Privacy Policy

Who is responsible

Pip is made and operated by David Ziman, working as a sole individual in Hungary. For the purposes of the EU General Data Protection Regulation (GDPR), that is the data controller for the limited processing described below.

Contact for any privacy question or request: zimand3@gmail.com.

The short version

Pip has no profile login, no sign-up form, and no cloud sync. It does not maintain an online family profile or meal-history database. Firebase creates a silent installation identity used only for subscription verification, as described below.

Child profiles, food entries, nutrient values, check-ins, and preferences live in a database on your phone. AI features send the selected food information and nutrition summaries described below; they do not attach profile names, dates of birth, measurements, or check-in notes.

A meal photo is sent for recognition only when you ask for it. Pip does not save a photo or thumbnail with your meal history. Temporary processing copies and the recognition provider are described below; the request does not include your child's name, profile, or food history.

Pip includes no advertising, behavioural analytics, or crash-reporting SDK. Subscription and security providers process technical identifiers and request information to deliver their services; these are described below.

What stays on your device

Pip keeps the following in a local SQLite database on your phone. None of it is transmitted to Pip or to anyone else.

Use Delete all local data in Settings. After confirmation, Pip removes family records, resets preferences, and cancels its check-in reminders. This does not cancel an Apple subscription or delete records held by subscription providers. Deleting the app also removes its local database, subject to how iOS handles app deletion and device backups.

Meal-photo recognition

Photo recognition runs when you choose to take or upload a meal photo. You can take a new photo with the camera or pick an existing one from your photo library. Pip reads only the single image you select; it does not browse or index your photo library. That image is sent to Google Vertex AI through Pip's service. Avoid including faces, names, or other personal details in meal photos.

Before anything is sent, Pip re-encodes the image as a resized JPEG. Taking or selecting a photo can create a temporary copy in the app's cache, and preparing the upload creates another. Pip attempts to delete these cache copies when processing finishes, fails, or is cancelled. If the app is interrupted or cleanup fails, a temporary file may remain until the operating system clears the cache or the app is removed. Your original photo in your photo library is not deleted. Pip does not save photos, thumbnails, or image file paths with your meal entries.

The request is sent over HTTPS to Pip's recognition service and contains the image plus a Firebase App Check attestation token. Pip does not attach your child's profile or food history to the photo request. The token and normal network information are processed as described under abuse prevention and security.

Pip's recognition service processes the upload, forwards it to Google Vertex AI, and returns possible foods with suggested amounts. It does not save meal photos or recognition results to a database or photo archive. Vertex AI is configured to the European Union multi-region. Google's processing, including any applicable abuse-monitoring retention, is governed by its data-retention terms and settings; this policy does not promise zero retention by Google.

Pip's application diagnostic logs contain an opaque request ID, request duration, HTTP status, and, on failure, the failed stage and error type. They exclude images and submitted content. Hosting and web-server access logs may separately contain technical request information, such as an IP address, URL, timestamp, and response status. The application-log exclusions do not mean that hosting providers receive no network information.

AI meal descriptions and nutrition insights

Before Pip sends information to Google for AI processing, the onboarding agreement screen explains the information shared and its purpose. Tapping Agree and continue accepts the Terms, acknowledges this Privacy Policy, and explicitly authorizes the described Google AI processing, including health-related dietary information. Pip records the agreement version and acceptance time on your device. Downloading the app alone does not record agreement. Delete all local data also removes this record.

Describe a meal is a separate Pip Pro tool. The description is sent only after you tap Find ingredients, then Pip uses Google Vertex AI to separate it into ingredients and looks up those ingredient queries in Open Food Facts. Ordinary food search does not send text to Google AI. The full description you submit is sent for parsing, so do not include a child's name or other unnecessary personal details.

For a Pip Pro customer, opening Insights after at least three logged days sends the number of logged days, combined nutrient totals, dietary pattern, and food restrictions to Pip's service and Google Vertex AI. Requests can run again when the selected child's summary changes or you reopen the screen. Profile names, dates of birth, height, weight, and check-in notes are not attached. Free-text food restrictions are sent as entered and may reveal health information.

Pip uses these responses to suggest ingredients and show editable or informational nutrition observations. Its service does not save the submitted content or generated response to a family-record database. Google's retention terms and settings described above also apply to these AI requests.

