The longer version is below, in two parts: this website, then the Pip app. They're separate things and they handle data differently, so we keep them apart.
This website (pip.katelastrapes.com)
A simple hello-and-waitlist page. It doesn't run your paperwork — it just tells people about Pip and lets them ask to be notified.
What it collects
- Your email address — only if you type it into the waitlist form. Alongside it, Pip notes which page (and any campaign link) you came from and the date you signed up, so we know where people are finding Pip. That's the whole of it.
- A theme preference. If you switch the site to dark mode, a small cookie remembers that so it stays dark next time. It's a preference, not a tracker.
- Basic server logs. Like any website, our host records ordinary technical details when your browser loads a page — your IP address, browser type, and the time — to keep the site running and secure.
What it doesn't collect
- No accounts and no passwords — there's nothing to sign up for here.
- No tracking or advertising cookies, no pixels, no third-party ad networks.
- Never your documents. Your binder, your files, your household data — none of it ever comes near this website.
The email you'll get
If you join the waitlist, you'll get the occasional note from the nest — short updates as Pip grows — and first word when Pip is ready to download. Every email has an unsubscribe link, and it works the moment you click it. We won't use your address for anything else, and we'll never sell or share it.
Who helps run the site
A few trusted services keep the site online. Each one only ever touches your email and basic technical data — never your household documents:
- Relayplex — hosts the site and stores waitlist signups.
- Resend — delivers the waitlist emails.
- GitHub Actions — runs the small script that sends your welcome note.
- Google Search Console & Ahrefs — show us aggregate search and traffic trends (how many people visit, which pages are popular), never profiles of individual visitors.
Each is an established service with its own privacy policy; depending on the provider, your email and technical data may be processed in the United States or other countries.
The Pip app
This is the heart of it. Pip is a Mac app that reads your household paperwork and files it for you. It's built local-first — a specific promise about where your data lives.
Everything starts on your Mac
Your documents stay as normal files in a folder on your Mac — your family binder. Pip keeps an index of them in a small database on that same Mac. There's no Pip account, no Pip server holding your files, and no analytics phoning home. If you deleted Pip tomorrow, your documents would still be sitting in Finder, exactly where they've always been.
The AI — and what actually leaves
Pip uses AI to read and sort your paperwork. Here's the honest part: some of that can happen in the cloud, so this is where we're most precise.
- Pip runs on your own Claude subscription (a Claude Pro plan or higher). There's no Pip API key and no Pip middleman — when Pip calls on cloud AI, it's your Claude account doing the work, under Anthropic's terms.
- When Pip uses the cloud, it sends only what the task needs — the document you're filing, or (when you ask Pip a question in chat) the non-sensitive files needed to answer it. Your Medical and Vital Documents are never sent, and your whole binder is never handed over at once.
- Prefer to keep everything on the machine? Local-only mode does exactly that: filing runs on Apple's on-device intelligence, and nothing — not even a filename — goes to the cloud. Anything that would need the cloud simply waits for you.
Some things Pip never reads
Your most sensitive categories — Medical and Vital Documents — are filed by their name alone. Pip never reads, indexes, or quotes what's inside them, and never sends their contents to the cloud. That's built into how Pip works, not a setting you have to find and switch on.
Connectors you choose to turn on
Pip can connect to a few outside services to save you typing — Gmail (read-only, to pull in bills you label), Google Calendar, Google Drive, Google Photos, and a read-only bank feed. Every one of them:
- starts off;
- turns on only with your explicit permission, one capability at a time;
- shows you plainly what it will send before you enable it; and
- can be disconnected — and for account logins like Google, the access is actually revoked at the provider, not just forgotten.
When a connector is on, its data comes to your Mac for Pip to file. Pip doesn't hand it off to any Pip server or outside party of its own — and if you later run cloud AI on something it brought in, the AI rules above apply.
Your phone, and a second Mac
Pip has a phone companion, and an optional partner mode for a second Mac in your household. Both work only across your own devices, over your private Tailscale network — never the open internet. Sign-ins are protected, every signed-in device is listed so you can sign it out, and there are no public links to your binder. There never have been.
Keeping it safe where it sits
Because your files live on your Mac as ordinary documents, the lock on the door is your Mac's own disk encryption. Pip asks you to turn on FileVault (macOS's built-in whole-disk encryption) before you add real documents — that's the at-rest protection for everything. Passwords and connector keys Pip needs are kept in the macOS Keychain, not in plain text. And the encrypted emergency binder you can export for a USB stick or safe-deposit box is locked with a passphrase that Pip never stores — only your family knows it.
If you report a bug
Bug reports are opt-in and shown to you first. Pip scrubs personal details like your username and file paths by default, you see exactly what will be sent before it goes, and reports go to a private repository — never a public one.
Children's privacy
Pip is a tool for adults running a household. This website isn't directed at children, and we don't knowingly collect information from anyone under 16. The app may well hold documents about your kids — a permission slip, a vaccination record — but those live in your binder on your Mac, handled with the same care as everything else.
Your choices
- Your email: want it gone? Click unsubscribe in any email, or just write to Kate (below) and she'll remove it. You can also ask what's on file — it's only ever your address and signup details.
- Your documents: they're already yours, on your Mac. You add, move, or delete them in Finder like any other file — Pip doesn't keep a second copy somewhere else.
- Wherever you live: if you're somewhere with formal data rights — the EU or UK (GDPR), California (CCPA/CPRA), and others — those rights apply, and we'll honor them. For the record: Pip does not sell or share your personal information, full stop.
If something ever goes wrong
Pip is built and run by one person, and she takes a bad day seriously. If there's ever a security problem that could have exposed your data, the plan is already written down: you get a direct, plain-language email — naming exactly what was affected and what to do — within 72 hours of it being confirmed. No burying it in fine print.
Changes to this page
Pip is in alpha and growing, so this page will grow too. If it changes in a way that matters, we'll update the date at the top — and for anything significant, we'll tell waitlist members by email.
Reach a human
Questions about any of this? There's no privacy department — there's Kate. Email kate.lastrapes@gmail.com and she answers every one.
he keeps the binder — and the secrets — so you don't have to. 🦉