App Privacy Policy

Effective 15 June 2026

The short version: the Pipkin app has no servers, no accounts, no ads, and no trackers — everything you log stays on your device and in your own iCloud. The only data that ever leaves your device is anonymised usage counts that can't identify you (so we can see which features get used and where people get stuck), and they never include anything you've logged about your child. Joined the beta waitlist on our website? How that email is handled is covered separately in the website & waitlist privacy policy.

This policy covers the Pipkin iOS app. The website and beta waitlist are covered by their own privacy policy. "We" means Forge 9 Labs LTD, the company behind Pipkin and the data controller for any personal data the app processes — company number 17317315, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

What we collect

Almost nothing — and never anything you log. Pipkin runs no servers of its own and never transmits the data you record — your children's sleep, feeds, diapers, growth, milestones, or photos — to us or to anyone. There is no account to create.

The one exception is anonymised usage analytics. Pipkin sends a small set of aggregated, anonymous signals — for example "the insights screen was opened" or "a free trial was started" — so we can see which features people use and where they get stuck, and improve the app. These signals carry no name, no email, no account, no device identifier, no IDFA, and no advertising ID; they set no cookies and cannot be tied back to you or used to track you across other apps or websites. They never contain anything you've logged about your child.

Who processes the analytics

The anonymised signals are processed by TelemetryDeck, a privacy-first, EU-based analytics service built around GDPR that uses no device identifiers and no fingerprinting. They act as a processor on our behalf and receive nothing that could identify you. Details are in TelemetryDeck's privacy policy.

Where your data lives

Everything you log — sleep, feeds, diapers, growth measurements, milestones, and photos — is stored in a database on your device. If your device is signed into iCloud, Pipkin syncs that database to the private CloudKit database attached to your Apple ID, so your data follows you across your own devices. That storage belongs to you and is governed by Apple's privacy policy; we cannot read, access, or recover it. The one thing that can change where your data lives is co-parent sharing, below: if you turn it on, a shared household is copied into a shared iCloud zone rather than staying only in your private one — but we still can't read it either way.

Sharing with a co-parent

Sharing is optional and off until you turn it on. If you invite another caregiver to share a household, the household and the children and events under it are copied into Apple's shared CloudKit storage so the person you invite can see and add to it on their own device. That shared storage is governed by Apple's privacy policy; both you and anyone you invite can read and write it, but we still can't read or access it ourselves.

You decide who to invite and can remove a co-parent at any time in the app. Removing someone stops future syncing to them. A copy of data shared while they had access may remain on their device or in their iCloud, which is outside our control. Deleting a shared household removes it from the shared zone for everyone.

Photos

Milestone and profile photos are stored inside Pipkin's database on your device and synced to your private iCloud like everything else. They are never uploaded anywhere else, and Pipkin only accesses photos you explicitly pick.

Purchases

Pipkin Plus subscriptions are processed entirely by Apple through the App Store. We never see your payment details. Apple shares only anonymous, aggregated sales figures with us.

Children's privacy

Pipkin is made for parents and caregivers. The information you record about your children is entered by you, stays under your control, and is stored as described above. We never see it.

Support email

If you email us for help, we'll receive your email address, your message, and the basic diagnostics the app pre-fills (app version, iOS version, device model, locale). We use that information only to help you, and we don't add you to any mailing list — the waitlist above is strictly opt-in.

Deleting your data

You can delete individual entries or whole child profiles inside the app (deleting a child removes all of their events). Deleting the app removes the on-device database. iCloud-synced data can be removed by deleting it in the app while online, or via Settings → Apple ID → iCloud on your device.

Changes to this policy

If Pipkin ever adds something that touches your data — for example, optional crash reporting — this policy will be updated first and the change called out in the app's release notes. The effective date at the top always reflects the latest version.