Privacy policy.
What Pip collects, who handles it, how long it's kept, and what you can ask for.
Last updated 19 October 2026
The short version
- Your work is saved in a folder on your Mac. We never receive it.
- When you ask Pip's AI for help, what that job needs goes to the AI you chose, and the answer comes back to your Mac.
- With the Pip subscription, your request passes through our server in Frankfurt on its way to the AI. What you write isn't stored or logged.
- Your Pip account knows who you are and how you get your AI. Never what you write.
- This website has no cookies, no analytics and no trackers.
- To see, correct or delete what we hold about you, email hello@haydenslaughter.co.uk.
Who we are
Pip is made by Hayden Slaughter in Brighton, UK, through his company, Little Big Creative Limited. The company decides what happens to the personal data in this policy, so under UK data protection law it is the controller. In this policy, "we" and "us" mean Little Big Creative Limited.
- Company
- Little Big Creative Limited, registered in England and Wales, company number 09482823
- Made by
- Hayden Slaughter
- hello@haydenslaughter.co.uk
There's no data protection officer. It's a one-person business, so the reply comes from Hayden himself.
This website
hellopip.co.uk is a plain website. It sets no cookies and runs no analytics, trackers or adverts. Its fonts are served from the site itself, not from Google or anyone else.
The site is hosted on GitHub Pages. Like any web host, GitHub sees your IP address and the pages your browser asks for. GitHub logs and stores visitors' IP addresses for security. We don't see or use those logs. GitHub's own privacy statement covers them.
The sample on the home page loads from GitHub Pages when you open it. While you play, it keeps its settings in your browser, and clears them on your next visit. Nothing you do leaves your browser.
You download Pip from GitHub. The download page (hellopip.co.uk/get) asks GitHub which version of Pip is the latest, and the download comes from GitHub, so GitHub sees your IP address. The sign-up page itself doesn't contact GitHub.
The sign-up form
Download for Mac leads to a short form, and we email you Pip. It asks for:
- your name;
- your email address;
- then, if you'd like to answer them, three optional questions: what you do, how comfortable you are with AI (1 to 5), and whether you pay for an AI at the moment. You can skip them.
We use your name and email to send you Pip: one email with the download link, a few minutes after you sign up, or straight away when you answer or skip the questions. If you sign up again with the same email, we send it again, at most once an hour. Hayden gets an email too, with your name, email and any answers. If you answer the optional questions, they help us understand who Pip is for and what help you might need. Hayden reads each one, and may write to you to see how you're getting on. You won't be added to a mailing list, and we won't send you marketing. Ask to be removed at any time and we'll delete your answers.
The answers are stored in Pip's Supabase project, on servers in Frankfurt, with the date you signed up, your sign-up number and when each email was sent. Sending the form also shows Supabase your IP address, which its logs keep for up to a week. The emails are sent by Resend, an email service, which keeps a record of each one for 30 days. If you join Pip with the same email, we delete your three answers a month after you join. The rest of the form, and your answers if you join with another address or not at all, we keep until you ask us to delete it, or until you delete your account.
When you sign in to Pip with Apple and Apple gives us the same email address you signed up with, we link your sign-up to your account, so deleting your account deletes your sign-up too. If you use Hide My Email, or sign in with a different address, they aren't linked.
The app on your Mac
Pip saves your notes, tables, decks, photos and canvases as files in a folder on your Mac. Pip also keeps its own working files on your Mac: what Pip remembers about you and your work, your chats, your settings, a search index and its logs. Your API keys and sign-in details are kept in an encrypted file on your Mac.
We don't receive any of it. There's no copy on a server of ours. Pip sends no analytics and no crash reports. The only records of use are the account ones described below: which kind of AI you use, when Pip last checked in, and how much of the subscription's AI you've used.
Because it's on your Mac, it's yours to manage. Back it up, move it, open it in other apps or delete it. If you delete it, we can't bring it back.
Two things worth knowing. Your keys and sign-ins are kept in a file only your Mac account can open, so they're only as safe as your Mac's own login. Keep your Mac locked. Pip's working files are kept in your account's private Library folder. Your work, though, is saved in a Pip folder in your home folder unless you choose another place, and other accounts on the same Mac can usually open folders there. If you share your Mac, keep that in mind.
