Pip

Privacy

Last updated October 1, 2026.

Pip is built so that it only sees your screen when you ask it to. This page lists exactly what leaves your Mac, where it goes, and what is kept.

When Pip looks at your screen

Only while you hold the Pip hotkey, after you double-press it for hands-free mode (below), or when you type a question in the Pip menu. Nothing runs in the background, and Pip never records video.

When an answer takes several clicks (for example Format, then Text, then Show Ruler), Pip follows along as you click so it can point at each next step. To find it, Pip looks at the names of the controls on screen and, in apps that don't provide names, reads the visible text on your screen. That happens only on your Mac: nothing from it is sent anywhere or saved, and it stops when the steps are done, after a short while without progress, or when you ask something else.

Hands-free listening

If you double-press the hotkey, Pip records as if you were holding it. Each time you pause, it handles what you said like any spoken question and keeps listening for the next one, until nothing is said for 8 seconds (a minute at most, or sooner if you say "that's all" or stop it). Your voice is streamed to AssemblyAI for that time, and a pill at the top of the screen shows it the whole time. While Pip is talking, it sends silence instead. Pip decides when you've paused from how loud the microphone is, on your Mac. Short fragments ("okay", "hmm") are dropped on your Mac and not sent to OpenAI.

What is sent when you ask a question

  • Your voice, streamed while you hold the hotkey (or, after a double-press, until it's quiet for 8 seconds, a minute at most), to AssemblyAI to turn it into text.
  • With voice typing on in a terminal, only your voice is sent (to AssemblyAI): the words are typed on your Mac, with no screenshot and no request to OpenAI.
  • A screenshot of each display, your question, the last few questions and answers from this session, and the names of the controls in the front window, menu bar, and Dock (for example "Bold" or "Wi-Fi", never text you typed into fields) to OpenAI, which writes the answer and says where to point.
  • With the same request: where your pointer is while you hold the hotkey, with the name of the control under it (or of the controls inside a circle you draw around something, which is also marked on the screenshot), and text you have selected in the app you're using, if any, so you can ask "what's this?" or "fix this". Pip reads these only while you hold the hotkey, after a double-press, or when you send a typed question.
  • The answer text to ElevenLabs, which turns it into speech.

When you ask Pip to find a file, the search runs on your Mac with Spotlight. File names and folders never leave your Mac.

When Pip does things for you

Everyday requests like "turn it down", "set a timer", "remind me to call John at 5" or "text Sarah I'm running late" are carried out on your Mac, without a screenshot and without sending your words to OpenAI. macOS asks for your permission the first time Pip uses each of these:

  • Calendar and Reminders: read on your Mac to answer "what's on my calendar" or add the reminder you asked for. Pip changes or deletes an event only after you confirm it on screen.
  • Contacts and Messages: used on your Mac to find the person you named and send the text you confirmed. Pip never sends a message without your confirmation.
  • Mail: when you ask Pip to check your email, the sender, subject, date and the first few lines of your newest unread messages (up to twelve) are sent to OpenAI to write a short spoken summary. Nothing else from your mailbox leaves your Mac.
  • Morning briefing: the titles and times of today's events, your reminders due today, and (if Mail is open) the senders and subjects of your newest unread email are sent to OpenAI to phrase the briefing.
  • Weather: Pip's server looks up the weather for the approximate area of your internet connection (city level, from Cloudflare) with Open-Meteo. Your precise location is never used and the location isn't stored.
  • Music: when you ask for a song on Spotify, the name you said is sent through Pip's server to Spotify's search; for Apple Music it's looked up with Apple's public iTunes search.

All of these go through Pip's own server on Cloudflare, which checks your plan and forwards the request. Pip's server does not store screenshots, audio, questions, or answers. OpenAI, AssemblyAI, and ElevenLabs process the data under their own API terms and may keep it for a limited time (for example, for abuse monitoring).

What Pip keeps

  • Your account: your Firebase user id and email address (from Google sign-in, handled by Google Firebase).
  • Your plan: Free, Pro or Max, your subscription status, and your Stripe customer id if you subscribe.
  • Monthly counts: how many questions you asked, how many characters were spoken, and how many voice sessions you started, used to apply your plan's limits.

On your Mac, Pip keeps your sign-in in the macOS Keychain and your settings (pet theme, hotkey, and so on) in its preferences. The conversation is kept in memory only and is gone when Pip quits.

Payments

Payments are handled entirely by Stripe. Pip never sees or stores your card details.

Counting installs and downloads

Pip counts copies, not people. The first time Pip opens, it makes a random install ID. The ID isn't tied to your account, your Mac's hardware, or anything you do. Pip sends that ID with its version and your macOS version when it updates and about once a day, so we know how many copies are installed and in use.

When you click a download button on this site, the click is counted with the page it came from and your country (from Cloudflare). Your IP address isn't stored. To count each person once per day, Pip keeps a one-way code made from your connection and browser that changes every day and can't be turned back into your IP address.

Pip does not track what you ask, what's on your screen, or which features you use.

Actions Pip can take

Pip can open a website (web links only), a System Settings pane, or an app that is already installed, and it shows you where it is going first. When you ask it to search for something, it opens that site's search page or types your search into the app's search box, and nothing else. When you ask it to find a file, it shows the file in Finder. It never moves your mouse.

When you ask it to, Pip also changes your Mac's volume, brightness, appearance and Do Not Disturb, controls music, arranges windows, runs a Shortcut you named, sets timers, and adds reminders (with Undo). Anything that sends or deletes — a text message, moving or deleting a calendar event — always waits for you to confirm it on screen.

Deleting your account

In the Pip menu, choose Delete account. This removes your account and usage counts from Pip's server and deletes your sign-in. If you have an active subscription, cancel it first with Manage subscription; Stripe keeps its own billing records as required by law.

Contact

Questions about your data or this policy: support@hipip.app.