Pipeq

Privacy Policy

Last updated: 15 October 2026

This policy explains what personal data Pipeq collects, why, who receives it, how long it is kept and what rights you have. It applies to pipeq.app and the Pipeq app.

Who we are

Pipeq is operated by Individual Entrepreneur Dmitrii Molochkov, Georgia (“we”, “us”). We are the controller of the personal data described here. Contact for anything about your data: privacy@pipeq.app. We answer within one month.

What we collect

  • Your account. Your email address and name. If you sign in with Google, we receive from Google your name, email address, profile picture link and Google account ID, and nothing else. You can add a short bio and upload a profile photo. Your browser reports your time zone so deadline reminders arrive at the right moment. We store your notification settings.
  • What you and your team put into Pipeq. Teams, columns, cards and their descriptions, deadlines, checklists, tags, comments, emoji reactions and attached files, and who owns, is assigned to or wrote each of them.
  • People you invite. When you invite someone by email, we pass their address to our email provider to send the invitation. We do not store the address in our database; our email provider keeps a record of the sent email, with the address, for 30 days.
  • Activity log. We record who did what in which team and when: signing in, creating, moving, archiving and deleting cards, writing comments, creating invitations, joining, leaving and removing members, creating teams and changing a profile photo. We use it to keep the service secure, to include it in your data export and to count, in aggregate, how the service is used.
  • Sign-in codes. When you ask for a code by email, we store your email address, a hash of the code (never the code itself) and when it was used.
  • Your devices. Each time you open the app, it tells us what kind of device it runs on (iPhone or iPad, Android, or a computer), whether Pipeq is installed on it, and whether you allowed notifications there. We keep only the latest of these per kind of device, and nothing finer, such as the model or browser. If you turn on push notifications, we also store the address your browser gives us for delivering them, with its encryption keys.
  • Feedback you send. When you use Send feedback, your message reaches us by email with your name, email address, team name and the kind of device you are on, so we can answer you. It is not stored in Pipeq’s database.
  • Logs. We keep no web access logs. Our application logs each request (method, the address within the app, the result and the time) without your IP address. The web server’s error log can include your IP address. Your IP address is also used, in memory only, to limit repeated sign-in and invitation attempts.
  • On your device. The app keeps a copy of your team’s recent data and any changes waiting for a connection in your browser’s storage, plus a few display settings. Signing out or deleting your account removes them from that browser.

We do not use third-party analytics, advertising or tracking tools, we do not sell or rent your data, and we do not use it for advertising or to train AI models.

Why we use it

  • To run your account and teams, sign you in, sync your work and send the invitations you ask for: because you asked us to provide the service.
  • To notify you about work that involves you: by email when you are added to a card or made its owner, mentioned, or a deadline is near or missed; by push also about comments, replies, moved cards and people joining your team. You can turn each kind off under More, Notifications, or with the unsubscribe link in any email. Push is only sent if you turn it on.
  • To send an invitation to someone a team member chose to invite: in the interest of the inviting team in letting it grow.
  • To keep the service secure, investigate abuse and limit repeated attempts: in our interest in a secure service.
  • To learn how Pipeq is used and improve it: how many teams and people were active each week, which features they use, on which kinds of devices and whether the app is installed. Only counts leave the database, never names, email addresses or IDs.
  • To answer your feedback.
  • To comply with the law and answer lawful requests.

You need an email address to have an account; without it we cannot provide the service. We make no decisions about you by automated means.

Who sees your data

  • Your teammates. Everyone in a team sees the name, email address and photo of the other members, and everything posted in that team.
  • Our service providers, who handle data only to run Pipeq for us:
    • our hosting providers, who run the server Pipeq works on, in Singapore. It holds our database, files and backups;
    • Cloudflare, Inc. (USA), which stores encrypted copies of our backups in its Asia-Pacific region. The copies are encrypted before they leave our server, and Cloudflare cannot read them;
    • Resend, Inc. (USA), which sends sign-in codes, invitations, notifications and the feedback you send us, and keeps a record of each email, with the recipient’s address, for 30 days.
  • Google, when you choose Sign in with Google. Google acts under its own privacy policy. If you signed in with Google, your profile picture is loaded from Google’s servers, so Google receives the IP address of whoever views it in Pipeq.
  • Push services run by your browser’s maker (Google for Chrome and Android, Apple for Safari and iOS, Mozilla for Firefox, Microsoft for Edge) deliver push notifications if you turn them on. The content is encrypted end to end; they see only that a message is being delivered to your device.
  • Authorities, only when the law requires us to disclose data.

