PIPO

Legal

Privacy Policy

Version 2026-08-01 · in effect from 1 August 2026 · applies to the PIPO device, its firmware, and this website

PIPO has a microphone, so you are entitled to a straight answer about what it does. This page gives you one, at the level of specific fields and specific tables, rather than reassurance.

The short version. Nothing you say is recorded. Nothing you say is uploaded. The microphone is used on the device to notice a wake word and a short list of fixed commands, and that processing never leaves the device. When PIPO asks our server for a line to say, the request contains a handful of numbers describing its mood - not your words.

What is on this page

1. Who is responsible for your data

The data controller is [SELLER LEGAL NAME - DECIDE BEFORE LAUNCH], [SOLE TRADER / COMPANY + REGISTRATION NUMBER], of [FULL POSTAL ADDRESS]. Privacy questions go to [PRIVACY EMAIL].

PIPO is a small operation. There is no data protection officer, because at this size the law does not require one - a real person reads that mailbox and answers it.

EU and UK residents: see section 10 for your rights, section 13 for how data leaves your region, and [EU ARTICLE 27 REPRESENTATIVE - REQUIRED IF SELLING INTO THE EU] for our representative there.

2. What we do not do

Stated first, because it rules out most of what people are worried about.

  • We do not record audio. There is no recording feature in the device, and no storage on our servers that could hold one.
  • We do not sell or rent your data. Not to advertisers, not to data brokers, not to anyone.
  • We do not run advertising or tracking. This website loads no third-party scripts at all - no analytics, no tag manager, no fonts from someone else's server, no social buttons. Its content security policy blocks scripts outright.
  • We do not build a profile of you. We do not track you across sites, and we do not make automated decisions that have a legal or similarly significant effect on you.
  • We do not read your WiFi password. It is entered on the device and stays in the device's own storage. It never reaches us.
  • We do not store passwords. Only a one-way hash, which cannot be turned back into your password by us or by anyone who steals the database.

3. The microphone, in detail

When it is active

The microphone is powered whenever PIPO is awake and microphone features are switched on. It is not "always uploading"; it is always listening locally, in the same sense that a doorbell is always able to be pressed.

What happens on the device, and stays there

Audio is captured into a small buffer in the device's memory (RAM) and analysed there by speech recognition that runs on the ESP32-S3 chip itself. Two things are recognised:

  • The wake word - a single fixed phrase that tells PIPO you are talking to it.
  • A short fixed list of commands - a small, pre-built vocabulary compiled into the firmware. It cannot recognise free speech, because the chip cannot do that.

That audio never leaves the device. The buffer holds a moment of sound at a time and is continuously overwritten. It is never written to the device's flash storage, never saved to a file, never sent over your network, and never transmitted to us or to anyone else. When the power goes off, it is gone - there is nowhere for it to have been kept.

What the device does send when it hears something

The result of local recognition is at most a label: which command matched, or that the wake word fired. If that leads to a request to our server, the request contains the fields listed in section 4 - a mood number, an emotion label, an event name. It does not contain the audio, a transcript, or the words you used.

There is no cloud speech-to-text

As of version 2026-08-01 of this policy, PIPO has no feature that sends speech anywhere for transcription, and our servers have no endpoint that would accept audio. If we ever build one, it will be off by default, it will require a separate and explicit opt-in that says plainly what it does, and this page will be rewritten and re-versioned before it ships. We will not quietly widen this.

Turning it off

The microphone can be switched off from the device itself; with it off, the wake word is not detected either, and the rest of PIPO's personality carries on as normal. Cloud lines are controlled separately, in your dashboard (section 4).

Other people in the room

Because local recognition only matches a fixed vocabulary and keeps nothing, a conversation happening near a PIPO is not captured in any usable form. You are still the one responsible for telling the people you live or work with that there is a microphone on your desk - see section 10 of the Terms of Service.

4. What is sent to the AI provider

PIPO always has human-written lines to fall back on. Cloud generation is an upgrade on top of that: it exists so your PIPO repeats itself less.

