The short version
- Pippin reads the text on your screen. It takes no screenshots, no video and no audio.
- It never reads password fields, common password managers or apps you block.
- What it reads is saved on your Mac. There is no Pippin account, and no Pippin server ever gets your screen text.
- To be understood, excerpts of that text go to the AI you chose: OpenAI, Anthropic or OpenRouter.
- The app sends us usage counts and crash reports, and checks for updates. Never what it reads.
- For the beta, the website keeps your email address. We use it to send the download link, and to count if the link reached you.
Last changed: 20 October 2026.
Who is responsible
Pippin is made by one person: Shubham Padia, India. In data law, they are the “controller” of the data on this page. In this page, “we” means them.
Write to hello@usepippin.com about anything on this page.
What Pippin reads
- The text in the windows of the apps you have open, about every 15 seconds, through macOS Accessibility.
- Window titles, app names, and the web address of a page when the app shows it.
- If you also allow Input Monitoring (optional): that you typed, clicked or used a shortcut, and on which button or field. Not the keys you pressed.
No screenshots. No video. No audio. It does not read pictures.
What it never reads
- Password fields.
- Common password managers: 1Password, Bitwarden, KeePassXC, Dashlane, LastPass, Enpass, Proton Pass, Keychain Access, Passwords.
- The lock screen, and the macOS password and Touch ID prompts.
- Pippin’s own windows.
- Any app you block.
- Private browser windows it can recognize by their English title: Chrome Incognito, Edge InPrivate, Firefox Private Browsing.
While macOS secure keyboard entry is on, reading pauses.
Safari private windows. Pippin cannot recognize a Safari private window, or a private window whose title is not in English. If you need that, block the browser.
What is cleaned before saving
- Masked: API keys, tokens, passwords, many one-time codes, card and bank account numbers.
- Dropped whole: a screen with a card form or a recovery phrase.
Not masked: names, email addresses, message text, and what you type to Pippin in chat. Masking finds common patterns; it can miss one.
What it keeps on your Mac, and for how long
In ~/Library/Application Support/Pippin, unless a line below says other.
| What | Kept for |
|---|---|
| Screen text and the activity log | 3 days |
| Pippin’s written accounts of your work, and closed rows | 30, 60 or 90 days. You choose. |
| Chat, day and week summaries, and open rows | Until you reset Pippin |
Daily backups, in Pippin Backups next to the folder above. They hold your rows, chat and accounts, not screen text. | The 3 newest |
| Backups made before an update. These hold screen text too. | The 2 newest |
| Backups you save yourself | Until you delete them |
| Your Claude or OpenRouter key, in the macOS Keychain | Until you remove it |
What leaves your Mac, and to whom
| To | What, and when |
|---|---|
| The AI you chose | Excerpts of screen text, your rows, summaries, and your chat. Each time Pippin thinks or answers you. |
| PostHog, in the EU | Usage counts and crash reports, with a random install ID. Never screen text, window titles, app names, chat or row titles. |
| Our update server | Once a day, a check for a new version: your IP address and the app version. |
The AI you chose
- With my ChatGPT: your own ChatGPT sign-in, through the Codex that comes with the ChatGPT app. OpenAI gets the text.
- With a Claude key: Anthropic gets the text.
- With an OpenRouter key: OpenRouter gets the text, and passes it to OpenAI.
The account or key is yours. So the provider handles the text under your agreement with them, and its own privacy policy: whether it keeps the text, for how long, and whether it trains on it. We never see this text.
Check your provider’s training setting. A personal ChatGPT plan may use your content to train OpenAI’s models unless you turn that off in ChatGPT’s data controls. Anthropic’s API does not train on your data by default. OpenRouter keeps no prompts by default; your OpenRouter settings apply.
The app’s own words: “Stored on this Mac. Excerpts go to your assistant when Pippin reasons. Usage counts and crash reports go to PostHog (EU), never what Pippin reads.”
Usage counts and crash reports
The app sends these to PostHog, in the EU. Usage counts are events like “a row was marked done”, with numbers and on/off states. A crash report has the place in the code where Pippin failed. Both carry a random install ID, the app version, the macOS version and the Mac model. Reset makes a new install ID. PostHog sees your IP address when the app connects, but we told it not to look up where you are.
We use them to find bugs and to see whether Pippin helps. This beta has no switch to turn them off yet. If you object, write to us.
The update check
Once a day, Pippin asks updates.usepippin.com if there is a new version. It sends nothing about you, but the server sees your IP address and the app version. You can turn automatic checks off in Settings.
Your email address
To get the beta you give an email address on this website. We use it to send you the download link, and to count the steps after it (below). We do not send news unless you ask for it.
- Cloudflare runs this website. Cloudflare Turnstile checks that you are a person, not a bot. It sees your IP address and browser.
- Resend, our email service, sends the link email. When you open the link, Resend keeps your address on our beta list.
- To stop abuse, the website keeps a scrambled form of your address (it cannot be turned back into the address) for one day. One address gets at most one email in 10 minutes and five in a day.