What Pip fetches on its own
A few requests happen without you connecting anything. None carries your work, but like any download they show your IP address to the host:
- on a fresh install, a small model from Hugging Face that Pip uses to find related things in your work. It then runs on your Mac;
- the first time you use Clean up in the image editor, its model, from Hugging Face;
- each time Pip starts, a check with GitHub for a newer version, which sends the version you have. Nothing downloads until you say yes.
When you ask Pip's AI
When you ask Pip for help, Pip sends what that job needs to the AI you chose: your message, the parts of your work the job uses (a note, a table, a picture you show Pip), the conversation so far, and Pip's own instructions. The answer comes back to your Mac and is saved there.
Pip also uses AI for small jobs in the background, such as summing up a long conversation or keeping track of its subjects. These go to the AI you chose for background work, which can be a different one. You choose both in Settings.
Where it goes depends on that choice.
With the Pip subscription
Your request goes from your Mac to Pip's relay, a small server function in Frankfurt, run on Supabase. The relay checks you're signed in and within your allowance, passes the request on to EU Router with our key, and sends the answer back. EU Router passes it to the company that runs the model: Amazon Web Services (AWS Bedrock) for the Claude models, in Amazon's EU regions, and Lyceum (Germany), Inceptron (Sweden) or Tensorix (Ireland) for GLM-5.3 Flash. EU Router's agreement with us keeps all of this inside the EU.
What you write, and any picture you show Pip, passes through the relay and is never stored or logged there. A picture goes as a smaller copy. The relay keeps only who made the request, the model, whether it worked and what it cost.
We don't use what you write to train AI. EU Router doesn't either: its data processing agreement says so, and it doesn't keep your words once it has answered. It lists each company that runs these models as keeping nothing and training on nothing.
With your own Claude plan or API key
Your request goes straight from your Mac to that provider, under your own account. It doesn't pass through us and we never see it. That provider's terms and privacy policy apply, including what it keeps and whether it trains on your data. Pip works with Anthropic (Claude), OpenAI, OpenRouter, GreenPT and DeepSeek. OpenRouter passes your request on to the company that runs the model you pick.
On your Claude plan, Pip runs Anthropic's own Claude Code on your Mac, signed in to your Claude account. You sign in through Anthropic, and Pip never sees your password. Claude Code keeps its own record of each chat on your Mac, which Pip's delete doesn't reach, and includes your Claude account's email address in what it sends to Anthropic.
With a model on your Mac
If your main and background AI both run on your Mac (with Ollama), what you ask the AI stays on your Mac. Web searches, pictures and services you connect still go out as this policy describes. If you point Ollama at another computer, your requests go there instead.
Searching the web
Internet access is off until you switch it on. When it's on and Pip searches, only the search words go out: to Anthropic or to DuckDuckGo, depending on your AI. On the Pip subscription, searches go to DuckDuckGo. When Pip reads a page, it fetches it from that website like a browser would, without your cookies or logins.
Services you connect
If you connect Slack, Notion, Gmail, Google Calendar or Granola, Pip reads from them on your Mac with your own sign-in, when a job needs it. What it reads may then go to your AI as part of that job. Pip never sends email or Slack messages, and only writes to Notion when you allow it. These connections are between you and that service. We don't receive anything from them.
Your Pip account
Pip asks you to sign in with Apple when you set it up. You need an account for the Pip subscription and pictures. You can carry on without one and use your own AI.
Sign in with Apple happens in your browser, and Pip never sees your Apple password. Apple gives us your email address and a user id, and Pip asks for your name. If you choose Hide My Email, we get Apple's forwarding address instead of yours.
What the account holds
It's kept in Pip's Supabase project, on servers in Frankfurt:
- your email address (or Apple's forwarding address), your name and the user id Apple gives us;
- a one-way fingerprint of that Apple user id, so your allowance stays with your Apple ID if you sign in again;
- whether you chose the Pip subscription or your own AI, the history of each change and why it happened, and which provider your main and background AI use (for example Anthropic, or a model on your Mac). Never your keys;
- your monthly allowance, when you started the subscription, and what you've used each month, as a cost and a number of requests;
- counts that keep the limits working, such as how many requests you've made this minute and today;
- when Pip last checked in (once each time it starts), and when your account was made and last changed;
- for each sign-in, when it happened, your IP address and the app or browser it came from. Supabase also logs each sign-in, sign-out and refresh, with your IP address and email, in its own logs for up to a week;
- one log line for each AI or picture request: your account id, the model, whether it worked and the cost. Never what you wrote;
- how you joined: open to anyone, or, from when Pip was invite-only, through the invite list or a code. We also keep the list of invited email addresses and the codes we've made, with who used each, for as long as How long we keep it says.