The switch

Each unit has a cloud-lines setting in your dashboard. It is on when a device is first set up, and turning it off stops that unit contacting an AI service at all - immediately, and with no loss of personality. There is also a separate switch on our side that we use only to stop runaway cost or abuse on a single unit.

Exactly what the request contains

When a line is generated, this is the whole of what describes the moment:

  • Personality - one of the six SKUs.
  • Emotion label - from a fixed list, e.g. happy, idle.
  • Mood - a number from 0 to 100, and the band it falls in.
  • Level - the unit's level, and the bond band it falls in.
  • Time of day - morning, afternoon, evening, night.
  • Minutes since the last interaction - and the band it falls in.
  • Event - from a fixed list, e.g. poke, wake, levelup.
  • Up to 8 lines PIPO itself recently said, each trimmed to 80 characters, stripped to plain readable characters. These are the model's own previous output, sent so it does not repeat them. They are not anything you said.

Not sent: audio, transcripts, your words, your name, your email address, your device serial, your IP address, your location, or any account identifier. The AI provider receives a description of a mood and cannot tell one customer from another.

Before and after

Every request is checked by our own filter before any money is spent, and the generated line is checked again before it reaches your PIPO. Text that mentions self-harm causes the request to be refused outright and a gentle, human-written line to be used instead - see section 2 of the Terms of Service, which explains why PIPO must never improvise there.

What we keep afterwards

  • Counters, per device per day: how many requests, how many tokens, how much they cost, how many were served from cache, how many were blocked. Numbers only.
  • The generated line itself, in a short-lived cache keyed by the kind of moment it was for, so that other units in the same situation can reuse it instead of paying for a fresh call. The cache holds PIPO's output, never anything from you, and rows expire and are deleted automatically.
  • No transcripts, because there is nothing to transcribe.

5. What we store, field by field

Your account

  • Email address - your login, and how we reach you. Required.
  • Password hash - never the password itself.
  • Display name - optional, whatever you type.
  • Preferred language - guessed from your browser at signup, changeable later.
  • Which version of the terms you accepted, and when.
  • Account created, last signed in, account status.

Your devices

  • Serial number and personality SKU - assigned at manufacture.
  • Nickname you gave the unit, if any.
  • Which account it is bound to, when it was bound, and the history of previous bindings - kept so that resale, warranty and "I never gave it away" disputes have an answer.
  • Level, EXP and language as last reported by the unit.
  • Firmware version and update channel.
  • Health telemetry - uptime, free memory, WiFi signal strength, battery percentage. This is a last-known snapshot that each heartbeat overwrites; we do not keep a history of it. It exists so that "this batch reboots every 40 minutes" is a question with an answer.
  • Last seen time and last seen IP address.
  • Your cloud-lines setting for that unit.

Security records

  • Sessions - a hash of your session cookie (never the cookie), the IP it was issued to, a hash of your browser's user-agent string, and timestamps.
  • Pairing codes and device tokens - stored only as hashes, and short-lived by design.
  • Rate-limit counters - keyed by a keyed hash of whatever is being limited, so the table cannot be read back as a list of email addresses or IPs.
  • Audit log - security-relevant events such as a failed sign-in, a device pairing, or a unit being revoked, with the IP, a user-agent hash, and structured detail. It is written so that it never contains secrets, tokens or pairing codes.

Orders

If you bought directly from us, we hold what an invoice needs: name, delivery address, contact details, what you bought and what you paid. [PAYMENT / STOREFRONT ARRANGEMENT - WHO PROCESSES CARDS - DECIDE BEFORE LAUNCH] We never see or store full card numbers.

Server logs

Our hosting provider keeps ordinary web-server access logs - IP address, time, URL, response code, user-agent - as part of running the server. We use them for troubleshooting and abuse only.

6. Cookies

Two, both strictly necessary, both first-party, neither used for tracking. This is why there is no cookie banner: there is nothing here to consent to.

