last updated: 17 september 2026 · plain-language policy describing how the app actually works.
pip is built privacy-first. the short version: your full conversation history, memories, and journals live encrypted on your own computer. paid features send only the bounded context needed for a particular operation to our hosted proxy and its AI provider; we do not keep a second copy of your local stores.
this data is written as AES-256-GCM encrypted files in your operating system's app-data folder. the encryption key and your sign-in secrets are kept in your operating system's credential vault (Keychain on macOS, Credential Manager on Windows), not in plain text. you can delete all of it any time in My Brain → Workshop → Data → "erase everything on this computer" ("make pip forget everything" clears what pip learned but keeps your settings and licence). typical locations:
~/Library/Application Support/com.pip.desktop/%APPDATA%\com.pip.desktop\ (Microsoft Store installs keep this inside the app’s private package folder, which Windows removes when you uninstall)to power focus sessions, gentle proactive presence, and build mode, pip can look at which application is in the foreground and that window's title, plus how long you've been idle. this observation is off by default — nothing is observed until you turn it on in the workshop, and you can turn it back off at any time. it is metadata only: pip never takes screenshots, never reads your keystrokes, and never reads the contents of your files, messages, or pages.
window titles are sanitised on your device before pip ever uses them: email addresses, links, file paths, anything that looks like a password or key, and probable personal names are stripped out. this signal stays on your machine. sending anything to the model is a separate, second choice: only if you also switch on "include a coarse activity summary in hosted replies" will a short category summary (for example, "about 40 min in a coding tool today") travel with a reply. it never includes window titles, filenames, project names, or commands. both switches are yours to revoke whenever you like.
pip reacts to the weather where you are: it holds an umbrella when it's actually raining on you, goes quiet in fog, watches the snow. your app never sends us a location. it doesn't read GPS, it doesn't look your address up, and it never asks you for a city.
instead, when pip asks our service for the weather, we use the approximate location that request already arrives with (the same rough area any website can see from a connection), rounded to about 11 km before it is used. that rounded area is all we ever handle: it isn't stored, isn't logged, and isn't attached to you. everyone in the same rounded area shares one cached answer, so we usually don't look anything up at all. you can switch the whole thing off in the workshop.
that guess is wrong for anyone on a vpn or a work connection, so the workshop shows you the area pip is using and lets you correct it by typing a town. if you do: the name you type is sent to our service to look up, and the town you pick is saved on your machine and sent with each weather request — rounded to the same ~11 km, never more precise than the automatic guess. it is not stored on our side, and "use my connection instead" clears it. pip never reads your gps and never asks your operating system where you are.
when your plan is active and you send a message, pip sends the current turn plus up to 20 recent turns and a small, locally selected context bundle (for example, up to five relevant memories, your profile, agenda, writing preferences, and optional activity/weather summaries). the complete local history and memory files are not uploaded; selected excerpts can be sent because they are what makes a personalised reply possible. free preview replies are generated locally and do not use this hosted path.
paid background features are separate operations. when enabled, bounded conversation windows, selected memories, theories, reflections, people notes, predictions, or dreams may be sent to extract memories, write reflections, or make a gentle synthesis. if you enable "almost-said", a deleted draft can be sent for a short topic-only extraction; turn that feature off and deleted drafts are not kept. these operations run only with an active plan.
the hosted proxy runs on Cloudflare, keeps the AI key server-side, calls Anthropic's Claude, and returns the result to your machine. we do not retain prompts or replies beyond what is needed to deliver a request and operate the service (for example, short-lived request logs and abuse/usage metering).
if you choose to add a friend, pip passes short notes between your desktops through short-lived mailboxes on our Cloudflare service. to do this we relay: a random per-install id, your friend code, the display name and creature look you chose, and the short notes you send. these are kept only briefly — messages for up to 7 days (max 50, up to 240 characters each), friend cards for up to 180 days, and a "last seen" timestamp for up to 30 days — then they expire automatically. the conversation threads themselves live encrypted on your device; "forget everything" wipes your local social data. if you never add a friend, nothing social ever leaves your machine.
the playground is a shared outdoor map you can walk your pip into. it is the one part of pip where strangers can see you, so it is worth being precise: while you are connected, the display name you chose, your creature look, and your pip's live position on the map are relayed through our Cloudflare service to the other pips in the same area, and theirs to you. nothing from your conversations, memories, reflections, or activity is ever sent to the playground — it carries movement and appearance only.
