Pipit Wallet Privacy Policy

Effective 20 October 2026

Pipit Wallet ("Pipit", "the app") is a personal budgeting app. This policy explains what data the app handles, where it goes, and what you can do about it. Pipit is made by an independent developer ("we", "us").

Data stored on your phone

Everything you enter is kept in a database on your phone and isn't sent anywhere unless a section below says so. That includes accounts, records, transfers, categories, labels, budgets, debts, planned payments, credit cards and notes. It is not sent to us.

• Notifications: reminders are worked out and scheduled on the phone. Nothing about them leaves it.
• Statement passwords: a locked PDF statement is unlocked on the phone, and the password is never sent anywhere. If you tick "Remember for this card", it is saved in the phone's secure storage and isn't included in backups or sync.
• Backup files: backups and exports are saved only where you choose. They aren't encrypted, so keep them somewhere private.

Signing in with Google

Smart features and Drive sync use Google sign-in. The app receives your Google account's name, email address and account ID. It uses them to show who is signed in and to prove to Pipit's proxy who is making a request. Pipit doesn't create an account of its own on any server.

Smart features (OpenAI)

Smart features read receipts, statements and typed or spoken notes and turn them into draft records. They are processed by OpenAI. Requests go from your phone to Pipit's proxy, which runs on Cloudflare. The proxy checks your Google sign-in, adds Pipit's OpenAI key and passes the request to OpenAI.

Data is sent only when you use one of these features, and only what that feature needs:

• Smart scan: the receipt, screenshot, statement or bank message you choose to scan, along with your category names. A locked statement is sent as page images once it is unlocked on the phone.
• Smart entry: the note you typed, today's date, and the names of your accounts, categories and people (including what's left on open debts).
• Smart-categorize: each draft's payee or note, whether it's income or an expense, and your category names. No amounts, dates or accounts.
• Smart-tidy merchant names: merchant names only.
• Smart notes on budget suggestions: category names, their monthly totals and the suggested amounts. No individual records.
• Online voice recognition (off by default): your voice recording, which is deleted from the phone once it's processed.

Requests are sent with OpenAI's store: false setting. Under OpenAI's API data policy, data sent through the API isn't used to train their models. OpenAI may keep it for up to 30 days to monitor for abuse.

What the proxy keeps: only a count of each Google account's smart-feature uses for the day, keyed by the account's Google ID. This count enforces the daily limit and is deleted automatically after two days. The proxy doesn't keep your requests, documents, records or email address. Cloudflare may process standard network data, such as IP addresses, to run and protect the service.

Voice input

By default, speaking a record uses your phone's built-in speech recognition, provided by Google on Android and Apple on iOS. Their privacy policies apply to that audio. Pipit doesn't receive or keep the audio. Microphone access is requested only when you first use voice input.

Google Drive sync

If you turn on sync, a copy of your Pipit database is saved in a private app folder in your own Google Drive. Pipit asks only for the drive.appdata permission, so it can't see your other Drive files, and the folder doesn't appear in your Drive file list. The backup isn't encrypted by Pipit, so it's as safe as your Google account. We recommend turning on 2-Step Verification. We have no access to your Drive.

Pipit's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Permissions

• Internet: smart features and Drive sync.
• Microphone and speech recognition: voice input, only when you use it.
• Camera, photos and files: only for the receipts, statements and backup files you pick.
• Notifications, and running after restart: reminders for planned payments, card due dates, debts and budgets.

Sharing

We don't sell your data, share it for advertising, or use it to profile you. The only third parties involved are OpenAI and Cloudflare (smart features, as described above) and Google (sign-in, Drive sync and on-device speech recognition). We may disclose information if the law requires it, but we hold almost none.

Your choices and deleting your data

• Not using smart features or sync: the app works without signing in. Nothing then leaves your phone.
• Data on your phone: uninstalling the app or clearing its storage deletes it.
• Drive backup: in Google Drive on the web, open Settings → Manage apps → Pipit Wallet → Options → Delete hidden app data.
• Revoking access: you can remove Pipit's access to your Google account at any time at myaccount.google.com/connections.
• Proxy usage count: it deletes itself within two days. Nothing else about you is kept on our side.

Depending on where you live, you may have rights to access, correct or delete your personal data. Because nearly all of it stays on your device or in your own Drive, you can exercise those rights directly. For anything else, contact us below.

Security

Data travels over encrypted connections (HTTPS). Pipit's OpenAI key stays on the proxy and never reaches your phone. Your phone's own security, such as its screen lock and encryption, protects the data stored on it.

Children

Pipit isn't meant for children under 13, and we don't knowingly collect data from them.

Changes

If this policy changes, we'll update this page and the date at the top. Significant changes will also be noted in the app's release notes.

Contact

Questions about privacy: CONTACT_EMAIL