Pip Tech Privacy Policy
PIP TECH LLC
PRIVACY POLICY
for the Mary & Pip App
Effective date: September 29, 2026 | Version: 2026-09-29
Revision 5 — incorporates outside counsel’s redline of 29 September 2026. Every factual claim has been verified against the Mary & Pip codebases and the production AWS account.
This Privacy Policy explains how Pip Tech LLC and its affiliates (“Pip Tech,” “we,” “our,” or “us”) collects, uses, discloses, and protects information when you use our website at www.maryandpip.com (the “Website”), mobile application known as the Mary & Pip App (the “App”), and related services (collectively, the “Services”). It applies to everyone who uses the Services, including prospective users who have not yet opened an account with Mary & Pip Investments, LLC. By accessing or using the Services, you agree to the practices described in this Policy.
The short version
We know privacy policies are long, so here is the plain-English version. Pip Tech does not sell your personal information, and we do not run targeted advertising. There are no ad networks, tracking pixels, or advertising partners in our App or on our Website, and we never share your financial data for marketing purposes.
We use Plaid to connect your bank accounts, to verify your identity, and to collect your subscription fee. Alpaca Securities LLC holds any brokerage account you open. Every account opened through the App is opened as a client of Mary & Pip Investments, LLC, our registered investment adviser partner. Pip Tech itself does not give investment advice or hold your account.
The App has no AI features. We do not use artificial intelligence to analyze your financial data, and your information is never used to train any AI model.
We run our own analytics rather than sending your activity to an outside analytics company. We share information only with the service providers it takes to run the Services, our partners above, and anyone the law requires.
Table of Contents
1. Scope
2. Who We Are and How This Policy Fits Together
3. Personal Data We Collect
4. How We Use Your Information
5. How We Disclose Your Information
6. Service Providers and Third-Party Services
7. Cookies, Tracking, and Analytics
8. Data Security
9. Data Retention
10. Children’s Privacy
11. Managing and Deleting Your Data
12. U.S. State Privacy Rights
13. Exercising Your Rights
14. Where Your Data Lives
15. Changes to This Policy
16. Contact Us
1. Scope
This Policy covers the personal information Pip Tech collects through the Services upon which it is posted. It does not cover the practices of companies we don’t own or control, including Plaid, Alpaca, and Mary & Pip Investments, LLC, each of which maintains its own privacy policy or privacy notice. Section 6 tells you where to find those.
2. Who We Are and How This Policy Fits Together
Pip Tech LLC is a technology company. We build and operate the App, which lets you link financial accounts, track your finances, and open an investment account. Pip Tech does not provide investment advice and does not open, hold, or manage accounts itself. All investment advice and account opening are provided exclusively through Mary & Pip Investments, LLC. Every person who opens an account through the App becomes an advisory client of Mary & Pip Investments, LLC; the App does not offer a way to open an account without doing so.
Mary & Pip Investments, LLC (“Mary & Pip Investments”) is a registered investment adviser and a separate legal entity from Pip Tech. Pip Tech’s role is limited to providing the technology that connects you to Mary & Pip Investments’ advisory services.
Brokerage accounts opened as part of that advisory relationship are held at Alpaca Securities LLC (“Alpaca”), a registered broker-dealer and member FINRA/SIPC.
Bank account connections, identity verification, and subscription payments are all facilitated through Plaid Inc. (“Plaid”). At no point does Pip Tech receive or store your online banking credentials. Those are entered directly with Plaid.
Shared infrastructure. Pip Tech and Mary & Pip Investments use a single shared Plaid account. Pip Tech uses it to connect your bank accounts and process subscription payments; Mary & Pip Investments relies on it to verify your identity for regulatory purposes. This means personnel of both companies may have access to information held in that shared account, including information about people who use the App but never open an investment account. The two companies are separate legal entities and their handling of your information is governed by a written agreement between them.
The App is currently distributed through the Apple App Store (iOS).
When you open an account, Mary & Pip Investments, LLC will separately provide you its own privacy notice, required under Regulation S-P and the Gramm-Leach-Bliley Act (GLBA), which governs how nonpublic personal financial information is shared in connection with your advisory relationship. This Policy is different: it covers Pip Tech’s collection and use of information across the Services as a whole, including for prospective users who are exploring the App and/or Website before opening an account.
3. Personal Data We Collect
The table below summarizes the categories of personal data we collect, where it comes from, and who we share it with. The sections that follow go into more detail.
