Your things stay yours.

Who makes Piilo

Piilo is made by Simon Weaver, an independent developer. In this policy, “I” and “me” mean Simon, “Piilo” means the Piilo app for iPhone and iPad, and “this website” means piiloapp.com.

For any question about your information, email [email protected].

What stays on your device

Everything you put into Piilo is stored in the app’s own storage on your iPhone or iPad: your Places, Rooms, Boxes and Objects, where each one is, their photos and videos, notes, documents, tags, Lists, reminders and history. I don’t run a server for Piilo, and the app never sends me your library, your photos or anything about how you use it.

Piilo does its own work on your device, too — reading the text in a photo, lifting a Cutout, suggesting a name, and understanding what you say or type to Tell Piilo. Where Piilo uses Apple Intelligence, it uses the model on your device. When you add things by voice, Piilo asks iOS to recognise your speech on the device, so your voice isn’t sent anywhere for it.

Reminders are scheduled on your device. Siri, Shortcuts, Spotlight and Piilo’s widgets are parts of iOS: Apple handles your requests to Siri under Apple’s Privacy Policy, and Piilo answers them on your device.

Like other apps’ data, your Piilo library is included when you back up your iPhone or iPad with iCloud Backup or a computer. Those backups are Apple’s, or your computer’s, not mine.

Locks

You can lock a Place, Room, Box or Object so it asks for Face ID, Touch ID or your passcode before it opens, and App Lock can ask whenever Piilo opens. Anything you lock is kept out of Siri’s answers, Spotlight, the widgets and Piilo’s suggestions.

A lock hides; it doesn’t encrypt. A complete Piilo backup includes the things you’ve locked, so keep backup files somewhere you trust.

iCloud sync and Household Sharing

Both are optional and off until you turn on Sync & Household Sharing in Piilo’s Settings. Turning it on saves a complete backup on your device first.

• Your own devices. Your library is kept in iCloud, in your own Apple Account, using Apple’s CloudKit, so your iPhone and iPad stay in step. I can’t read it. Apple stores it under Apple’s Privacy Policy.
• Your household. If you invite people, they see your shared library from their own Apple Accounts — and edit it, if you allow that. You choose read-only or editing for each person, and you can stop sharing at any time. Sharing happens through iCloud, between Apple Accounts; it never passes through me.

Turning sync off, or leaving a household, never deletes what is on your device. The copy in iCloud belongs to your Apple Account, where your iCloud storage settings manage it.

Features that use another service

A few features need something from outside your device. Each one connects only when you use it, and sends only what that feature needs. The services below receive what any website receives from a visitor — such as your network address and the kind of device you’re using — and their own policies cover what they do with it.

Open Food Facts

When you scan a food barcode, or add from a receipt that prints one, Piilo sends that barcode number — and nothing else from your library — to Open Food Facts, the free, open food database, to find the product’s name. If you turn on Product Photos from Barcodes, Piilo also downloads the product’s photo. Each request identifies the app and how to reach me, not you. See Open Food Facts’ privacy policy.

YouTube

Piilo uses YouTube API Services. You can attach a YouTube video you found elsewhere to an Object by its link — the video showing how to put up the tent you keep in the garage — and watch it inside Piilo later. Piilo doesn’t search or browse YouTube.

• When you add a YouTube link, Piilo asks YouTube for that video’s title, channel and picture.
• When you press Play, YouTube’s own embedded player plays the video inside Piilo. While it is open, YouTube receives what its player collects; that is YouTube’s processing, under Google’s Privacy Policy, and none of it comes to me.
• YouTube receives the video’s address. Nothing else from your library is sent.
• Nothing goes to YouTube from your device until you’ve agreed to YouTube’s terms in Piilo — when you enter a YouTube link in Add Video, or when you first press Play.

Piilo keeps the link, and the title, channel and picture YouTube gave for it, on your device, in your backups, and in your iCloud sync if you use it. When you open the page it’s on, Piilo asks YouTube again once that information is a week old; it deletes the title, channel and picture after 30 days without an update, and keeps the link. Removing the video removes all of it. The player keeps nothing on your device once it closes, and Piilo keeps no record of what you watch.

By adding or playing YouTube videos in Piilo, you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy explains how YouTube and Google use information.