It never holds your notes, chats, files or memory, anything you type to Pip or anything Pip replies, or your own API keys and Claude sign-in. Those stay on your Mac.
On your Mac, Pip keeps your sign-in session in the encrypted file. Signing out removes it.
Pip is open to anyone who signs in with Apple. If we ever make it invite-only again and you sign in without an invite, Supabase still keeps your sign-in (your email or Apple's forwarding address, and your Apple user id) so we can let you in later. No account record is made and no use is recorded, apart from a count of how often your sign-in asks to join, to stop abuse.
Paying
The trial is free and needs no card, and there's no way to pay yet. When payments start, a payment provider will take your card details. We'll name it here before it does.
If you ask for a concession, we keep a note that one applies to your account. We don't keep the reason, and we delete your email about it once the concession is set up.
Children
Pip is for people aged 18 or over, and we don't knowingly hold data about anyone younger. If you think someone under 18 has made an account, tell us and we'll delete it.
Pictures
With the Pip subscription, Pip can make a picture from a description, or change a photo you describe ("take the clutter out", "make it evening"). Nothing is sent unless you ask for a picture, and to begin with Pip checks with you before it makes one.
The description, and for a change the photo (made smaller first), go from your Mac through Pip's pictures function in Frankfurt to Black Forest Labs' EU service, which makes the picture. The picture comes back and is saved in your folder.
Our server doesn't keep the words or the pictures. It records only who asked, the kind of change, the model, whether it worked and the cost.
Black Forest Labs makes the pictures under its own terms and privacy policy. Our account is with its US company, Black Forest Labs Inc., and pictures are made on its EU service, on Microsoft Azure. Its terms let it use what it's sent to improve its models unless a customer opts out. We have opted out. It doesn't say how long it keeps what it's sent. A finished picture can be collected for 10 minutes, and our server collects it straight away.
If you'd rather not send Black Forest Labs anything, turn pictures off in Settings, under Models and usage. The image editor's own tools, Clean up included, work on your Mac and send nothing anywhere.
Emails to us
If you write to hello@haydenslaughter.co.uk, we get your email address, what you write and anything you attach. We use it to reply and to help. Our email is handled by Google Workspace (Google).
If something goes wrong, Pip can save a diagnostics file for you to send. It holds Pip's logs and the versions of Pip and macOS. The logs can include short extracts of what Pip's tools returned, so look through it before you send it. Nothing is sent unless you send it.
Our reasons
UK data protection law asks us to say why we're allowed to use your data. These are our reasons, called lawful bases.
| What we do | Our reason |
|---|---|
| Keep your sign-up, email you Pip and reply to you about it | You asked us to, before an agreement (contract) |
| Read what you do, if you tell us | You chose to tell us (consent). Leave it blank, or ask us to delete it |
| Run your account and the Pip subscription, and pass your requests to the AI | Our agreement with you, the terms (contract) |
| Make pictures you ask for | Our agreement with you (contract) |
| Limits, the Apple ID fingerprint, the counts and sign-in records | Keeping the service safe from abuse and running for everyone (legitimate interests) |
| Record which kind of AI you use and when Pip last checked in | Understanding how Pip is used without seeing your work (legitimate interests) |
| Reply to your emails | Helping you (legitimate interests), and our agreement with you if you have an account |
| Keep payment records, once payments start | The law requires it, for tax (legal obligation) |
Where we rely on legitimate interests, you can object, and we'll stop unless we have a strong reason that outweighs yours.