  • __Host-pipo_sess - keeps you signed in. Set only after you sign in, cleared when you sign out, and not readable by JavaScript. It holds a random token; the record that gives it meaning lives on our server.
  • __Host-pipo_csrf - a short-lived random value that lets us tell a form you submitted from a form another website submitted on your behalf. Expires in two hours.

The device does not use cookies. It authenticates with a challenge-response handshake instead, which means its secret never crosses the network.

7. Why we are allowed to hold it

For anyone in the EU, the UK, or anywhere with similar law, these are our legal bases:

  • Performing our contract with you - your account, device binding, firmware updates, and support. Without these we cannot deliver what you bought.
  • Legitimate interests - security records, rate limiting, abuse prevention, fleet health telemetry, and cost control. We keep these narrow: numbers and hashes rather than content, snapshots rather than histories.
  • Consent - anything optional, including cloud lines, which you can withdraw at any time with the dashboard switch. Withdrawing consent does not affect processing that already happened.
  • Legal obligation - tax and accounting records for orders, and responding to a lawful request from an authority.

8. Who else touches it

We use as few third parties as we can get away with. These are all of them:

  • Hosting: Hostinger hosts the website, the database and the firmware files, in [SERVER REGION - CONFIRM IN hPANEL]. They can technically access what is on the server; they are contractually a processor acting on our instructions.
  • AI provider: Anthropic PBC (the United States) generates lines from the fields listed in section 4. They receive no identifier for you or your device. We do not permit our inputs or outputs to be used to train their models.
  • Email: [TRANSACTIONAL EMAIL PROVIDER - DECIDE BEFORE LAUNCH] delivers account email such as verification and security notices.
  • Payments and storefront: [PAYMENT PROCESSOR / MARKETPLACE - DECIDE BEFORE LAUNCH]. They handle card details directly; we receive the order, not the card.
  • Shipping: the courier you chose receives the delivery address, and for international orders the customs declaration that country requires.

We may also disclose data where we are legally required to, or where it is necessary to investigate abuse, fraud or a security incident. If we are ever asked for your data by an authority, we will tell you unless we are legally forbidden from doing so.

If the business is ever sold, account data would transfer with it, and you would be told before it happened so that you could delete your account first.

9. How long we keep it

  • Account record - while your account is open, then deleted within 30 days of a deletion request.
  • Device binding history - kept for 24 months after a unit is unbound, so that ownership disputes and warranty claims can be answered, then reduced to the serial and the dates.
  • Sessions - a session expires after 14 days of inactivity and cannot live longer than 90 days in any case. Expired rows are removed.
  • Device telemetry - snapshot only. Each heartbeat overwrites the last, so there is no history to age out.
  • AI usage counters - 13 months, for cost control and abuse investigation. These are per-device numbers, not content.
  • Generated-line cache - hours to days. Rows carry an expiry and are deleted automatically.
  • Security and audit records - 12 months.
  • Rate-limit counters - swept away roughly a day after the window they belong to closes.
  • Order and tax records - as long as tax law requires us to keep them, which may be several years and is not something we can shorten on request.
  • Web-server access logs - kept by our hosting provider under their own schedule, typically a few weeks.

Audio is missing from this list because it is never stored anywhere, for any length of time. See section 3.

10. Your rights, including GDPR

If you are in the EU or the UK these rights come from the GDPR. We extend the same handling to every customer wherever they live, because running two standards would be more work than running one good one.

  • Access - ask for a copy of the personal data we hold about you.
  • Rectification - have anything inaccurate corrected.
  • Erasure - have it deleted, subject to records we are legally required to keep (section 11).
  • Restriction - ask us to stop processing while a dispute is sorted out.
  • Portability - receive the data you gave us in a machine-readable format.
  • Objection - object to processing we base on legitimate interests, including the security and telemetry records.
  • Withdraw consent - the cloud-lines switch in your dashboard is the main one, and it takes effect immediately.
  • No automated decision-making - we do not make decisions about you by algorithm that produce legal or similarly significant effects, and there is no profiling.
  • Complain - you can complain to your national data protection authority. We would rather you told us first, but it is your right either way.

