Pip privacy policy

Last updated: 30 September 2026

What Pip is

Pip is an end-to-end encrypted messenger for Android. Messages, photos, videos, voice notes and stickers are encrypted on your device with the Signal protocol before they are sent. Only the people in the conversation hold the keys. The service that relays messages cannot read them.

What we store

• Account: your Google account ID (used only to sign you in), the handle you choose, and the display name you enter.
• Public keys: the public half of your encryption keys, so other people can start encrypted conversations with you. Private keys never leave your device.
• Messages in transit: encrypted message envelopes are held on our servers (Google Firebase) only until your device downloads them, then deleted. We cannot read their contents.
• Encrypted attachments: encrypted files are held for up to 30 days so recipients can download them, then deleted. The keys to decrypt them travel inside the encrypted message.
• Push tokens: a Firebase Cloud Messaging token so we can wake your device when a message arrives. Pushes contain no message content.
• Typing indicators: a short-lived "is typing" flag per conversation, which expires within seconds.

What we do not do

• We do not read, scan, or sell your messages. We cannot.
• We do not upload your contacts or phone number.
• We do not show ads or use analytics or tracking SDKs.

Backups

If you turn on backup, an encrypted copy of your message history is saved in the app-private area of your own Google Drive. It is encrypted with a key that only you hold (your 12-word recovery phrase). We never see the key or the backup contents.

Payments

The optional Supporter unlock is a one-time purchase handled by Google Play. We receive a purchase token to confirm it and nothing else.

Deleting your account

Settings → Account → Delete account removes your account, handle, keys and any pending envelopes from our servers immediately. Local data is deleted from your device. You can also email the address below.

Children

Pip is not directed at children under 13, and we do not knowingly collect personal information from them.

Contact

Questions: landoncoryjarvis@gmail.com