Privacy, in plain words

This website (pip.katelastrapes.com)

A simple hello-and-waitlist page. It doesn't run your paperwork — it just tells people about Pip and lets them ask to be notified.

What it collects

• Your email address — only if you type it into the waitlist form. Alongside it, Pip notes which page (and any campaign link) you came from and the date you signed up, so we know where people are finding Pip, and, if you tick the box, whether your Mac has Apple Intelligence on. That's the whole of it.
• A theme preference. If you switch the site to dark mode, a small cookie remembers that so it stays dark next time. It's a preference, not a tracker.
• Basic server logs. Like any website, our host records ordinary technical details when your browser loads a page — your IP address, browser type, and the time — to keep the site running and secure.

What it doesn't collect

• No accounts and no passwords — there's nothing to sign up for here.
• No tracking or advertising cookies, no pixels, no third-party ad networks.
• Never your documents. Your binder, your files, your household data — none of it ever comes near this website.

The email you'll get

If you join the waitlist, you'll get the occasional note from the nest — short updates as Pip grows — and first word when Pip is ready to download. Every email has an unsubscribe link, and it works the moment you click it. We won't use your address for anything else, and we'll never sell or share it.

Who helps run the site

A few trusted services keep the site online. Each one only ever touches your email and basic technical data — never your household documents:

• Relayplex — hosts the site and stores waitlist signups.
• Resend — delivers the waitlist emails.
• GitHub Actions — runs the small script that sends your welcome note.
• Google Search Console & Ahrefs — show us aggregate search and traffic trends (how many people visit, which pages are popular), never profiles of individual visitors.

Each is an established service with its own privacy policy; depending on the provider, your email and technical data may be processed in the United States or other countries.

The Pip app

This is the heart of it. Pip is a Mac app that reads your household paperwork and files it for you. It's built local-first — a specific promise about where your data lives — and since late 2026 he asks for outside help with one job, sorting. Here's exactly what that means.

Everything starts on your Mac

Your documents stay as normal files in a folder on your Mac — your family binder. Pip keeps an index of them in a small database on that same Mac. There's no Pip account, no Pip server holding your files, and no analytics phoning home. If you deleted Pip tomorrow, your documents would still be sitting in Finder, exactly where they've always been.

How Pip reads

Pip uses AI in a few places, and only one of them can leave your Mac: deciding what a new document is, so he can give it a title and a folder. Everything else — search, due dates, the index, your binder, the other small on-device readers — stays on your Mac. For that sorting job Pip has a ladder, and he uses the lowest rung that works:

• Your Mac screens first. Before anything leaves, Pip checks the filename and a keyword screen on your Mac. If either says medical or vital record, the document is handled entirely on your Mac and nothing about it is sent anywhere.
• Then Kate's relay and Claude. With a subscription and an internet connection, Pip sends the document's filename first and, if the screen found nothing sensitive, the first part of its text, along with your binder's category names, a few example titles already in it, and any filing rules you've set. That goes to a small relay Kate runs (on Cloudflare), which passes it to Anthropic's Claude model and returns one answer: a title, a category, and the dates it noticed. Never a whole document. Never your to-dos, your questions, or anything you've already filed.
• Apple's on-device model as the fallback. No subscription, no connection, or Pip has read his fill for the day (300 documents)? If Apple Intelligence is on, Apple's on-device model reads the same excerpt on your Mac instead. If it isn't, Pip names the file from what he can see and puts it in Needs Review for you. Nothing is ever blocked.

What the two outside parties see:

• Kate's relay checks that the request carries a valid App Store subscription receipt, counts it toward the day's 300 documents (600 calls, two per document; a call that fails and is retried once costs one more), and passes it on. It logs the kind of request, whether it succeeded, how long it took, and the receipt's id — never the filename, the text, or the answer. It stores none of your content.
• Anthropic processes the excerpt to produce the answer, under its commercial terms: it does not use what Pip sends to train its models and does not keep it beyond the short period those terms allow. Anthropic is not told who you are: it sees the request from Kate's relay, not from you, with no receipt, account, address or device identifier attached. What it reads is the filename and excerpt themselves, and a document's own text can contain a name.

Pip needs an Apple silicon Mac on macOS Tahoe. Apple Intelligence is what makes the on-device fallback possible; the cloud step is what the subscription pays for. Kate's stated plan is to move this job back onto your Mac as the on-device reader gets good enough, one task at a time, in app updates — and this page will say so when it happens.

Medical and Vital Documents get extra care

Your most sensitive categories — Medical and Vital Documents — are handled differently. Once a document is filed in one of them, Pip keeps its contents out of the search index and out of the AI's answers and briefings. That's built into how Pip works, not a setting you have to find and switch on.

