after 30 days. Active email choices stay until you withdraw them or delete your account. A minimal address hash and suppression record remain to honor unsubscribes, bounces, and complaints. Recovery copies can remain for up to seven more days.

Your controls and deletion

You can edit or delete saved entries and download an export from Settings. Exports can contain private text and original attachments, so keep them somewhere you trust.

You can delete your account in Settings by confirming with the word DELETE. This removes the account's active app data and original attachments and ends its sessions. Saved account records are kept until you delete them or your account. Temporary demo accounts expire after 30 days. Unsaved drafts in browser storage and encrypted mobile recovery files on other devices are not remotely erased. Remove those local copies or the app separately on each device. Copies you exported or shared are also outside this deletion.

Deleted account data may remain in database recovery copies and daily backups for up to seven days. Deleted attachments may remain in cloud storage recovery for up to seven days. These copies are restricted to service recovery and are not used by the app during normal use. AI providers may retain submitted content under their own policies. Deleting your account here does not delete your Google or Apple account.

You can also request account deletion without the app. For access, correction, deletion, or other privacy requests, email hello@pipwild.com. We may need to verify that the request belongs to the account owner.

Who the app is for

Pipwild is for adults aged 18 and over. It is not intended for children. If you believe a child has provided personal information, contact us so we can look into it.

Changes and contact

If this policy changes, we will update the date on this page. The operator is Tony Montes. For questions about this policy, contact hello@pipwild.com.