your desktop is not identified to anyone. the id used in a playground area is a one-way scramble of your install id, and joining uses a single-use ticket that expires in sixty seconds, so your licence and device credentials never travel with it. if you claim a plot, we keep one row — that scrambled id, the plot number, and the name and look you chose — for up to 180 days after your last visit, then it is deleted and the plot is freed. if you never open the playground, none of this ever leaves your machine.
if you run a business on Stripe, you can connect it so pip's morning brief shows today's sales. pip asks for a restricted, read-only key that you create in your own Stripe dashboard with a single permission ("Balance: Read"); it refuses full secret keys. pip on your PC then reads your balance transactions — sales, refunds, and whether they have settled — directly from Stripe. neither the key nor your sales pass through our service, and we never see them.
the key is kept in your operating system's credential vault; the sales it reads stay in pip's encrypted local files and are included in your data export. disconnecting deletes the key and the cached sales from your PC — delete or roll the key in your Stripe dashboard too. "erase everything on this computer" removes both. Stripe's own privacy terms apply to your Stripe account.
so we can see how many people use pip and keep the service running, our service keeps a small activity record for each licence or trial: a scrambled id (a code, not your name, email or device), your plan, and when it was first and last used. it is updated when pip activates, starts a trial, renews its sign-in, or makes a hosted request.
we also count how many people were active each day, and in which country, as totals only (for example, "12 in India today"). the country is Cloudflare's estimate for the connection and is added to that total and nothing else — it is never stored with your id, so the record cannot say where you are. the free preview never contacts us, so it is never counted.
daily records are deleted after 35 days, and your activity record 180 days after you last used pip. you can ask us to delete it sooner through the data request page.
the app may check a versioned update endpoint so it can offer you new versions. that check does not send your personal data.
the desktop app stores your licence renewal key and device credentials in your operating system’s secure credential vault, not in chat history or data exports. the key is sent over an encrypted connection to our licensing service and payment provider when activating or periodically rechecking your purchase. our licensing service stores a hashed licence reference, device binding, plan, and activation/session-refresh timestamps. authorised support staff can look up linked devices and recent session activity; this does not give them access to local chats or memories. “recently seen” is not live presence. erase-everything removes local credentials; use our data request guide for server-side licensing records.
payments are handled by our reseller, Dodo Payments, who acts as merchant of record. when you buy, they process your payment and email you a licence key. we receive limited order information (such as your email and which plan you bought) to provide support and manage your subscription. we do not see or store your card details. Dodo Payments' own privacy terms apply to checkout.
we keep third parties to a minimum. they are: Anthropic (generates AI replies from the context described above), Cloudflare (hosts our proxy, metering, downloads, pip-social mailboxes, and the playground areas, and supplies the approximate network location used for weather), Open-Meteo (receives only the Worker-rounded weather coordinate, and — if you correct your area — the town name you typed), Dodo Payments (payments and licensing), Netlify (hosts this website, and like any web host briefly logs the requests your browser makes to it), and Meta (optional marketing measurement only, after consent). Each receives what it needs for its function; their own privacy terms apply to those requests.
the site uses essential local storage to remember your cookie choice. Meta Pixel is a separate, optional marketing measurement tool: it is off until you choose “Allow marketing” in the cookie banner. Choosing “Reject marketing” does not limit downloads, trials, purchases, or app features. You can change the choice at any time in Cookie settings. The website’s Fraunces and Hanken Grotesk typefaces are self-hosted; Google is not contacted for typography.
Pip is not directed to children and is for people aged 16 and over. We do not knowingly collect or process personal information from anyone under 16. If we learn that this has happened, we will delete it. A person under 16 must not use hosted replies, Brain mapping, social, or website marketing measurement. This avoids treating a checkbox as parental consent where the law requires verifiable parental consent.
because your data is local, you already hold and control it — you can inspect it in the app and erase it with “erase everything on this computer.” For a purchase, social-relay, or other cloud-data request, use our data request guide or contact support@doorado.in. Pip is provided by Doorado, based in New Delhi, India. We respond to every data request within 30 days. If you are not satisfied with our answer, you may complain to the data protection authority where you live.