Privacy Policy

Information We Collect

Newsletter Subscription

When you subscribe to our newsletter, we collect:

• Email address: Required to send you newsletter content
• Consent timestamp: Records when you provided GDPR consent
• Signup source: Tracks which page you subscribed from
• IP address: Collected automatically by our email service provider

Website Analytics

We use Google Analytics 4 with privacy-friendly settings to understand how visitors use our site:

• Pages visited and time spent on site
• Referring websites and search terms
• Device and browser information
• General location (country/city level)

Our GA4 configuration anonymizes IP addresses, disables Google signals, and turns off ad personalization. We do not use advertising networks or build user profiles for targeting purposes.

How We Use Your Information

Newsletter Communications

We use your email address to:

• Send weekly newsletter content about AI-powered product management
• Share methodology insights and building-in-public updates
• Notify you about new features or significant site updates
• Send double opt-in confirmation emails (required by law)

Website Improvement

We use aggregated analytics data to improve our content and user experience. This data cannot be used to identify individual users.

Data Sharing and Third Parties

Email Service Provider

We use Buttondown to manage our newsletter subscriptions. Buttondown is GDPR-compliant and processes your data according to their privacy policy:

• Your email and consent data are stored on Buttondown's secure servers
• Buttondown may process data in the United States under appropriate safeguards
• You can review Buttondown's privacy policy at: https://buttondown.com/legal/privacy

Website Hosting

Our website is hosted on Vercel, which may collect basic server logs including IP addresses and request information. Vercel is GDPR-compliant and you can review their privacy policy at: Vercel Privacy Policy.

Using Piper from ChatGPT, Claude and other AI assistants

You can connect Piper to an AI assistant you already use, such as ChatGPT or Claude, through Piper's connector at mcp.pipermorgan.ai (built on the Model Context Protocol, “MCP”). Here is what that connection does and doesn't do.

What the assistant can read. With your approval, given on a Piper sign-in page, the assistant can read:

• Your Piper profile: organization, active projects and stated priorities.
• The things Piper has confirmed with you about how you work.
• Your open GitHub issues, read through the GitHub account you connected to Piper.

The assistant cannot change anything in Piper through this connection, and it cannot see another person's data.

Where your data goes. When your assistant reads from Piper, that information goes to the assistant's provider (for example OpenAI or Anthropic) as part of your conversation. From then on it's handled under that provider's privacy terms, not ours. No AI model runs on Piper's side of this connection.

What Piper keeps about the connection.

• A record of each connected assistant app: the name it registers with and its sign-in callback addresses.
• Access credentials, stored only as one-way hashes, never in readable form. Access tokens expire after one hour. The longer-lived token that renews them expires after 30 days.
• When each connection was created and last used.
• Standard technical request logs (time, address requested, result), kept for security and troubleshooting.

Piper does not receive your conversations with the assistant. It only receives the specific requests your assistant makes to read the items listed above.

Turning it off. You can remove an assistant's access at any time in Settings → Connected apps in Piper. Access ends right away. Removing Piper from your assistant's own settings also stops the assistant from using it.

Your Piper account

When you sign up for Piper and use it, here is what we keep, where it lives, and what you can delete.

What we store.

• Your account details: username, email address, your password (stored only as a one-way hash, never in readable form), your settings, and your answers during setup.
• Your conversations with Piper: each message you send and each reply. These are encrypted when stored.
• What you create or connect in Piper: reminders and to-dos, projects and linked repositories, files you upload, and what Piper learns from your documents and your work. Uploaded files are encrypted when stored.
• The AI provider key you add. It's stored encrypted, and it's never written to our logs.

Where it lives. On our hosting provider, Fly.io, in San Jose, California. Our admin tools don't display your conversations, and the stored copies are encrypted.

Your AI provider. Piper sends your messages to the AI provider you connected (Anthropic or OpenAI), using your own key. From then on they're handled under that provider's privacy terms. There's no shared Piper key processing your conversations.

Logs. Our server logs don't keep the text of the messages you send to Piper. At most, they keep a scrambled fingerprint of a message. This doesn't affect your conversations, which you can still see in Piper.

Services you connect. If you connect GitHub, Slack or Notion, Piper reads and writes there when you ask. Google Calendar is read-only (see below). For GitHub and Slack, Piper never sees your password. Piper keeps the access the service grants, encrypted. When you disconnect GitHub, Piper deletes the stored copy.

Google Calendar. If you connect Google Calendar, Piper asks Google for read-only access to your calendar and for your Google account's email address. Piper reads your events only when you ask about your schedule or start your standup, and uses them only to answer you. Piper can't create, change or delete events.

To write that answer, Piper sends the details of the events you asked about to the AI provider you connected, using your own key. Piper's answer is kept with your conversations, encrypted.

Piper doesn't sell Google user data, use it for advertising, or use it to build or train AI models. No one at Piper Morgan reads it unless you ask us to, for example for support, or unless it's needed for security or to comply with the law.

The access Google grants is stored encrypted. When you disconnect Google Calendar in Piper, Piper revokes that access at Google and deletes its copy.

Piper Morgan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

No analytics or ad tracking in the app. The Piper app doesn't use analytics, advertising or error-reporting services.

How long we keep it. As long as your account exists. We don't automatically delete your conversations, files or account.

Deleting your data. In Piper you can delete files you uploaded, your AI provider key, what Piper has learned about you, your settings, and your to-dos, projects and linked repositories. Deleting removes them.

• Conversations. There's no way to delete a conversation inside Piper yet, so your conversations stay on our servers, encrypted. Our goal is a trash, where you can purge a conversation from your data for good.
• Your whole account. There's no way to delete your account inside Piper yet. We plan to add one. Until then, email support@pipermorgan.ai and we'll delete your account and everything in it within 14 days.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Data Security

We implement appropriate security measures to protect your personal information:

• All data transmission is encrypted using HTTPS
• Email data is stored with Buttondown using industry-standard encryption
• We regularly review and update our security practices
• We limit access to personal data to authorized personnel only

Data Retention

Cookies and Tracking

Our website uses minimal cookies and tracking:

• Essential cookies: Required for basic website functionality
• No advertising cookies: We do not use cookies for advertising or detailed user tracking
• No advertising trackers: We use Google Analytics 4 for site usage statistics, but do not embed social media widgets or advertising networks

International Data Transfers

Your data may be processed in the United States by our service providers (Buttondown, Vercel). These providers comply with appropriate data protection safeguards:

• Standard Contractual Clauses (SCCs) for GDPR compliance
• Industry-standard security and privacy practices
• Regular privacy and security audits

Children's Privacy

Our website and newsletter are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately.

Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify newsletter subscribers of significant changes
• Post the updated policy on our website