- The link in the email holds your address. It works for 7 days.
We keep your address on the beta list until you ask us to delete it. The address is not linked to anything Pippin reads on your Mac; the app does not know it.
What this website records
The website uses PostHog, in the EU, to count what visitors do. We use the counts to see where people stop on the way to the beta.
- Every visitor: the pages you open, the links and buttons you click, and how far you scroll. Whether the sign-up form went through. Your browser, device type and the page you came from.
- After you ask for the beta, with your email address: the email was sent, failed or held back by the limit; you opened its link; you opened the download page; the download started. PostHog keeps your address itself, not a scrambled form, so these steps line up for each person.
No cookies. The website stores nothing on your device. PostHog tells visits apart with a code it makes from your IP address and browser. The code changes every day. PostHog does not keep your IP address.
Never sent: what you type, other than the address you send. No screen recording. No link from the email: the code in it is removed first.
PostHog keeps these records for up to 1 year. Ask us, and we delete yours sooner.
Why we may use it
Data law asks us to name a reason for each use. These are ours:
| Use | Reason in the law (GDPR Article 6) |
|---|---|
| Your email address, to send the download link | To give you what you asked for (a contract, 6(1)(b)) |
| Website counts: visits and clicks, and with your email the steps to the download | Our legitimate interest in knowing that the beta reaches the people who ask for it (6(1)(f)). No cookies, and visits carry no name. |
| Bot check and abuse limits | Our legitimate interest in keeping the website safe (6(1)(f)) |
| Usage counts and crash reports | Our legitimate interest in fixing a beta and seeing if it works (6(1)(f)). We send no content, and a random ID only. |
| The update check | To give you the app you asked for, with its fixes (6(1)(b)) |
Screen text goes to the AI under your own account with that provider, by your choice in setup. We never receive it.
No ads. We do not sell or share your data, as California law uses those words. No automated decisions about you with legal effect.
Outside the EU and UK
These companies work for us (our “processors”).
| Company | Does, and where |
|---|---|
| Cloudflare | Runs the website, the bot check, the download and the update server. USA, with servers worldwide. |
| Resend | Sends the email and keeps the beta list. USA; the email itself leaves from Japan. |
| PostHog | Usage counts and crash reports from the app; visit and download-step counts from the website. EU, in Germany. |
Your data goes to the USA with Cloudflare and Resend. Both are in the EU–US Data Privacy Framework and its UK extension, which the EU and UK accept as safe. Where a company is not in it, the EU’s standard contract clauses cover the transfer.
Your AI provider is your own choice, under your own agreement. Its privacy policy says where it handles your text.
Your controls in the app
- Pause screen awareness: For 1 hour, Until tomorrow at 9:00 AM, Until a date and time…, Resume now. It is a timed pause.
- Blocked apps: Pippin never reads text from a blocked app. Add app… or Block All Suggested.
- Keep detailed accounts for: 30 days, 60 days or 90 days.
- Clear recent history…: Last 10 minutes, Last hour or Last day. It removes screen text and accounts from that time. Chat and backups stay.
- Save a backup to…: a copy of your data, in a file you keep.
- Reset Pippin…: deletes the Pippin folder and makes a new install ID. It does not delete backups or your key in the Keychain.
- Check for updates automatically: on or off.
Remove everything
- In Pippin, open Settings, then Reset Pippin…. Then quit Pippin.
- Move Pippin from Applications to the Bin.
- Delete the folders
~/Library/Application Support/Pippin Backups,~/Library/Application Support/com.shubhampadia.pippinand~/Library/Caches/com.shubhampadia.pippin. - If you added a key: open Keychain Access and delete the items named
com.shubhampadia.pippin.anthropicorcom.shubhampadia.pippin.openrouter. - If you used ChatGPT with an early beta build: those builds let Codex save each request in
~/.codex/sessions. Builds from now on do not, and they delete the files Pippin left there once they are 30 days old. After you remove Pippin, delete the files from your Pippin days if you want them gone. - To leave the beta list, write to us.
Your rights
Where GDPR or UK GDPR applies, you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct it, or delete it;
- stop or limit a use. You can object to any use based on our legitimate interest;
- give you your data in a file you can move.
Write to hello@usepippin.com. We answer within one month. It is free.
Most of your data never reaches us: it is on your Mac, and you control it there. The app’s usage counts carry no name, so to find yours we may ask for the install ID. The website’s download steps are under your email address. We cannot see what your AI provider keeps; ask them.
You can also complain to a data protection authority: the one where you live or work in the EU, or the ICO in the UK (ico.org.uk). We would like to hear from you first.
In the USA, some states give you the right to know, to delete and to correct. Write to us; we do the same for everyone.
Pippin is not for children under 16. We do not knowingly collect their data.
Changes to this page
When this page changes, the date at the top changes. If a change matters to you, we tell you before it applies.
The beta’s terms: Terms.
Contact
Shubham Padia, India.
The same facts, with the reasons: What Pippin reads on your Mac, and what it never reads.