Category
Examples
Collected from
Shared with
Identity & contact
Name, email, phone, mailing address, date of birth, Social Security number, government ID information
You
Alpaca, Mary & Pip Investments, Plaid
Identity verification
Images of your government ID, a scan of your face geometry, verification outcome, watchlist screening result
You, via Plaid
Plaid (collects and holds); Mary & Pip Investments and Alpaca receive the outcome
Financial account
Bank and card balances, transactions, loan balances and interest rates, institution details
Plaid
Not shared outside our service providers
Brokerage & investment
Positions, trade confirmations, performance, investment experience, risk tolerance, income, employment, net worth
You, Alpaca
Alpaca, Mary & Pip Investments, Google Workspace
Payment
Designated payment account (masked), billing history, ACH authorization records
You, via Plaid
Plaid
Information about others
Beneficiary name, date of birth and Social Security number; transferring account details; regulatory affiliations
You
Alpaca, Mary & Pip Investments
Device & usage
IP address, device identifiers, operating system, app version, crash reports, feature usage
Automatically
Sentry, Expo, AWS
Content you create
Journal entries, goals, budgets, category names, profile photo
You
Not shared outside our service providers
Communications
Support requests, survey responses, messages
You
Postmark, Google Workspace
3.1 Information You Provide to Us
• Account and identity information: name, email address, phone number, mailing address, date of birth, and, where required to open your account or verify your identity, Social Security number or other government ID information.
• Financial profile information you enter directly: income, employment information and employer details, investment experience, risk tolerance, net worth, marital and tax filing status, and financial goals.
• Communications you send us: support requests, survey responses, and other messages, including forms submitted through our website.
• Payment information. Pip Tech does not collect or store payment card numbers, bank login credentials, or your full bank account and routing numbers. Your subscription fee is debited by ACH from the bank account you designate, through Plaid. Money moving into and out of your investment account is handled by Alpaca. Advisory fees are debited from your Alpaca account.
3.2 Information From Linked Accounts and Your Investment Account
• Bank and credit account information. When you connect an account, Plaid facilitates that connection. Your online banking credentials are entered directly with Plaid and are not stored by Pip Tech. We receive account balances, transaction history, institution details, and — where your institution supports it — loan balances, interest rates and payment due dates. We do not receive or store your full account or routing numbers.
• Brokerage account information. When you open your account, Alpaca collects identity verification and suitability information as required by KYC, AML, and securities regulations. Pip Tech receives account balances, positions, trade confirmations, and performance data needed to show that information in the App.
• Advisory account information. Because opening an account through the App means becoming a client of Mary & Pip Investments, LLC, information about that relationship is handled as described in that firm’s separate GLBA privacy notice, in addition to this Policy.
3.3 Information Collected Automatically
• Device and log information: IP address, device identifiers, operating system, app version, and crash or error reports.
• Usage information: features used, screens viewed, time spent in the App or Website, and session length. This is collected by our own systems and stored in our own database — we do not use a third-party analytics company.
• Error and crash reporting through Sentry, which receives your IP address, a user identifier, and application log data in order to diagnose problems.
• Approximate location. The Services do not request or collect GPS or precise geolocation information. Our service providers may derive an approximate location from your IP address.
• We do not currently use session replay or screen-recording tools to record how you interact with the Services.
3.4 Information From Other Sources
• Plaid, which performs identity verification and watchlist screening on our behalf.
• Alpaca and Mary & Pip Investments, as described above.
3.5 Identity Verification and Biometric Information
Before you can open an investment account, federal law requires that your identity be verified. We use Plaid’s identity verification service to do this.
During verification, Plaid collects images of your government-issued ID and a scan of your face geometry — a biometric identifier — in order to confirm that you are the person shown on the ID. We ask for your agreement before this happens, on a screen that explains what is collected and why. Plaid’s identity verification process is subject to Plaid’s applicable privacy policies, including its Biometric Policy and Release at https://plaid.com/legal/#biometric-policy-and-release, which you are responsible for reviewing.
Pip Tech never receives or stores your face scan or your ID images. Pip Tech only keeps the record of the verification itself: your name, date of birth, the outcome, and the result of the watchlist screening.
We use this information only to verify your identity and to meet anti-money-laundering and Know Your Customer obligations. We do not use it for any other purpose, we do not use it to identify you elsewhere, and we do not sell, lease, trade, or otherwise profit from it.