Where your data is

Our server and the backups on it are in Singapore. Encrypted backup copies are stored by Cloudflare in the Asia-Pacific region. Our email provider processes email data mainly in the United States. We send data to these places only as needed to run Pipeq, and only to the providers named above.

How long we keep it

  • Account data: until you delete your account.
  • Team content: as long as the team exists. A card you delete stays in Recently deleted for 30 days, where it can be restored, and is then deleted for good. When you delete your account, teams where you are the only member are deleted with all their cards, comments and files. In teams you share, what you posted stays for the team, without your name. If you were a team’s last owner, its longest-standing member becomes owner.
  • Files and photos: until they are deleted, their card, comment or team is deleted, or you delete your account (your profile photo).
  • Activity log: as long as the team it belongs to exists. When you delete your account, your name is removed from it.
  • Sign-in codes: a code expires after 15 minutes. The record of a code (your email and when it was used) is deleted after 91 days, and at once when you delete your account.
  • Sessions: a sign-in lasts up to 30 days without use and ends when you sign out.
  • Device information and push addresses: until you delete your account. A push address also goes when you turn push off, sign out on that device, or the push service tells us the device is gone.
  • Feedback: in our mailbox until we delete it; our email provider keeps its record of the email for 30 days.
  • Queued notification emails: deleted once sent, within minutes.
  • Logs: our application’s logs are kept for at most 7 days.
  • Backups: we back up the database and files every night and before every update. Copies on our server are kept for 14 days, encrypted copies at Cloudflare for 30 days. Anything deleted, by you or by us, stays in these backups until they are replaced, at the latest 30 days after it was deleted. We restore a backup only to recover from a failure.

Your rights

Wherever you are, you can ask us to give you access to your data, correct it, delete it, restrict its use or give you a copy you can take elsewhere, and you can object to how we use it to learn how Pipeq is used. You can also complain to a data protection authority: in Georgia, the Personal Data Protection Service, or the authority where you live.

In the app:

  • Export: More, Export my data gives you a JSON file with your profile, your teams and roles, the sign-in methods linked to your account, the cards you own or are on, your comments, the checklist items assigned to you and your activity log. For a full copy that also includes your files, reactions and settings, email us.
  • Delete: More, Delete account deletes your account at once, as described under How long we keep it.
  • Correct: edit your name, bio and photo in your profile.
  • Notifications: turn email and push notifications on or off under More, Notifications.

For anything else, email privacy@pipeq.app. We may ask you to confirm the request from the email address of your account.

If you are in the United States

We do not sell or share your personal information, as those terms are defined in the California Consumer Privacy Act, and we do not use it for targeted advertising. Pipeq does not track you across other websites and lets no third party do so, so it treats all visitors the same whether or not their browser sends a Do Not Track signal.

Cookies and local storage

We use only cookies that are strictly necessary to sign you in and keep you signed in, so we do not ask for cookie consent:

  • pq_at: proves you are signed in, 15 minutes;
  • pq_rt: renews your sign-in, 30 days;
  • pq_session: tells pipeq.app to open the app instead of the landing page, 30 days;
  • pq_pending: holds a new sign-in while you create or join a team, 15 minutes;
  • pq_invite: holds the invitation you opened while you sign in, 30 minutes;
  • pq_oauth_state, pq_oauth_verifier: protect Sign in with Google, 10 minutes.

The app also uses your browser’s storage as described under On your device. None of it tracks you.

Security

Data travels encrypted (HTTPS). Each team’s data is kept apart at the database level. Sessions and sign-in codes are stored only as hashes. Backup copies that leave our server are encrypted first. Access to the server and its backups is limited to the people who run Pipeq’s infrastructure. If a breach puts your data at risk, we will notify the authority and, where required, you.

Children

Pipeq is not meant for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

Changes

We may update this policy. We will announce material changes in the app or by email before they take effect. The date at the top shows the latest version.