Privacy Policy

The short version

• Your data lives on your phone. Pip has no accounts, no sign-up, and no servers of ours.
• We run no analytics, no ads, no trackers, and no third-party data SDKs. We never sell or share your data.
• Optional encrypted backup uses your own iCloud, encrypted on your device before anything leaves it. We never hold your key and cannot read your data.
• Optional friend sharing sends only a small, coarse summary — never your diary — sealed to the invite you hand over. The invite link carries the key, so share it like one: whoever you give it to can read the summary. You can revoke at any time.
• Delete all my data in Settings removes everything, including any backup.

What Pip stores

Pip stores what you log: period days, symptoms, moods, and the settings you choose. It also stores predictions computed from your logs. All of this is kept in a local database on your device.

What never leaves your phone

Everything, by default. A fresh install of Pip makes no network requests with your data. Purchases are handled entirely by Apple (see below).

Encrypted backup (a Pip Save feature)

Backup & sync switches on when you subscribe to Pip Save — so a paying subscriber can never lose her story to a lost phone — and you can switch it off at any time in Settings. If a backup from another phone already exists, Pip points you to it and joins it only when you say so. While backup is on, your data is backed up to your personal iCloud so it can follow you to a new phone:

• Your data is encrypted on your device before upload (AES-256-GCM). What reaches iCloud is sealed ciphertext.
• The encryption key is stored in your iCloud Keychain, which Apple protects with end-to-end encryption. We never see or hold your key.
• The backup lives in your iCloud space under your Apple ID. We operate no server and cannot access, read, or recover your backup.
• Switching backup off, or deleting your data, purges the remote copy — and Pip confirms the purge actually happened before it stops telling you about it.

Sharing with a friend (optional, invitation only)

Pip can show two consenting friends each other's cycle weather. If you invite a friend and she accepts:

• What is shared is a small, fixed summary: a display name you chose, an appearance, your upcoming window, and a coarse phase mood. Your logs, notes, symptoms, and diary cannot travel — the sharing channel is built so that detailed data has no way in.
• The summary is encrypted with a key we never hold. The key travels inside the invite itself — nothing readable ever touches our servers or anyone else's — so the invite link should be treated like a key: hand it only to the friend it is for, over a channel you trust.
• You can stop sharing at any time. Revoking removes what she can see.

Notifications

Reminders and heads-ups are generated on your device by the app. No notification content comes from, or goes to, any server. Nothing sensitive is shown on the lock screen beyond the words of the notification itself, and no prices are ever shown there.

Purchases

Pip Save subscriptions are processed by Apple through the App Store. We receive no payment details, no card numbers, and no billing identity — Apple provides the app only a receipt that the subscription is active.

Health data

If you connect Apple Health, Pip reads only the categories you approve, uses them on-device for predictions, and sends them to no server of ours. Days imported from Health become ordinary Pip logs, so if encrypted backup is on they are included in it — sealed on your device first, stored in your own iCloud, like everything else you log. You can disconnect Health at any time in Settings.

Deleting your data

Settings → Delete all my data erases the local database and — if backup was ever on — the remote backup, with the remote deletion confirmed before local traces are cleared. Uninstalling the app deletes the local database as iOS removes the app container.

Children

Pip is not directed at children under 13, and we do not knowingly collect personal information from children.

This website

pipcycle.app is a static site. It sets no cookies and runs no analytics. It is served by Cloudflare, whose infrastructure logs requests (IP address, user agent) for security and delivery, as any web host does; we add nothing to that.

Who we are

Pip is made by Compiled Intelligence, Inc., a company incorporated in Delaware, United States. Contact: support@pipcycle.app.

Changes

If this policy changes, the new version appears at this address with a new effective date. Material changes will be called out in the app's release notes.