What can leave your Mac

Apart from the sorting request above, Pip makes no internet request of his own, and he doesn't connect to any Google service or any bank. Here's every way data can still move, and who moves it:

• Sorting a new document, described above. Filename, first part of the text, your category names — to Kate's relay and on to Claude, only with a subscription and a connection, never for anything the screen flags as medical or vital.
• Your subscription, through Apple. You pay Apple; Pip and Kate never see your card, your name, or your email. Apple gives Pip a signed receipt, and that receipt's id is the only thing Kate's relay uses to know a request comes from a subscriber.
• Helping Pip learn, off until you turn it on. In Settings you can choose to send Kate your corrections: which category Pip proposed, which you chose, whether you changed the title (yes or no, not the words), which reader made the proposal, the date and time you made the correction, and the short note you type if you give a document a thumbs-down. No filenames, no titles, no text. Kate keeps these for twelve months, tied to your receipt id and nothing else, and uses them to make Pip's sorting better. Turn it off any time; nothing more is sent.
• iCloud sync, off until you turn it on. If you switch it on, Pip syncs your to-do list through the private database in your own iCloud account, under Apple's terms. Only to-dos sync; your documents never do. You can pause sync, or delete Pip's data from iCloud, at any time.
• Your calendar. When you add a due date to your calendar, Pip puts an event holding the document's title and the date in your default calendar, through macOS. If that calendar syncs — to iCloud, Google, Exchange, or a calendar you share — the event syncs with it. That's your calendar account doing its job, not a Pip connection.
• Voice capture. Hold the capture button to speak a to-do. Your speech is turned into text on your Mac, and no audio is kept or sent. The first time you use it, macOS may download Apple's on-device speech model from Apple.
• Crash reports, through Apple. If you've turned on Share with app developers in macOS, Apple may share crash reports and usage statistics for Pip with us, under Apple's own privacy policy. You can turn that off in System Settings at any time.

Who helps run the app

Three companies touch the sorting request, and only that:

• Apple — sells the subscription and issues the receipt, under Apple's own privacy policy.
• Cloudflare — hosts Kate's relay and the small store for the counts and, if you opt in, your corrections.
• Anthropic — runs the Claude model that reads the excerpt, under its commercial terms.

Each may process that data in the United States or other countries. None of them receives your binder, your index, or anything you've already filed.

Your phone, later

Pip starts on the Mac. An iPhone companion is planned for a later wave; it isn't part of Pip yet. So it can pair with your own devices, Pip listens on your local network while it's open and announces itself there: other devices on the same Wi-Fi can see that a Mac running Pip is nearby, and that Mac's name. None of your documents are shared this way, and macOS asks you once whether to allow it. There are no public links to your binder. There never have been.

Keeping it safe where it sits

Because your files live on your Mac as ordinary documents, the lock on the door is your Mac's own disk encryption. Pip relies on FileVault (macOS's built-in whole-disk encryption); if it's off, please turn it on before you add real documents — that's the at-rest protection for everything. And the encrypted emergency binder you can export for a USB stick or safe-deposit box is locked with a passphrase that Pip never stores — only your family knows it.

If you report a bug

Bug reports are your choice, and Pip shows you the report first. It removes your username, home-folder paths, file names, numbers, and email addresses, and leaves out anything about Medical or Vital Documents. Then it opens a draft in your own mail app: nothing goes until you press send, and it reaches Kate as an ordinary email, with your address on it.

Children's privacy

Pip is a tool for adults running a household. This website isn't directed at children, and we don't knowingly collect information from anyone under 16. The app may well hold documents about your kids — a permission slip, a vaccination record — but those live in your binder on your Mac, handled with the same care as everything else.

Your choices

• Your email: want it gone? Click unsubscribe in any email, or just write to Kate (below) and she'll remove it. You can also ask what's on file — it's only ever your address and signup details. If you've sent a bug report, ask and she'll delete that too.
• Your documents: they're already yours, on your Mac. You add, move, or delete them in Finder like any other file — Pip doesn't keep a second copy somewhere else, and neither does the relay.
• Your corrections: the Settings toggle stops them. To have the ones already sent deleted, write to Kate with roughly when you turned it on; they're keyed to your receipt id, so she'll ask you for the subscription's order id from your Apple receipt to find them.
• Sorting without the cloud: cancel the subscription, or go offline, and Pip files with Apple's on-device model or his own rules instead. The binder works either way.
• Wherever you live: if you're somewhere with formal data rights — the EU or UK (GDPR), California (CCPA/CPRA), and others — those rights apply, and we'll honor them. For the record: Pip does not sell or share your personal information, full stop.

If something ever goes wrong

Pip is built and run by one person, and she takes a bad day seriously. If there's ever a security problem that could have exposed your data, the plan is already written down: you get a direct, plain-language email — naming exactly what was affected and what to do — within 72 hours of it being confirmed. No burying it in fine print. The app itself has no account and no email address for you, so if we find a security problem in the app, the fix ships in an update and we say so plainly in its notes and on this site.

Changes to this page

Pip is young and growing, so this page will grow too. If it changes in a way that matters, we'll update the date at the top — and for anything significant, we'll tell waitlist members by email.

Reach a human

Questions about any of this? There's no privacy department — there's Kate. Email kate.lastrapes@gmail.com and she answers every one.

he keeps the binder — and the secrets — so you don't have to. 🦉