Google Photos

In versions of Piilo that offer it, you can choose a photo from your Google Photos when you add a photo of something you keep. Piilo signs you in on Google’s own page. The permission Google shows covers the photos and videos you select in Google’s picker. Piilo downloads only a photo, and only the one you pick. It cannot see the rest of your Google Photos library. That photo is kept with the item on your device, the same way as a photo you took in Piilo, and in your own iCloud only if you turn on Sync & Household Sharing. Nothing from your Piilo library is sent to Google. I never receive those photos, and Piilo does not use them for advertising.

The sign-in is kept in your device’s Keychain — never in your library, your backups or your sync — and Disconnect Google Photos in Settings › Privacy signs you out and asks Google to revoke that permission. Piilo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google account is covered by Google’s Privacy Policy.

Backups and things you share

A backup, a readable copy, an Inventory Book, a Share Card or a photo you export goes only where you save or send it. Piilo’s own backup files appear in the Files app under On My iPhone (or On My iPad) › Piilo.

A complete Piilo backup is one file with your whole library in it, including anything you’ve locked, and Piilo doesn’t encrypt it. The code on a printed label, and the link written to an NFC tag, hold only an identifier that opens the matching Box in your own Piilo — not what’s inside it.

The App Store and TestFlight

Apple runs the App Store and TestFlight under Apple’s Privacy Policy. Apple gives me summary reports about downloads, and crash reports from people who choose to share them with app developers in their device’s settings. None of it includes what you keep in Piilo.

If you test a beta of Piilo through TestFlight, Apple also passes me what TestFlight gives developers — for example the feedback, screenshots and crash reports you choose to send, your device model and iOS version, and when you installed and opened the beta. I use it only to fix and improve Piilo.

This website

piiloapp.com is hosted by Cloudflare. To deliver and protect the site, Cloudflare processes the details every web request carries, such as your network address, your browser and the page you asked for, under Cloudflare’s privacy policy. Cloudflare can show me overall traffic figures, which don’t identify you.

The site sets no cookies of its own, runs no analytics or advertising, and loads nothing from other companies. Links to the App Store, TestFlight and Piilo’s social accounts take you to those sites, whose own policies apply.

Piilo news

If you sign up for Piilo news, your email address goes to Kit, the service that sends the newsletter, and I can see it there. I use it only to send occasional news about Piilo. Every email has a link to unsubscribe, and you can ask me to delete your address altogether. Kit handles it under Kit’s privacy policy.

When you contact me

If you email me, I receive your address, your message and anything you attach, and I use them only to reply and to help with Piilo. Email to piiloapp.com is routed through Cloudflare to my mailbox. I keep support email only as long as it’s useful for helping you, and I’ll delete our correspondence if you ask, unless the law requires me to keep something.

What I don’t do

• I don’t sell or rent your information, or share it for advertising.
• I don’t track you across other companies’ apps or websites.
• I don’t build a profile of you or use your information to make decisions about you.
• There’s no Piilo account, so there’s no account data to lose or leak.

Your choices

• Change or delete anything in Piilo whenever you like. Deleted things wait in Recently Deleted for 30 days, then are deleted for good, and you can delete them permanently sooner. With sync off, Delete Everything in Settings removes the whole library from the device.
• Turn Sync & Household Sharing off, stop sharing with someone, or leave a household at any time.
• Remove a YouTube video from an Object, turn off Product Photos from Barcodes, or disconnect Google Photos.
• Allow or refuse the camera, microphone, speech recognition, Face ID and notifications in your device’s Settings. Piilo keeps working without them; only the feature that needs one stops.
• Deleting Piilo from a device deletes its library there, including the backup files in Piilo’s own folder. Backups you saved elsewhere, your iCloud data and your device backups are separate.

For anything I hold — your emails to me, or your newsletter address — you can ask me what I have, correct it, or have it deleted by emailing [email protected]. Depending on where you live, you may have other rights over your personal information; ask, and I’ll help. If you’re unhappy with how I’ve handled it, please tell me first — you may also be able to complain to your local data-protection authority.

Children

Families use Piilo together, and it has a theme made for kids. Because the app sends me nothing, I don’t collect children’s information through it. If a child has emailed me or signed up for the newsletter, a parent or guardian can ask me to delete it.

Keeping it safe

Your library is protected by your device’s own security — its passcode and the data protection built into iOS — and, if you sync, by iCloud’s. Locks add Face ID to the things you choose. Piilo’s connections to Open Food Facts, YouTube and Google use encrypted HTTPS. The services named here may process information in countries other than yours.

Changes

If Piilo changes what it sends, or to whom, I’ll update this page and change the date at the top. Inside the app, Settings › Privacy always describes the version you have.