Privacy policy

Who we are

Pipi is made by Andreea Papillon (Papillon Makes). Questions about this policy or your data go to hello@papillonmakes.com.

What Pipi accesses

When you add a Google account, Google asks you to let Pipi:

• Read your Gmail (gmail.readonly): message contents, headers, labels and attachments' names, so Pipi can show and sort your mail. Pipi cannot send, delete or change anything in Gmail.
• See your email address (openid, email), so Pipi knows which account a message belongs to.

How Pipi uses it

• To show your mail and sort it into People, Updates, Newsletters and New senders.
• To learn from what you do. When you move an email or accept a sender, Pipi remembers it so the next email from them lands in the right place. People you've written to are treated as people you know.
• To search your mail.

All of this runs on your device. Pipi does not use your Gmail data for advertising, does not sell it, does not share it with data brokers, and does not use it to train AI or machine-learning models. Nobody at Papillon Makes reads your mail.

Where your data is kept

What	Where
Your mail and Pipi's sorting	A database inside Pipi's private storage on your phone, protected by the operating system's file encryption (iOS Data Protection, Android file-based encryption).
Your Google sign-in	A refresh token in the iOS Keychain (Android Keystore on Android), readable only by Pipi on this device. Short-lived access tokens are kept in memory only.
Your preferences, such as which senders may load images	Pipi's settings on your phone.

Pipi talks directly to Google's servers over HTTPS. We don't run a server that stores or passes on your data.

Sharing

Pipi does not transfer your Google user data to anyone. The only exceptions are the ones Google's policy allows: if you ask for it, to comply with the law, or as part of a merger or sale of Pipi with the same protections in place.

Two things reach other parties because you chose them:

• Images in emails. Pipi blocks remote images by default. If you tap "Load images", the sender's servers can see that the email was opened, your IP address and approximate location.
• Links. Tapping a link opens it in your browser, where that site's own policy applies.

Google API Services User Data Policy

Pipi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting your data

• Remove one account: in Pipi, open Accounts and tap Remove. Pipi signs out and deletes that account's mail from your phone.
• Remove everything: delete the Pipi app. Its database, settings and Keychain sign-ins go with it.
• Revoke access from Google's side: visit myaccount.google.com/permissions and remove Pipi.

Pipi keeps your mail until you do one of these. Because nothing is stored on our side, there is nothing for us to delete, but you can write to us any time.

Analytics, ads and tracking

None. Pipi has no analytics, no advertising, no crash-reporting service and no tracking.

Children

Pipi isn't directed at children under 13, and we don't knowingly collect their data.

Changes

If Pipi ever adds a feature that sends anything off your phone, such as optional instant alerts, it will be off until you turn it on, Pipi will say exactly what it can see, and this policy will be updated first. The date at the top shows the latest version.