Privacy as Architecture

Most apps want more of you. More taps, more notifications, one more thing to check before you've even had coffee. Pip was built the other way around — to want less of you. To take things off your plate instead of piling more on.

That's the whole job: a calm assistant that keeps track of the loose threads so you don't have to, remembers what matters, and helps you stay on top of your own life instead of buried under it. Not one more thing demanding your attention — the thing that hands some of it back.

But to help like that, it has to be let in. It has to hold the real material of a life — your files, your half-finished thoughts, the question you'd only ask somewhere private. And you can only lean on something that holds all that if a quiet part of you isn't calculating who else might be listening, or what it might cost you later.

That's where most tools quietly fail you: the ones we think with now also think about us, turning our questions into someone else's data. You get used to it. But used to it was never the same as fine.

Here's the catch — you can't feel privacy from a promise. Every product swears it respects you on a policy page nobody reads. But a promise is a decision a company makes about your data after it already holds it. That isn't privacy. That's hope.

Real privacy is architecture.

It's decided before you arrive, in the places you can't toggle: where your data rests, who can read it, and what the people who built the thing are structurally able to do with it.

And that's the thing we can't be talked out of. A privacy setting can be added in an afternoon; the things that actually protect you can't. They're not really features at all — they're the building, and a building is hard to copy.

Your world — your files, your memory, everything you've told Pip — rests in Europe, under European law. Stockholm is home. It's encrypted. We never sell it, and we never train on it without your say-so. And underneath that, how we're paid: no venture capital, no advertiser in the room, no shareholders waiting for the quarter we turn your attention into revenue. Pip is paid for by the people who use it. A company drifts toward whatever feeds it; we made sure the only thing that feeds us is doing right by you.

We'll also tell you what isn't finished, because trust you can't inspect isn't worth much. Your data already lives in Europe — but Pip works with every major AI model, and today the thinking those models do still happens on the model-makers' own machines, much of it beyond Europe's edge. We're closing that gap from two directions: moving the processing itself into Europe, and — for devices powerful enough to run them — building local versions of Pip, with the models living and thinking right there on your own device, where nothing has to leave at all. We'd rather show you the scaffolding than photograph a cathedral we haven't built.

And where it's still unfinished, we'd rather hear from you than guess. Tell us when Pip gets it right — and, more useful to us, when it doesn't: when it misses the point, or adds to your plate instead of clearing it. That doesn't vanish into a ticket queue; it reaches the people actually building Pip, and the next version gets shaped around it. We won't always get it right. We'd just rather get it wrong with you in the room.

None of this asks you to take our word for it. You can look at the structure and decide for yourself. That's the difference between privacy you hope for and privacy you can stand on.

We started Pip with one quiet idea: start with the person, and the rest follows. Build for the people the loud part of tech overlooks, and give them back a little room to breathe. We call that architecture. You might just call it peace of mind.