The short version. Pippin is a planner. We collect what we need to schedule your day across your devices, nothing more. We don’t sell your data or use it for advertising. Some features — the AI assistant, sleep tracking, location — are optional and explained in plain language below. Questions? pippinaiteam@gmail.com.
This Privacy Policy explains what information Pippin (“we,” “us,” the “App”) collects, why, who processes it on our behalf, how long we keep it, and the choices you have. It applies to the Pippin iOS app and related services.
1. What we collect and why
| Category | Data | Why |
|---|---|---|
| Account | Email address, display name | Create and secure your account; sync across devices |
| Schedule & tasks | Events, tasks, categories, durations, locations, notes, completion status | The core planner — storing and syncing your schedule |
| Sleep & energy | Bed/wake times, sleep duration and a computed fatigue score | Tuning your daily capacity (only if you enable sleep features) |
| Personalization | Facts you ask Pippin to remember (e.g. your major, commute) | Smarter AI suggestions — opt-in, and editable any time |
| Usage | A monthly AI token counter; basic product analytics (if enabled) | Enforcing fair-use limits and improving the app |
| Subscription | Subscription status and anonymized purchase identifiers | Unlocking and verifying Pippin Plus |
2. Device permissions
Pippin only requests a permission when you use the feature that needs it, and you can change your mind in iOS Settings at any time.
- Calendar — to read your events and write the ones Pippin schedules, so your plan and your calendar stay in sync.
- Apple Health (sleep & workouts) — optional. If you connect it, Pippin reads recent sleep and workout data to estimate your daily energy. Your sleep summary is synced to your account; workout details are used on your device and not stored on our servers.
- Location — optional and approximate. Used to calculate local sunrise/sunset and to help with place suggestions. Your precise coordinates stay on your device and are not stored on our servers. If you ask the AI assistant something location-aware, only your general city / region is included in that request.
- Camera & Photos — optional. If you attach a photo (for example, a syllabus) to the AI assistant, that image is sent to our AI provider for analysis (see §4).
- Microphone & Speech Recognition — optional. Used to transcribe voice input into text. We don’t store your audio recordings.
- Notifications — to remind you about upcoming events. These are scheduled on your device.
3. Sign-in & security
- Email / password — your email and a hashed password, managed by Supabase Auth.
- Sign in with Apple — Apple shares a name and email (or a private relay email); no other Apple data is accessed.
- Google — your Google account name and email; no other Google data is accessed.
Sign-in tokens are stored in the iOS Keychain. Data in transit is protected with TLS, and access to your records is restricted to your account through database-level row security.
4. AI features & third-party AI providers
Pippin’s AI assistant and automatic scheduling are powered by large language models that we access through OpenRouter, which routes requests to underlying model providers (currently Google and, for web-search answers, Perplexity).
What is sent when you use an AI feature: your chat messages, the relevant tasks and events (titles, times, locations, categories), any image you attach, and — only if you’ve turned on personalization — the facts you asked Pippin to remember. Your general city/region is included only for location-aware questions.
What is never sent to AI providers: your email address, your password, your payment details, or your precise GPS coordinates.
AI providers process your request to generate a response and handle that data under their own privacy policies (see OpenRouter, Google, and Perplexity). The AI features are opt-in, and you can disable AI data sharing at any time in Settings without losing the rest of the app. Because attachments are sent to these providers, please don’t upload sensitive documents you wouldn’t want processed by a third party.
5. Third-party services
| Service | What it receives | Purpose |
|---|---|---|
| Supabase | Account, schedule, sleep, personalization, usage | Database, authentication, and sync (policy) |
| OpenRouter + AI providers | AI requests (see §4) | Powering the AI assistant and scheduling (policy) |
| RevenueCat | Anonymized user ID, subscription & transaction status | Managing Pippin Plus (policy) |
| PostHog | Anonymized product events (no schedule content) | Aggregated analytics to improve the app — consent-based; no session recording, no advertising IDs (policy) |
| Apple | Purchase records; Health/Calendar access on your device | In-app purchases and system integrations (policy) |
6. We don’t sell your data
Pippin is funded by Pippin Plus subscriptions, not advertising. We do not sell your personal information, schedules, or usage data, and we do not use them for cross-app tracking or advertising. We use no advertising SDKs and do not access Apple’s advertising identifier (IDFA).
7. Subscriptions & billing
Pippin Plus is an auto-renewing subscription processed entirely through Apple’s In-App Purchase system — we never see or store your payment details. RevenueCat receives an anonymized identifier and your transaction status to verify access. You can manage or cancel in iOS Settings → [your name] → Subscriptions; cancellation stops future charges and access continues until the period ends.
8. Data retention & deletion
- Account & schedule data — kept while your account is active. When you delete your account, your data is removed within 30 days.
- AI requests — we don’t keep your prompts after the response returns; providers handle any retention under their own policies.
- Analytics — anonymized and retained per PostHog’s standard retention.
You can delete your account and all associated data directly in the app under Settings → Delete Account — no email or form required. If you signed in with Apple, your Apple authorization is revoked as part of deletion.
Note: deleting your account does not automatically cancel an active Pippin Plus subscription. Cancel it in iOS Settings → Subscriptions to avoid future charges.
9. Your rights
Wherever you live, you can access a copy of your data, correct your account details, delete your account, export your schedule (email us), and withdraw AI consent at any time. To make a request, contact pippinaiteam@gmail.com; we respond within 30 days. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including the right to object to certain processing and to lodge a complaint with your local authority.
10. Health & wellbeing
If you enable sleep features, Pippin estimates a “fatigue” signal from your sleep to help plan your day. This is for planning only and is not medical advice and not a diagnosis. Please talk to a healthcare professional about any sleep or health concerns.
11. Children & students
Pippin is built for students, including those in high school. It is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child under 13 has used Pippin, contact us and we’ll delete the data. For users 13–17, we collect only what the planner needs, never use data for advertising, and encourage parental guidance around sharing information with AI features.
12. Changes
We’ll update this policy as the app evolves. Material changes update the effective date above and are surfaced in the app. Continued use after a change means you accept the updated policy.
13. Contact
Questions, requests, or concerns: pippinaiteam@gmail.com.