Privacy Policy & Data Flow

Updated and effective September 23, 2026

PIPU delivers preset emoji phrases between people who choose to connect. No account, phone number, email, contacts, location, or advertising identifier is required.

How a PI travels

Your device creates a random device ID and signing key; the private key stays in the iOS Keychain.
The app sends the connection ID, a random message ID, and a preset PIPU code over HTTPS.
Our server verifies the signature, connection, purchase entitlement, and daily usage before asking Apple Push Notification service (APNs) to deliver it.
The recipient's device turns the code into a localized phrase and shows it on the Lock Screen and Dynamic Island. Classic PIPUs last about one minute and theme PIPUs about five minutes; a PU or close action ends them earlier.

Data we process

Anonymous identity: random device ID, display alias, and public key. The private key is never uploaded.
Connections and delivery: a persistent device PIPU code, pal requests, connection records, encrypted APNs and Live Activity tokens.
Brief interactions: message ID, preset code, device IDs, timestamps, and one-time reply or dismissal tokens. PIPU has no free-text chat. The server keeps code-only interaction receipts for 30 days to restore PI/PU times and reply markers.
Purchases and usage: Apple-signed product ID, original transaction ID, purchase, expiry and revocation dates, environment, and a per-local-calendar-day PI count and device time zone. Apple processes payment details; PIPU does not receive card data or your Apple ID.
Security: one-way hashes of IP addresses, timestamps, status codes, and necessary error logs for rate limiting, replay protection, and diagnosis.
On device: connection display cache, six Home selections, settings, up to 80 PI/PU history entries, and up to 50 sent emoji per pal. You can clear sent emoji; local history is removed when you disconnect, reset, or delete the app.

Purpose, permissions, and retention

We use this data only to create an anonymous identity, connect pals, deliver PI and PU, run Live Activities, restore purchases, enforce entitlements and limits, prevent abuse, and diagnose failures. The camera is used only when you choose to scan a PIPU Link QR code; frames are not retained. PI/PU relay records last up to about five minutes, code-only interaction receipts about 30 days, and rate-limit events about one hour. Purchase records are retained as needed to fulfill and restore purchases, prevent fraud, and meet applicable legal obligations.

Providers and security

Tencent Cloud provides server, database, and network infrastructure. Apple provides in-app purchases, transaction signatures, APNs, and Live Activity delivery. We do not sell data, build advertising profiles, or track you across apps. Traffic uses HTTPS, requests are device-signed, push tokens are encrypted at rest, and one-time tokens plus rate limits reduce abuse. PIPU codes are not currently end-to-end encrypted; the server must recognize a code to validate and route it.

Your choices and contact

You can disable permissions, disconnect a pal, clear local activities, or reset your anonymous identity. Reset removes the PIPU server identity and local data; Apple manages the underlying purchase record, which can be recovered with Restore Purchases. Dynamic Island and Lock Screen content may be visible to people nearby, so do not use PIPU for passwords, financial instructions, exact location, or emergencies. Children should use PIPU with guardian guidance. For access, correction, deletion, or complaints, email kirala2026@163.com.