Privacy

Pip is built to need as little of your data as possible — which turns out to be almost none. No account needed, no personal data, no cross-site tracking, no cookies. We do count anonymous, cookieless usage so we can see what’s working — nothing that identifies you. Here’s the whole story, plainly.

Your profile — name, avatar, your Roll, stats, card backs, all of it — lives in your browser’s local storage, on your device. Nothing leaves your device unless you ask it to. Clear your browser data and it’s gone; we keep no copy, because we never had one.

Pip has an optional account, and it exists for exactly one thing: carrying your progress to another device. It is off unless you turn it on, in Settings, under Account. Until then Pip makes no request to us at all, holds no identity for you, and there is no row anywhere with your name on it.

Turn it on and we store two things: your email address, so you can sign back in, and a copy of the same profile that was already on your device. Nothing else. No hand histories beyond what your profile already holds, no IP-based profiling, no marketing email, ever. The data sits with Supabase on our behalf, and password-reset email goes out through Resend.

You can delete it from the same place you made it. “Delete my account and synced data” in Settings removes the account and the stored profile together, and it is genuinely gone rather than flagged. Your profile on the device stays exactly as it is, and Pip keeps working the way it did before.

You can also just ask. Email hello@playpip.io from the address on the account and we’ll delete it for you within 7 working days, whether or not you can still get into the app. Once it’s gone we keep nothing: no archive, no copy set aside, nothing to come back later and find.

• No account needed. You can play everything without one. There’s an optional account for moving your progress between devices (above), and that’s the only thing it does.
• No personal data. The counts we keep (below) are anonymous and aggregate — never your name, avatar, Roll, or anything that points back to you. You can check: it’s all in the open repo.
• No tracking cookies. None. So there’s no cookie banner to click away, either — and no way to follow you around the web.
• No selling your data. We don’t have any to sell, and wouldn’t if we did.

To know whether Pip is any good — whether people find it, start playing, and come back — we keep a handful of anonymous, aggregate counts through Umami, a privacy-first, cookieless analytics tool. It records things like page views and a couple of milestones (someone made a profile, someone played their first hand) with no cookies, no fingerprinting, and no personal data. We can’t tie any of it to a person — including you. It exists so we can improve the game, and for nothing else. It’s never sold or shared.

The counts are held by Umami on our behalf and roll off after about six months. We don’t keep our own copy beyond that.

The site is served as plain files by Cloudflare. Like any web host, Cloudflare keeps standard access logs — things like IP addresses and which files were requested — to deliver the page and keep it standing up. That’s Cloudflare’s doing, under their own privacy terms; we don’t add to it and we don’t go digging through it.

When you copy a hand link or a Daily result, the data rides inside the link itself — nothing is uploaded. It only goes anywhere if you paste it somewhere. Following a link out to GitHub takes you to GitHub, under their rules, not ours.

Pip is play money, but it’s still card play. It’s meant for people 13 and over.

If this ever changes — say we add something you can pay for — we’ll update this page and the date at the top. The honest version: right now there’s very little to say, and we’d like to keep it that way.

Pip is open source. The whole app lives at github.com/playpip/pip-web — you can read exactly what it does and doesn’t collect. Questions? Open an issue there.