Write to [PRIVACY EMAIL] from the email address on your account. We answer within 30 days. There is no charge unless a request is repetitive or excessive, and we will say so before charging anything.

We verify requests through the account email address rather than by asking for identity documents. Sending us a passport scan to prove who you are would create exactly the kind of data this policy is trying to avoid.

11. Deleting your account and data

Email [PRIVACY EMAIL] from your account address and ask. We will unlink your devices, delete your account, and confirm when it is done - within 30 days.

What survives deletion, and why

  • Order and tax records, because keeping them is a legal obligation.
  • Security records for their remaining retention period, with your account reference removed where it is not needed for the investigation they exist for.
  • The device record itself - serial, personality and firmware version - because it describes a physical object that still exists and may be resold. It is no longer connected to you.
  • A revocation entry, if a unit of yours was revoked as lost or compromised. Deleting it would let a stolen unit come back.

What is on the device is yours to erase

Level, EXP, mood and personality state live in the PIPO's own memory, not on our servers. Deleting your account does not wipe the robot. Use the factory reset in the device menu before selling or giving it away.

12. Children

  • Accounts require a minimum age of 16. Below that, a parent or guardian holds the account.
  • We do not knowingly collect personal data directly from children. A child using a PIPO under a parent's account is not asked for anything: the device reports mood numbers and health telemetry, not identity.
  • Nothing about a child is sent to the AI provider - see section 4 for the complete list of what is sent, which contains no personal data at all.
  • A parent or guardian can ask us to delete the account and everything attached to it at any time (section 11), and can turn cloud lines off entirely.
  • If you believe a child under the minimum age has given us personal data, tell us and we will delete it promptly.

Parents in the United States: we treat this as a product used under a parent's account rather than a service directed to children under 13, and we collect nothing from a child that would require verifiable parental consent.

13. International transfers

We are based in [SELLER COUNTRY], our servers are in [SERVER REGION - CONFIRM IN hPANEL], and the AI provider processes in the United States. If you are in the EU or the UK, your data therefore leaves your region.

Where that transfer needs a safeguard, we rely on [TRANSFER MECHANISM - STANDARD CONTRACTUAL CLAUSES / ADEQUACY - CONFIRM WITH COUNSEL]. In practice the exposure is small: the AI provider receives no identifier, and the account data that stays with our hosting provider is an email address, a password hash and a list of serial numbers.

14. Security, and what happens after a breach

  • Everything travels over HTTPS. The website ships no third-party JavaScript and blocks scripts through its content security policy.
  • Passwords are hashed with a modern algorithm designed to be slow to attack.
  • Session cookies, device tokens and pairing codes are stored as hashes, so a stolen database does not hand over working credentials.
  • Each device proves its identity by challenge-response, so its secret is never transmitted. Device secrets held on our side are encrypted with a key that is not in the database.
  • Sign-in, pairing and device authentication are all rate-limited.
  • A device secret known to be compromised gets its unit revoked, which contains the damage to that one unit.

No system is perfect. If a breach happens that puts your data at risk, we will notify the relevant supervisory authority within 72 hours where the law requires it, and tell affected owners directly with what we know, what we did, and what you should do.

Found a hole? Please report it to [SECURITY EMAIL]. We will not pursue good-faith research that stays away from other people's devices and data.

15. Changes to this policy

This policy is versioned. The current version is 2026-08-01, in effect from 1 August 2026.

  • Wording improvements happen without ceremony.
  • Any change to what we collect, who we send it to, or how long we keep it gets a new version and a note at the top of this page.
  • Anything that would materially reduce your privacy - above all, any feature that would send audio or a transcript off the device - gets an email to account holders and a fresh, explicit opt-in. It will never be switched on for you by default.

16. Contact

Controller
[SELLER LEGAL NAME]
Privacy email
[PRIVACY EMAIL]
Postal address
[FULL POSTAL ADDRESS]
Security reports
[SECURITY EMAIL]

Version 2026-08-01 · in effect from 1 August 2026 · Terms of Service · Home