Privacy Policy
- These statements describe the app. This website logs visits for metrics — see “This website” below.
- The information you enter (email addresses, phone numbers, names, Social Security numbers) is encrypted on your device and stays there. We run no server and receive none of it.
- Two optional features contact outside services, and only when you use them: Real breach lookup sends a one-way hash of your email address (never the address itself) to a breach-lookup service, and Check a web page downloads a page you choose.
- No account, no login, no ads, no tracking, no analytics, no third-party SDKs.
- One button erases everything: the encryption key is destroyed and all records are deleted.
What stays on your device
Everything you add under My Info, every exposure the app finds, your removal letters, your notes and your settings are stored only on your device, encrypted with AES-256. The encryption key is created on your device, protected by the device's secure hardware, and never leaves it. In the app's default demo mode, scanning runs entirely on the device against built-in sample sources, and nothing is sent anywhere.
Real breach lookup (optional, off by default)
If you turn on Look up real breaches in Settings, the app shows what will be sent and asks you to agree. After that, each scan asks LeakCheck (leakcheck.io), an independent breach-lookup service, about each email address you have verified. Your email address is not sent. The app sends only the first 24 characters of a one-way SHA-256 hash of the address, over an encrypted connection, and shows you the breaches the service reports for it. The request goes directly from your device to that service; it does not pass through us, and we receive nothing.
One detail, stated plainly: a hash is not readable, but the service can match it against addresses that are already in its breach records. That is how the lookup works. LeakCheck's own privacy policy governs what it does with the request. You can turn the feature off at any time, and nothing further is sent.
Check a web page (optional)
When you enter the address of a web page, your device downloads that page and looks for your information on the device itself. The website sees an ordinary page request from your device, including your network address, exactly as it would if you opened the page in a browser. Your information is not sent to that site. If you start a removal request for the page, the app may download it again later to see whether your information is still there.
Removal requests
Removal letters are written and signed on your device. You send them yourself, from your own mail app or the recipient's web form, to the recipient you choose. The letter contains the details you decided to include. We do not receive a copy.
Connecting to a PIIPER server (optional)
The app can be connected to a separately operated PIIPER server by entering that server's connection code. In that case the app sends the server one-way tokens derived from your information, public encryption keys, and the status of your removal requests, never the information itself. If you verify an email address through such a server, the server sees that one address briefly in order to send the verification code. Whoever operates that server is responsible for it; we do not operate one for the public.
Notifications
If you allow notifications, the app alerts you on your device when it finds a new exposure or a removal request changes status. These alerts are created on the device and do not contain your personal information.
Information we do not collect
We do not collect, store, or receive your name, email, phone number, Social Security number, contacts, location, device identifiers, the exposures found, or usage analytics. There is no account.
Deleting your data
In the app, Settings → Erase all my data destroys the encryption key and deletes every record and token. Without the key, any remaining copy of the encrypted data cannot be read by anyone. Deleting the app also removes its data.
App Store privacy label
On the App Store, PIIPER is listed as Data Not Collected. Nothing you enter is sent to the developer, and the two optional outside checks above go directly from your iPhone to the service you chose.
Children
PIIPER is not directed at children under 13.
This website
This section is about the web pages you are reading now, not the PIIPER app. The app's behavior is exactly as described above.
When a page on this website is opened, one visit record is sent to the developer for site metrics. It contains the time, the page, the referring site, browser type, device class (mobile or desktop), language, time zone, screen size, an anonymous random identifier kept in your browser's local storage so repeat visits can be counted, and your approximate location — city, region, and country — looked up from your network address by a third-party service (geojs.io). Your network address itself is not stored in the visit record, your device's GPS is never requested, and no name, email, or account is involved. The record is delivered to a private workspace channel (Slack) that only the developer can read. It is not sold, shared, or used for advertising.
If your browser sends a Global Privacy Control or Do Not Track signal, nothing is logged. You can also block scripts for this site or clear this site's data in your browser to remove the identifier. The hosting provider (Amazon CloudFront) may keep standard server logs as any website host does.
Changes to this policy
If a future version changes what the app does with data, this page will be updated and the effective date above will change.
Contact
Questions about privacy? Email aplgagal@gmail.com.