PipPrivacy Policy
Effective 28 September 2026
This policy explains how Pip ("we", "us"), the family meal-planning app made by Aymen Nurhussien, handles your information. Contact: eimen.nurhussien@gmail.com.
What we collect
- Your account. When you first open Pip we create an anonymous account so your plan can sync. If you sign in with Apple, we receive Apple's identifier for you and, if you choose to share them, your name and email address (which may be an Apple private relay address).
- Your household. The names of the people you add, their daily calorie goals, your units and your reminder preferences. Everyone who joins your household can see this.
- Your meal planning. Your weekly plan, meals marked as eaten, portion changes, leftovers, pantry items, grocery lists, favourites and collections.
- Recipes you import. Links and text you share with Pip. For a public post we read its caption (for example through TikTok's public embed service) to turn it into a recipe.
- Purchases. If you subscribe to Pip Pro, Apple takes the payment. We receive your subscription's status (which plan, whether it's a free trial, and when it renews or ends), linked to your Pip account ID. We never see your payment details.
- Usage analytics. Which features are used (for example "import started"), with basic device and app information, linked to your Pip account ID. We use this only to improve Pip.
- Diagnostics. Crash reports and performance data, used to find and fix problems.
- Notifications. If you allow notifications, the push token Apple gives Pip for your device, so we can tell you when someone in your household picks up groceries, changes the plan or preps lunches. You can turn these off in Household › Reminders.
What stays on your device
The gender, birthday, height and weight you enter during setup are used on your device only, to suggest a calorie goal. They are not sent to our servers. Only the calorie goal you choose is saved.
How we use it
- To plan your week, size each person's portions, build your grocery list and sync it across your household.
- To turn imported posts into recipes and make food photos for them.
- To send the reminders you turn on (these are scheduled on your device), and household updates when someone else in your household picks up groceries, changes the plan or preps lunches.
- To keep Pip working, secure and improving.
Shared recipes
When you import a recipe from a public post, a cleaned-up version may be added to the recipes available to everyone in Pip, credited to the post's creator with a link to the original. It is reviewed first, and it never includes your name, your household, or any changes you made. You can report a shared recipe from its menu. Creators can ask us to remove a recipe by emailing us the post link.
Who processes your data
We use these service providers to run Pip. They process data only to provide their service to us:
- Convex: our database and backend, where your account and household data are stored.
- OpenRouter and Google (Gemini models): read the text of posts you import to turn it into a recipe, write meal-prep plans from recipe steps, and review shared recipes. They receive the recipe text, not your account details.
- fal.ai: generates food photos from a recipe's name and ingredients.
- PostHog: product analytics.
- Sentry: crash and performance reports.
- RevenueCat: manages Pip Pro subscriptions. It receives your purchase history from Apple and your Pip account ID.
- Apple: Sign in with Apple, payments, push notifications, TestFlight and app distribution.
We don't sell your personal information or share it for advertising.
Keeping and deleting your data
We keep your data while you have an account. To delete it, open Household › Delete account in the app. This deletes your account and sign-in details. If nobody else uses your household, the household and everything in it are deleted too. If others share it, they keep the shared plan and lists. Shared recipes stay available because they don't contain your personal information. Copies in backups are removed as those backups expire. You can also email us to ask for a copy of your data or for deletion.
Security
Data is sent over encrypted connections and stored with our providers. Your session is kept in your device's keychain. No system is perfectly secure, but we work to protect your information.
Health information
Calorie goals and portions in Pip are estimates to help plan meals. They are not medical advice. Talk to a professional about specific dietary needs.
Children
Pip is not directed at children under 13, and we don't knowingly collect their personal information. A parent can add a child's first name and calorie goal to a household; that information is managed by the parent.
Your rights
Depending on where you live, you may have rights to access, correct, delete or export your data, or to object to certain processing. Email us and we'll help.
Changes
If we change this policy we'll update this page and the date above, and tell you in the app for significant changes.