Pip only works if you trust it with your inbox, so we keep this simple and honest. Here's exactly what Pip touches, what it stores, and how to get rid of it.
The short version. Pip reads your email receipts (read-only), never your email password, and never your bank. We use your data to build and manage your subscription list, and for nothing else. We don't sell it. You can delete it whenever you want.
When you connect a mailbox, you grant Pip read-only access through Google's or Microsoft's official sign-in (OAuth). Pip searches for receipts, invoices, and renewal notices to find your subscriptions. It cannot send, delete, or change your email, and it never sees your email password. You can revoke access from Pip or from your Google/Microsoft account settings at any time.
Only to run the service for you: to detect and display your subscriptions, warn you before renewals, and help you cancel when you ask. We don't sell your data, we don't use it for advertising, and we don't share it except with the processors below that make Pip work.
Pip relies on a few trusted services, each handling only what's needed:
Your data is stored on Pip's server and kept while your account is active. Delete your account, or disconnect a mailbox, and the associated data is removed. During the beta, some technical logs (for debugging and cost tracking) are kept for a short period and then cleared.
Access to your inbox is via read-only OAuth, mailbox tokens are encrypted at rest, passwords are hashed, and traffic is served over HTTPS. No system is perfect, and Pip is in beta, so please connect an inbox you're comfortable sharing receipts from.
Pip is for adults (18+) and isn't directed at children.
We'll update this policy as Pip grows. Meaningful changes update the date above and, where appropriate, we'll tell you in the app or by email.
Privacy questions, or want your data deleted? Email hello@pip-guardian.com. See also our Terms of Service.