Privacy Policy
Most of your Pip record stays on your device. When you agree to an AI scan or Ask Pip AI answer, Pip clearly tells you what will be sent and why.
This policy covers the Pip iPhone and Android apps, pippeptide.com, and support correspondence. “We”, “us”, and “our” mean Unakin Ltd, company number 14570755, the developer of Pip and the controller for the information described below.
Registered office: Flat 25, Ironworks 58 Dace Road, London, United Kingdom, E3 2NX. Privacy contact: ollie@unakin.ai.
Guided capture creates front, left, back, and right body photos. Pip can also keep the height, weight, age range, body-sex answer, focus goal, activity context, daily pulse, scans, fitted bodies, treatment records, notes, and Journey entries that you choose to add. Treatment logging is a record of what you enter; Pip does not prescribe or recommend treatment.
With permission, the iPhone app reads only your latest body-weight sample from Apple Health, including its date and source. Pip never writes to Apple Health. Motion is used for live capture guidance and is not saved. The current Android release does not request Health Connect or motion access.
Local photos and records are stored in Pip's private app storage and excluded from device backups. Removing Pip or using Delete all can make local data permanently unavailable, so export first if you want a copy.
iPhone Build 48 uses AI processing for completed four-photo scans. Before the first upload, the scan screen says that Pip will send four photos, height, weight, age range, and sex, names OpenAI and Modal, explains that Modal receives the full photos including face, hair, and surroundings, and labels the results as AI estimates rather than medical measurements. If your weight came from Apple Health, the disclosure says so. Nothing is uploaded until you choose “Agree & start scan”.
Pip prepares a separate analysis copy of each photo on your iPhone by removing metadata and background and masking the head. Those four prepared images, plus your entered height, weight, age range, body-sex answer and the source of the weight, travel through Pip's Railway service to OpenAI. OpenAI returns bounded exterior-body estimates and visible-shape observations. Pip does not send your name, treatment log, symptoms, notes, or Journey entries with the body-analysis request.
A second process sends metadata-stripped copies of the four full photos through Railway to Pip's private Modal service to create the fitted 3D body. These copies can include your face, head, hair, clothes, and visible surroundings. The staged source-photo bytes are removed from the avatar service after processing. The derived 3D result and necessary anonymous job record remain available until you delete the scan or withdraw consent.
Pip uses anonymous installation and request identifiers to protect these calls and record consent or deletion. The body-analysis service does not keep the submitted photos or result content in Pip's database. OpenAI requests are configured with store: false; OpenAI may still retain limited abuse-monitoring data under its applicable service terms.
Ask Pip always creates a supported answer on your device first. If you separately agree to AI answers, Pip may send your question and a short, bounded observation and evidence summary made from the record you asked about to OpenAI through Railway. It does not send photos, scan geometry, or your full Pip database. Medical, dosing, urgent-symptom, diagnosis, causation, and treatment-advice questions remain on-device and receive a fixed safety response. If the online answer fails, the local answer remains.
Apple App Store or Google Play handles payment. RevenueCat verifies the membership entitlement and may receive a random customer identifier, purchase history or store purchase token, platform, app version, locale, currency, and first- or last-seen timestamps. Pip does not send RevenueCat body photos, health data, treatment entries, notes, questions, or Journey data.
AppsFlyer's privacy-focused Strict SDK helps Pip understand an app install, app session, and whether onboarding was completed. It may process an AppsFlyer installation identifier and basic app, device, and attribution context. Pip does not enable cross-app tracking or send AppsFlyer photos, body or health data, treatments, symptoms, notes, questions, or Journey entries.
If you email us, we receive your email address, message, and the device or app details you include. Please do not send body photos, health records, medication documents, or a Body Story export to ordinary support email.
Cloudflare delivers and protects this website. It may process IP address, request headers, device and browser details, timestamps, requested pages, and security events. It may set the strictly necessary __cf_bmbot-management cookie, which expires after 30 minutes of inactivity. We do not use advertising pixels, cross-site tracking, or product-analytics cookies on pippeptide.com.
Pip does not make automated decisions that have legal or similarly significant effects on you.
Apple, Google, RevenueCat, AppsFlyer, Railway, OpenAI, Modal, and Cloudflare provide the services described above. They may process limited service information outside the UK or European Economic Area using their own applicable safeguards and privacy terms. Pip does not use these providers for advertising or cross-app tracking.
Local records remain until you delete them or remove Pip. Avatar source photos are removed from the processing service after the job; verified derived avatar files remain until scan deletion or consent withdrawal. OpenAI applies its service and abuse-monitoring retention terms despitestore: false. AppsFlyer, RevenueCat, Apple, Google, Cloudflare, and Railway retain necessary service records under their configured, contractual, or legal requirements. We normally keep support messages only as needed to resolve the request and for up to 12 months afterwards, unless security, law, or a dispute reasonably requires longer.
Remote scan deletion may briefly show as pending while Pip verifies that service copies are gone. Deleting Pip data cannot delete an original Apple Health sample, an App Store or Google Play transaction, a record a provider must retain by law, or a copy you previously exported.
Depending on where you live, you may have rights to access, correct, erase, restrict, object to, or receive a copy of personal data held by us, and to withdraw consent. Contact ollie@unakin.ai. We may need proportionate information to verify the request.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to the relevant authority where you live or work.
Pip is a personal progress-record tool, not a medical device. Photo and AI outputs are estimates, not clinical measurements. Any displayed body-fat range, waist estimate, fitted body, visible comparison, or future path can be wrong for an individual. Pip has not completed an independent DXA or tape-measure validation study. Do not use Pip to diagnose, prescribe, select a dose, or make another health or treatment decision. See the Methodology & Accuracy statement.
Pip is not designed for children. We will update this policy and provide any additional notice required before materially changing how sensitive information is used.
Unakin Ltd · Company number 14570755
Flat 25, Ironworks 58 Dace Road, London, United Kingdom, E3 2NX
For privacy questions or service-data requests, email ollie@unakin.ai.
