Privacy policy

Last updated: October 19, 2026.

Pip is operated by Ethan Catzel. This policy covers the Pip iOS app and its backend services. Contact ethancatzel@gmail.com with privacy questions.

Information we collect

Account information: your Apple account identifier and the name and email Apple shares when you use Continue with Apple. Your Apple email may be a private relay address. We do not receive your Apple password. Email accounts provide a name and email; we store a salted password hash, never the raw password, and email you one-time codes to confirm your address or reset your password.
Training information: your workout duration, experience, injury notes you choose to enter, training preferences and requests, scheduled workouts, and recorded sets, repetitions, hold times, lifting loads, assistance bands, and session dates.
Technical information: your timezone for scheduling, IP address and client information in authentication or service logs, service error records, and crash and error reports. These reports can include device and operating system information, app version, timestamps, and technical details of a failure. Apple separately provides beta diagnostics through TestFlight.
Messages: information you send when contacting us for support or giving feedback.

How we use information

We use this information to sign you in, save and sync your training, generate and adjust workouts, track progress, respond to support requests, and investigate reliability or security problems. Injury notes are optional. Injury notes may contain sensitive health information; share only what you want used for training personalization.

AI planning and service providers

Pip uses AI to generate and adjust training. Relevant training context, including preferences, injury notes, workout requests, and recorded performance, is sent through OpenRouter to the model providers used for those features, currently OpenAI and Google. You can avoid entering injury notes, but AI planning still requires sending relevant training context to these services.

We use Cloudflare to host the API, store account and training records, and process planning jobs. We use Braintrust to record and inspect AI inputs, outputs, errors, and related metadata to debug and improve planning. These traces can contain training context, injury notes, and internal account identifiers.

We use Sentry to receive crash and error reports from the app and the service. A report can include device and operating system information, app version, timestamps, and technical details of the failure. We do not attach your name, email address, or account identifier to these reports.

These providers process information under their applicable service terms and privacy policies. AI providers may retain inputs or use them for model improvement depending on the service and its settings.

Other sharing

We do not sell your personal information or use it for advertising or tracking across other companies' apps and websites. We may disclose information when required by law or when necessary to protect users, secure the service, or address abuse.

Apple separately processes information for Sign in with Apple and, when you use TestFlight, beta testing. TestFlight can share crash logs, usage information, and feedback with us. See Apple's TestFlight privacy notice.

Storage, retention, and security

Account and training records are retained while your account exists. There is currently no automatic expiry period in Pip for stored training history. Pip does not schedule deletion of AI traces; Braintrust's retention depends on the account plan and settings. Sentry keeps crash and error reports for a limited period set by its plan. Authentication sessions expire after 30 days; this does not automatically delete the underlying records.

We use encrypted network connections and authenticated access to account data. Your device stores an authentication token in the iOS Keychain and keeps some workout and recovery state locally. No storage or transmission method can guarantee absolute security. Providers may process information in countries other than your own.

Your choices and deletion

You can edit your profile and training information in the app and control notification permission in iOS Settings. To delete your account, open Profile, choose Delete Account, and confirm with Apple or your email account's password. If your version does not include this option, contact us by email. To request access, correction, or help with deletion of your personal data, email ethancatzel@gmail.com. We may verify account ownership before acting.

Successful in-app deletion removes your account, saved training, and stored planning state from the active service. For Apple accounts, it also revokes Sign in with Apple access for the grouped Pip apps. It clears associated local workout drafts on the device used for deletion. Identifiable AI traces are handled through a separate manual cleanup request; we retain your internal account identifier and request date until that cleanup is complete. Contact us for the status of this cleanup. Provider logs and backups may remain subject to their retention processes. We will explain any information that must be retained for legal or security reasons. Signing out, uninstalling Pip, or ending TestFlight participation does not delete server records.

You may have additional privacy rights under the laws where you live, including the right to object to processing or complain to a data protection authority. Contact us to exercise applicable rights.

Changes

We will update this page when our practices change and revise the date above. Material changes will be communicated through the app or another appropriate channel.