Trust Center
What Pip does, in plain English
Built from the actual code, not a wish list. Here's what Pip can access, what it can't, what's stored, and who processes it.
| Area | What Pip does | What Pip does not do | Status |
|---|---|---|---|
| The tablet, outside Pip | Runs inside its own browser world (Watch, Learn, Play, Read, Create). | See, open, close, or control any other app, YouTube, messages, or the browser. | Live |
| Camera & microphone | Turns the camera on only when your child starts a camera activity, like an approved video call. | Ever use the camera or mic to watch or listen to your child, including during Pip's own safety checks. | Live |
| Content checks | Gives a link or site a quick automatic look when a parent adds it, plus a deeper check moments later; checks messages and requests inside Pip's world against your family's boundaries. | Continuously watch the screen, take screenshots, or review content on a schedule. | Live (rule-based today — see AI note below) |
| What you can see | See when Pip steps in on something, ask for a plain-English summary any time, and turn on alerts for real blocks. | Give you a screenshot feed or a routine "everything watched/played" log. | Live |
| Sign-in | Pairs a tablet to your family with a one-time code you generate. | Give your child a password or account of their own. | Live |
| Your family's data | Store what's needed to run Pip and show you what happened; let you export your data or delete your account from Settings — removed from our active systems right away, while provider backups age out on their own schedule. | Sell your data, use it to train AI, or show your child ads. | Live |
| AI model calls | Use Anthropic's Claude via their official API for the deeper content checks, when the key is provisioned. | Run a live model in every environment yet — see the note below. | In development |
| A native app / App Room streaming | N/A today for a new family. | Deliver a downloadable Android/iOS app, or run a real streamed game session (App Room shows a labeled placeholder). | In development |
The camera and microphone, in detail
Pip never uses the camera or microphone to watch or listen to your child. The camera only turns on when your child starts a camera activity — like a video call with family members you've approved — and Pip's safety checks never look through it. Calls happen directly between devices; nothing about a video or audio stream ever reaches Pip's AI or any of our operations tools.
The AI behind Pip's checks
Today: Pip's safety checks run on a deterministic, rule-based system. Nothing your family adds is sent to any AI model right now.
In development: we're building AI-assisted contextual checks on Anthropic's Claude models, called through their official API, for the kind of judgment rules alone can't capture.
Before activation: before that connection goes live, this page and our Privacy Policy will say so plainly, and we'll collect consent first wherever it's required. When it is live: Anthropic does not use commercial API inputs or outputs to train their models by default, and their standard API data retention may run up to 30 days.
What's stored, and for how long
Your account email, your child's first name and age, device pairing details, and the moments Pip steps in on (with a short reason) are stored so your dashboard makes sense. Creative content your child saves inside Pip — a story, a beat, a drawing — syncs to your account too. Camera and Photos content stays on the tablet itself and is never sent to us. Today, this data is kept until you delete your account — there isn't yet a shorter automatic expiration window for routine activity, and we're not going to claim one we haven't built. Most stored data is not separately encrypted beyond our providers' standard protections, and we'd rather tell you that plainly than let you assume otherwise.
Who processes it
| Area | Provider |
|---|---|
| Hosting | Vercel |
| Database | Neon Postgres (United States) |
| AI | Anthropic (Claude), via their official API |
| Resend — planned, no data flows yet | |
| Payments | None yet — no billing exists |
Still in development
- AI-assisted contextual checks — still in development, not active for families today.
- Email notifications — not yet active.
- Billing — no payment processor is live anywhere in the product today.
- Native Android/iOS apps with deeper device-level controls exist as engineering work but aren't distributed to any customer today; every family uses the browser-installed version described on this page.
How to reach a real person
Questions, concerns, or just want to talk it through? Email hello@allpurekids.com and a real person will get back to you.