Who handles your data
These are the companies we use to run Pip. Supabase, EU Router and the companies that run its models, Resend and Google handle your data for us, on our instructions and only for the reason given. Black Forest Labs makes pictures under its own terms, as Pictures explains. Apple and GitHub decide for themselves what they do with what they see, and their own privacy policies cover it.
| Who | What they get | Why | Where |
|---|---|---|---|
| Supabasesupabase.com | Your account, sign-in records, counts and logs. Sign-up form answers. AI and picture requests pass through in transit | Accounts, the sign-up list, the relay and the pictures function | Servers in Frankfurt, Germany. Supabase is a Singapore company, part of a US group |
| EU Routerapi.eurouter.ai | Your AI requests on the Pip subscription, from our relay, with our key. Not your name or email | Runs the AI models | EU servers. EU Router is a Dutch company, and its agreement with us keeps all processing in the EU |
| The companies that run EU Router's models | The same requests, from EU Router | Running each model | Amazon Web Services (AWS Bedrock) for Claude, in Amazon's EU regions. Lyceum (Germany), Inceptron (Sweden) or Tensorix (Ireland) for GLM-5.3 Flash. EU Router tells us none of them keeps your request or trains on it |
| Black Forest Labsapi.eu.bfl.ai | Picture descriptions, and photos you ask to change, made smaller | Making and changing pictures | Its EU service, on Microsoft Azure. Our account is with Black Forest Labs Inc., its US company, under its own terms |
| Appleappleid.apple.com | The sign-in, in your browser. Apple tells us your email (or forwarding address), name and user id | Sign in with Apple | Apple's own privacy policy applies |
| GitHubthis website, github.com, api.github.com | Your IP address and what you ask for, when you visit this site, download Pip or Pip checks for updates | Hosting the website and Pip's downloads | A US company, part of Microsoft |
| Resendresend.com | Your name and email address, and the email we send you with the download link. Hayden's email about your sign-up, with your answers | Sending the sign-up emails | A US company (Plus Five Five, Inc.), which handles data in the US. It keeps a record of each email for 30 days |
| Google Workspace (Google) | Emails you send us, and Hayden's copy of the email about your sign-up | Our email, for replying to you | Google's servers, which can be in the US and other countries |
Services you choose yourself
These are your own accounts, which Pip uses from your Mac on your behalf. We don't receive what passes between you and them, and their own terms and privacy policies apply.
| Service | What goes there | When | Where |
|---|---|---|---|
| Anthropicapi.anthropic.com, claude.ai, downloads.claude.ai | Your requests, on your key or your Claude plan. Searches, on Claude. Claude Code itself, downloaded once | While Claude is your AI | US |
| OpenAIapi.openai.com | Your requests, on your key | While you've chosen it | US |
| OpenRouteropenrouter.ai | Your requests, on your key, passed to the company that runs the model you pick | While you've chosen it | US, then wherever that company is |
| GreenPTapi.greenpt.ai | Your requests, on your key | While you've chosen it | EU. GreenPT is a Dutch company, with servers in France and Finland |
| DeepSeekapi.deepseek.com | Your requests, on your key | While you've chosen it | China |
| Ollamayour Mac, or a computer you name | Your requests. When you add a model, its name, and Ollama fetches it from its own library | While you've chosen it | Your Mac, unless you point it elsewhere |
| Slackslack.com | Sign-in, then reading channels and messages you can see | While connected | US |
| Notionapi.notion.com | Sign-in, reading pages you share, and pages you let Pip make | While connected | US |
| Googleaccounts.google.com, oauth2.googleapis.com, www.googleapis.com | Sign-in, then reading Gmail and Calendar | While connected | US |
| Granolapublic-api.granola.ai, mcp.granola.ai | Sign-in, then reading your meeting notes and transcripts, and the words of a search across them | While connected | US |
| DuckDuckGolite.duckduckgo.com | The search words, nothing else | Internet on, and an AI other than Claude | US |
| Websites Pip reads | A request for that page | Internet on, when Pip reads a page | Wherever the website is |
| Hugging Facehuggingface.co | The request only: the search model, once, and the Clean up model, the first time you use it | Once each | US |
A link you click in Pip opens in your own browser, and leaves Pip there.
Outside the UK and EU
Pip's server is in Frankfurt, and the UK recognises the EU as protecting personal data properly. Some of the companies we use are based outside the UK and EU. Supabase, which runs Pip's server, is a Singapore company that's part of a US group: your account is stored in Frankfurt, but Supabase may reach it from elsewhere to keep the service running. GitHub, Apple, Google and Resend are in the US. So is Black Forest Labs Inc., the company our pictures account is with, though the pictures are made on its EU service, on Microsoft Azure. Amazon is a US company too, but it runs Pip's Claude requests in its EU regions, so those stay in the EU.