Food search and barcode lookup

When you search for a food by name or scan a barcode, that search term or barcode is sent to Open Food Facts, an open food database, to retrieve the matching product record. Nothing about your child or your history is attached to the query.

Open Food Facts is an independent service with its own privacy practices. Avoid typing a child's name or other personal details into the food search box, since the text you type is what gets sent. Meal-description parsing also uses Google as described above.

Abuse prevention and device attestation

Each AI request carries a Firebase App Check token. On iPhone this uses Apple's App Attest, falling back to DeviceCheck. These services process device and app-integrity information to help verify legitimate requests. The token is a security credential, not a child-profile identifier, and may be reused across requests until refreshed.

Pip's service hashes that token for an in-memory rate limiter with a one-minute request-counting window. It does not write the hash to a database or use it to build a family profile.

Subscriptions

Paid features are sold as an Apple subscription and the entitlement is checked through RevenueCat. Apple handles payment; Pip never sees your payment details. Pip uses the result only to decide whether paid features are unlocked on your device.

Firebase Authentication creates a silent installation identity without asking for an email or password. Pip links this identity to RevenueCat to verify Pro access for paid AI requests. The identity and authentication credentials are stored by Firebase and on the device; RevenueCat processes the linked subscription customer identifier. It processes purchase and entitlement information and technical app/device information. No child profile is attached to Pip's subscription requests. Trial availability and purchase qualification are handled by Apple and RevenueCat.

See Apple's privacy policy and RevenueCat's privacy policy. Deleting local family records does not remove transaction records that these providers retain.

Reminders

If you turn on check-in reminders, Pip schedules a repeating local notification on your device. Nothing is sent to a server to make this work, and the notification text contains no child name and no health information.

What Pip does not do

Pip does not ask you to create an account or provide contact details to use the app. It does not request access to your contacts or location and includes no advertising, behavioural analytics, or crash-reporting SDK. If you email us, we receive your email address and the information you include. Submitted photos, descriptions, and food restrictions can also contain personal information you choose to include.

Subscription identifiers, integrity checks, and operational logs are distinct from advertising tracking. Their use is described in this policy. Pip does not maintain an online database of your family's records.

Legal bases

Under GDPR Article 6, Pip relies on performance of a contract with you (Article 6(1)(b)) to provide food lookup and subscription access, and on legitimate interests (Article 6(1)(f)) for security, abuse prevention, and responding to support requests.

Processors

Google Cloud's Data Processing Addendum applies through the Google Cloud terms, and RevenueCat's data processing terms apply through its terms of service. Where data reaches a provider outside the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Your rights

GDPR gives you rights of access, rectification, erasure, restriction, portability, and objection (Articles 15 to 22), subject to the conditions in those provisions. You can review your local records, adjust meal entries, delete a child profile, or use Delete all local data in Settings. You do not need to subscribe to delete local data.

For requests about AI processing, support correspondence, or provider-held information, email zimand3@gmail.com. We will respond within the applicable GDPR time limit and explain any information needed to locate the relevant data. There is no online family account from which Pip can export a complete copy of your local history.

Children

Pip is designed for a parent or guardian to use. It is not offered directly to children and does not create accounts for them. The information in a child profile is entered by the adult using the app, who confirms they have the authority to record it.

Pip does not attach names, dates of birth, measurements, or wellbeing notes to AI requests. The nutrition totals and dietary restrictions described above are shared for insights. Anything you include in a submitted photo or free-text field may also be received by the relevant provider. Only submit a child's information when you have authority to do so.

Security

All network requests use HTTPS. Pip's database sits in the app's private storage and is covered by iOS Data Protection, meaning the file system is encrypted at rest by iOS while your device is locked, using your passcode or biometrics. Keeping a passcode on your phone is the single most useful thing you can do to protect what Pip stores.

The recognition service authenticates to Vertex AI with a service account rather than a shared key, verifies App Check on every request, rate limits abusive callers, and keeps image bytes out of its logs.

Changes and complaints

If this policy changes materially, the effective date at the top will change and the updated version will be published here.

If you think your data has been handled improperly you can complain to your national data protection authority. In Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu.