App Privacy Policy

Effective 2 September 2026

The short version: the Pipkin app has no servers, no accounts, no ads, and no trackers. Everything you log stays on your device and in your own iCloud. Nothing you log about your child ever leaves your device. Three things do: anonymised usage counts that can't identify you (so we can see which features get used and where people get stuck); only if you subscribe to Pipkin Plus, the record of that subscription, so we can see how many people subscribe and whether they stay; and, if an App Store advert brought you here, which advert it was, so we can tell whether our advertising is worth paying for. Joined the beta waitlist on our website? How that email is handled is covered separately in the website & waitlist privacy policy.

This policy covers the Pipkin iOS app. The website and beta waitlist are covered by their own privacy policy. "We" means Forge 9 Labs LTD, the company behind Pipkin and the data controller for any personal data the app processes. Company number 17317315, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

What we collect

Almost nothing, and never anything you log. Pipkin runs no servers of its own and never transmits the data you record (your children's sleep, feeds, diapers, growth, milestones, or photos) to us or to anyone. There is no account to create.

The one exception is anonymised usage analytics. Pipkin sends a small set of aggregated, anonymous signals, for example "the insights screen was opened" or "a free trial was started", so we can see which features people use and where they get stuck, and improve the app. These signals carry no name, no email, no account, no device identifier, no IDFA, and no advertising ID; they set no cookies and cannot be tied back to you or used to track you across other apps or websites. They never contain anything you've logged about your child.

Who processes the analytics

The anonymised signals are processed by TelemetryDeck, a privacy-first, EU-based analytics service built around GDPR that uses no device identifiers and no fingerprinting. They act as a processor on our behalf and receive nothing that could identify you. Details are in TelemetryDeck's privacy policy.

Subscription records, and only those, are processed by RevenueCat, which we use to understand subscription revenue and retention. They also act as a processor on our behalf. RevenueCat is based in the United States, so this involves a transfer outside the UK; it is covered by a data processing agreement incorporating the UK Addendum to the EU Standard Contractual Clauses. They receive nothing you have logged about your child. Details are in RevenueCat's privacy policy.

How we measure our advertising

We sometimes pay to advertise Pipkin in the App Store. If you installed Pipkin after seeing or tapping one of those adverts, Apple tells us which campaign, ad group and search keyword led to the install, and whether it was a first download or a re-download. If no advert led to your install, Apple tells us that instead and we record it as organic. We use this for exactly one thing: working out whether the money we spend on advertising is worth spending.

This comes from Apple's own attribution service and describes the advert, not you. There is no name, no email, no IDFA and no advertising ID in it, and it is never combined with anything you have logged about your child. It is attached to the anonymised signals described above, and so reaches our processor TelemetryDeck, which lets us see whether people who arrived from an advert use the app differently without us learning who any of them are. Because this is Apple reporting on Apple's own adverts, rather than us following you across other companies' apps and websites, it is not tracking — which is why Pipkin shows no tracking permission prompt. Apple explains its side in Apple Advertising & Privacy.

Where your data lives

Everything you log (sleep, feeds, diapers, growth measurements, milestones, and photos) is stored in a database on your device. If your device is signed into iCloud, Pipkin syncs that database to the private CloudKit database attached to your Apple ID, so your data follows you across your own devices. That storage belongs to you and is governed by Apple's privacy policy; we cannot read, access, or recover it. The one thing that can change where your data lives is co-parent sharing, below: if you turn it on, a shared household is copied into a shared iCloud zone rather than staying only in your private one, but we still can't read it either way.

Sharing with a co-parent

Sharing is optional and off until you turn it on. If you invite another caregiver to share a household, the household and the children and events under it are copied into Apple's shared CloudKit storage so the person you invite can see and add to it on their own device. That shared storage is governed by Apple's privacy policy; both you and anyone you invite can read and write it, but we still can't read or access it ourselves.

You decide who to invite and can remove a co-parent at any time in the app. Removing someone stops future syncing to them. A copy of data shared while they had access may remain on their device or in their iCloud, which is outside our control. Deleting a shared household removes it from the shared zone for everyone.

Photos

Milestone and profile photos are stored inside Pipkin's database on your device and synced to your private iCloud like everything else. They are never uploaded anywhere else, and Pipkin only accesses photos you explicitly pick.

Purchases

Pipkin Plus subscriptions are bought and charged entirely by Apple through the App Store. We never see your payment details. Your card, your Apple ID and your billing address stay with Apple, and are never shared with us or anyone else.

If you subscribe, a record of that subscription is shared with our processor RevenueCat so we can measure how the subscription is doing. That record is the transaction as Apple describes it: which plan you bought, when, the price and currency, your country, whether you are in a free trial, and whether the subscription renewed, lapsed or was refunded. It is tied to a random identifier generated on your device, not to your name, your email, your Apple ID, or anything you have logged in the app. We cannot use it to work out who you are, and it is never combined with your child's data, which never leaves your device at all.

If you never subscribe, nothing is ever sent: the record only exists because a purchase happened.

Children's privacy

Pipkin is made for parents and caregivers. The information you record about your children is entered by you, stays under your control, and is stored as described above. We never see it.

Support email

If you email us for help, we'll receive your email address, your message, and the basic diagnostics the app pre-fills (app version, iOS version, device model, locale). We use that information only to help you, and we don't add you to any mailing list. The waitlist above is strictly opt-in.

Deleting your data

You can delete individual entries or whole child profiles inside the app (deleting a child removes all of their events). Deleting the app removes the on-device database. iCloud-synced data can be removed by deleting it in the app while online, or via Settings → Apple ID → iCloud on your device.

Changes to this policy

If Pipkin ever adds something that touches your data, for example optional crash reporting, this policy will be updated first and the change called out in the app's release notes. The effective date at the top always reflects the latest version.