SHORT VERSION: NO PIPNOTE ACCOUNT REQUIRED. YOUR NOTES ARE YOURS.
Pipnote has no accounts and no sign-in, and we don't operate a server that receives your notes. What the app does send out is usage shape, never content: that a note was kept or sent, which courier carried it, which screen a button was tapped on. Never the note's text, never who it was for.
Those signals go to a small number of services, each doing one job:
On your phone, in the app's own storage. Notes you keep for yourself never leave the device.
A sent note is packed into the link itself and travels through whichever app you choose to send it with, usually Messages. It goes from your phone to theirs. It doesn't pass through us.
Because the note travels inside the link, treat a Pipnote link the way you would treat the message itself: anyone who has the link has what's in it.
Sealed links open a page that decodes the link in your browser to show who it's from and when it arrives. The decoding happens on your device; the note's contents are never displayed here.
One exception, so the note survives installing the app: when you open a sealed link without Pipnote installed, this page briefly parks the sealed link with our host so the app can collect it right after you install — without you having to tap the link a second time. It is deleted the moment the app picks it up, or within the hour either way. It is never opened, never logged, and never used for anything else.
pipnote.app uses Simple
Analytics to count page visits and interactions, such as menu clicks,
language choices, film playback and App Store clicks. It sets no cookies, collects no personal
data and doesn't follow you to other sites. We see aggregate numbers, like how
many people read this page or play a film. Interaction metadata uses fixed
labels, never your note text or sender name. Sealed-note paths are grouped
under /n/ so their encoded payloads are not sent as analytics paths.
Shortly after onboarding, iOS asks whether Pipnote may track your activity across other companies' apps and websites. If you allow it, Layers uses your device's advertising identifier to match your install to the campaign that brought you here. If you don't, iOS blocks the app from contacting Layers at all, and the app works exactly the same. You can change your answer any time in Settings → Privacy & Security → Tracking.
If you allow it, Layers receives an anonymous install ID, your device model and iOS version, the usage events described above and, if you subscribe, the product and price of what you bought: the same details as your App Store receipt, without your name.
In-app purchases are billed by Apple. Web purchases, when available, use RevenueCat Billing and Stripe. RevenueCat tells Pipnote whether Pro is active using a customer ID; opening a web activation link connects the purchase to the app installation. Pipnote does not receive your full card details.
Web checkout collects your email and the billing information requested by the payment provider. RevenueCat and Stripe process purchase and payment records to complete checkout, send receipts and activation links, and manage renewals, cancellations and refunds. We can access purchase records and your checkout email for billing support. This information is separate from your private notes. Contact hello@pipnote.app for help with purchase data.
Our hosted Pro funnel records steps and selections so we can understand where visitors complete or leave the flow. Campaign labels in the link help attribute visits. Do not enter personal notes into the funnel; its examples are prepared content. The app never logs activation links or their tokens.
As described above, install attribution uses the RevenueCat customer ID only when tracking permission allows Layers to run. The app does not send your checkout email or payment details to Layers.
If this policy changes, the new version appears here with a fresh date at the bottom.