Last updated 21 August 2026
Pip is a tiny voice-message service for families, run by a family. The honest summary: your voice messages pass through our server on their way to your people, and then we delete them. We keep almost nothing, because we want almost nothing.
A message lives on our server only while it is in transit:
A kid's Pip box keeps its own copy of the messages it has received, on the box itself, in your home - that inbox is yours, not ours. Messages older than 30 days fade off the box too.
The little that makes Pip work:
Sign-in codes and device keys are stored hashed, so even we can't read them back.
We keep short-lived backups so a server accident can't eat the family's messages in transit. Backups are kept for up to two weeks, which means a deleted message can linger inside a backup for up to two weeks after it disappears from the server. Then it is really, truly gone.
Our server lives in a Hetzner data centre in Germany, in the EU. Everything travels to and from it encrypted.
Sends our emails: your sign-in code, and the occasional "you have an unheard message" nudge.
Your phone's own notification service delivers the "new Pip!" poke. It never carries the audio.
When a Pip box starts up it asks this service for its timezone, so the clock on the box is right. The service sees the box's IP address and nothing else.
Pip is built for kids, so the box is deliberately boring: no camera, no browser, no store, no feed. It only knows the family members a grown-up has chosen, and it only does one thing: Pip.
Want a message gone? Delete it in the app. Want everything gone? Email us at pip@pipvoice.com and we will delete your account and everything attached to it. Questions about any of this land in the same inbox.
If we ever change how any of this works, we will update this page and the date at the top.