The short version
We keep as little as we can. No ads, no trackers, no third-party scripts, and no cookies unless you sign in.
Browsing and voting
- Votes need no account. To keep it to one vote per app from each network, we keep a scrambled code made from your network address and a secret. We never keep the address itself.
- The same code counts submissions and sign-in requests, so one network can't flood us.
Signing in
- You sign in with your email and a 6-digit code. We keep your email, your name if you add one, and your Pips.
- iPip and MacPip share one account, so this data lives in one place for both sites.
- Signed in, your browser keeps a sign-in cookie (
pip) and a small hint (pipin) so pages know to show your Pips. Signing in from MacPip uses a one-time code that lasts 60 seconds and a short-lived cookie that checks it. That hop runs only when you click Sign in.
Makers
When you submit an app we keep your email, so we can tell you when it is live, and the App Store details of your app, which are public anyway.
Who else sees it
iPip runs on Cloudflare, which carries every request. Emails go out through a mail service that sees the address and the message. We sell nothing to anyone.
Your choices
Write to [email protected] from your sign-in email to see, fix or delete what we keep. Deleting your account removes it from iPip and MacPip.
Last changed November 13, 2026.