Where your data does leave the UK and EU, it's covered by safeguards UK law recognises: standard contract clauses approved for UK transfers, which are part of Supabase's, Google's and Resend's terms with us, and the UK's data bridge with the US, which GitHub and Resend have signed up to. Apple's own privacy policy covers what Apple holds, and Black Forest Labs' own terms and privacy policy cover what it holds. Pip's downloads from Hugging Face, a US company, show it your IP address, but nothing of your work.
Some services you can choose yourself are outside the UK and EU: Anthropic, OpenAI, OpenRouter, Slack, Notion, Google, Granola and DuckDuckGo are in the US, and DeepSeek is in China. Sending your work there is your choice, under your agreement with them. If you'd rather it went through EU servers, use the Pip subscription, and if you'd rather what you ask stayed on your Mac, use a model on your Mac.
How long we keep it
Here's how long we keep each thing.
| What | How long |
|---|---|
| Your work and Pip's files on your Mac | Until you delete them. We never have them |
| What passes through the relay and the pictures function | Not kept. It passes through in transit |
| Your sign-up: name, email, number and when each email went | Until you ask us to delete it, or delete your account if it's linked to it |
| Your answers to the three questions | A month after you join Pip with the same email. Otherwise until you ask us to delete them |
| Your sign-in: email, name, Apple user id, sessions | Until your account is deleted |
| Apple sign-ins not yet let in, if Pip is ever invite-only again | Until we let you in, six months after you last tried, or until you ask us to delete them |
| The sign-up emails, at Resend | 30 days |
| Supabase's sign-in log | Up to a week, in Supabase's own logs |
| Your account record: the fingerprint, your choices, allowance and dates | Until you delete your account |
| What you've used each month | Until you delete your account |
| Your account's history and the limit counts | Until you delete your account. Then one line stays saying an account was deleted, with the time and nothing else |
| Request logs | Up to a week, in Supabase's logs, which also record the IP address each request came from |
| Backups of the above | Up to a week |
| The invite list | Until you ask us to take you off it, or delete your account |
| Invite codes, and who used each | Until the account that used the code is deleted |
| Emails to us | While we're helping you, then deleted within 2 years |
| Payment records, once payments start | 6 years, as UK tax law requires |
Your rights
You can ask us:
- for a copy of the personal data we hold about you;
- to correct it if it's wrong;
- to delete it;
- to stop using it, or to use it only in limited ways, and to object to how we use it;
- for it in a file you can take elsewhere;
- to withdraw your consent, where that's our reason.
Email hello@haydenslaughter.co.uk, from the address on your account if you have one. Before we delete anything or send you a copy, we'll write to the address we have for you to check the request came from you. It's free, and we'll reply within a month.
Your work on your Mac is already yours. You don't need to ask us for it.
Complaints
If you're unhappy with how we've handled your data, tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can complain to the data protection authority where you live.
Deleting your account
In Pip, open Settings, then You and appearance, then Your account, and choose Delete my account. Pip asks once, then our server deletes your account and Pip signs you out on that Mac. If you can't sign in to do it, email hello@haydenslaughter.co.uk from the address on the account. We'll write back to check the request came from you, then delete it by hand and tell you when it's done, within 30 days.
What goes, all at once: your sign-in, with your email address, name and Apple user id; your account record, with the Apple ID fingerprint, your allowance and your choices of AI and their history; what you used each month; the limit counts; the invite code you used and your place on the invite list; and your sign-up on this website, if it's linked to the account. If you signed up here with another address, it isn't linked: email us and we'll delete it too.
What stays: one line saying an account was deleted, with the time and nothing else, and the relay's daily totals, which are sums for everyone and name nobody. Supabase's own logs and backups keep what they hold for up to a week, then it's gone.
Nothing is kept that could recognise you, so if your Apple ID signs in again later, it starts afresh.
Signing out ends your session on that Mac only. It doesn't delete your account.
Your work and Pip's own files on your Mac are yours to delete whenever you like.
Changes to this policy
When this policy changes, the date at the top changes too. If a change matters, such as a new company handling your data, we'll email people with an account before it applies, at least 30 days before where we can. A change needed for security or the law may apply sooner.
Questions about any of it? Write to hello@haydenslaughter.co.uk. Hayden reads every email.