Pip

Privacy

Pip OS (the TV app) and Pip Remote (the phone app) · Updated 26 October 2026

The short version

There is no account and no tracking. The TV app never shows ads. The free phone app shows ads on one screen (Customize), only after Google's consent form where the law requires it, and never with Pip Pro. Your settings stay on your TV and your phone.

What leaves your TV

• Weather. The weather widget sends the city name you set to Open-Meteo to get the forecast. Like any web request, it carries your IP address. Nothing else is sent.
• Pictures and the film. Landscape photos and the welcome film download from this website (GitHub Pages). Update checks ask GitHub for the newest release. These are ordinary web requests and carry your IP address.
• Links you choose to open. When you send a link from your phone, the TV opens it in the matching app (for example YouTube), which then works under that app's own privacy policy.

Pip Pro and payments

• Buying. Payment is handled by Lemon Squeezy, our merchant of record. They see your card and email; Pip never does. Their privacy policy applies to the checkout.
• Your license. When an order is paid, our license service (on Cloudflare) makes a signed license and keeps three things: the order number, the email you bought with (so you can restore the purchase) and, for 30 days, the short code your TV showed, so the TV can pick the license up. Nothing else.
• On your devices, the license and, after a rewarded ad, the end time of your free Pro day are stored locally. Pip checks licenses offline.

Ads in the free phone app

• Pip Remote (free) uses Google AdMob for one banner at the end of Customize and for an optional rewarded ad that unlocks Pro for 24 hours. AdMob may use your device's advertising ID and IP address to serve and measure ads, as described in Google's ad policy.
• Where required (for example in the EU, the UK and under KVKK), Google's consent form appears first, and you can change your choice later under Pip Pro → Privacy choices.
• The remote screen and the TV never show ads. Pip Pro removes them all.

What stays on your home network

• The phone remote talks to the TV directly over your Wi‑Fi. The web remote needs the code shown on the TV. The Android app pairs once with a 4-digit code and keeps a key, which only your TV accepts.
• Network debugging (optional). If you turn it on and allow Pip on the TV, Pip connects to the TV's own debugging service at 127.0.0.1 to pass remote key presses to other apps. It is never reachable from outside the TV through Pip.

What Pip reads on the TV

• The list of installed apps, their icons and sizes, to show them on the home screen and in Clean up.
• The TV's inputs (HDMI and aerial), free storage, free memory and whether you're online, for Inputs and Quick settings.
• Home button helper (optional, off unless you turn it on). An accessibility service that catches the Home button and notices when the TV's own home screen comes to the front, so the Home button brings you back to Pip. Other keys pass straight through, and it cannot read what's on screen. You can turn it on yourself in Settings, or ask Pip to do it through the TV's network debugging; either way it is your choice, and Quick settings turns it off again.

Changes

If a future version adds crash reports or usage statistics, they will be opt-in, described here before release, and contain no personal data. Material changes to this page are noted in the release notes.

Contact

Questions or requests: open an issue on GitHub.