3.6 Information About Other People
Some parts of the Services ask you for information about people other than yourself:
• Beneficiaries. If you name a beneficiary on your account, we collect their full name, date of birth, Social Security number and relationship to you. Social Security numbers are stored encrypted and are never shown in full in the App.
• Transferring an account from another firm. We collect the account number, name on the account, and taxpayer identification number at your prior brokerage.
• Regulatory disclosures. If you or a family member work for a broker-dealer or exchange, or if you are related to a senior foreign political figure, securities and anti-money-laundering rules require us to collect details about that person and your relationship to them.
When you give us information about someone else, you represent and warrant that you are permitted to share it with us and that the data subject has provided consent, where applicable, and that our use of the information does not violate any applicable laws. We use such information only for the purpose you gave it to us for. If someone whose information you have given us wants to know what we hold or asks us to delete it, they can contact us at the address in Section 16, and we will respond subject to the records we are legally required to keep.
3.7 Content You Create
The App includes features where you write or upload your own content: journal entries in the weekly money ritual, savings goals and the images attached to them, budgets, custom spending categories, renamed transactions, and a profile photo. This content is stored in your account and is used to provide those features to you.
Your journal entries are private. They are never published, never shown to other users, and never shared outside Pip Tech. As with all account information, a small number of authorized staff can access them where necessary for support or compliance, as described in Section 5.
4. How We Use Your Information
• Provide, maintain, and improve the Services, including linking accounts, displaying balances and transactions, and supporting your investment account.
• Verify your identity and comply with legal and regulatory obligations, including KYC and AML requirements applicable to Alpaca and Mary & Pip Investments.
• Collect the subscription and advisory fees you have authorized.
• Communicate with you, including account notices, customer support, service updates, and the reminders and notifications you have turned on.
• Send marketing communications about Pip Tech products and features, where permitted; you can opt out as described in Section 13.
• Detect, investigate, and prevent fraud, unauthorized access, and other security incidents.
• Analyze how the Services are used so we can fix problems and build better features.
• Meet our recordkeeping, tax, and other legal obligations.
4.1 Automated Checks
As part of opening your account, your identity is verified and your name is screened against government sanctions and politically-exposed-person watchlists. These checks are automated and can result in your application being declined or held for review. A person at Pip Tech or Mary & Pip Investments reviews any result that would prevent your account from opening, and we keep a record of that review. If your application is declined and you believe the result is wrong, contact us at the address in Section 16 and we will look at it again.
4.2 Personalizing What You See
We group users into broad categories — for example, someone who has connected accounts but not yet invested — based on information in your profile, the accounts you have connected, and how you use the App. We use these groupings to decide which educational content to show you in the Learn tab.
This is done by simple rules, not by artificial intelligence, and it does not affect whether you can open an account, what your account costs, or any advice you receive. If you would prefer we didn’t do this, contact us at the address in Section 16.
5. How We Disclose Your Information
We do not sell your personal information, and we do not share it for advertising. We disclose information in the following circumstances:
• Service providers who perform work on our behalf — cloud hosting, error monitoring, email delivery, document storage, customer support, and compliance operations — under contracts that limit their use of your information to the services they provide us. Section 6 lists them.
• Plaid and Alpaca, to provide the account-linking, identity verification, payment, and investment account functionality you have requested.
• Mary & Pip Investments, LLC, because opening an account through the App means becoming its advisory client and it needs this information to deliver those services to you. That relationship is separately governed by its own GLBA privacy notice. As described in Section 2, the two companies also share a single Plaid account.
• Our own authorized personnel. A small number of Pip Tech and Mary & Pip Investments staff can access account information to provide support, investigate fraud, and meet compliance obligations. Administrative access to our systems is logged in a tamper-evident audit trail that we retain indefinitely.
• Regulators, law enforcement, or other parties when required by law, subpoena, or legal process, or to protect the rights, property, or safety of Pip Tech, our users, or others.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets or similar transactions.
• Any other party, with your consent.
We may also share aggregated or de-identified information that cannot reasonably be used to identify you, without restriction.
6. Service Providers and Third-Party Services
Mary & Pip Investments, LLC is the registered investment adviser for every account opened through the App, and Alpaca is the broker-dealer that holds those accounts. Plaid connects your bank accounts, verifies your identity, and processes your subscription payment. Each maintains its own privacy policy or notice:
• Plaid End User Privacy Policy — plaid.com/legal
• Alpaca Securities LLC disclosures and privacy notice — alpaca.markets/disclosures
• Mary & Pip Investments, LLC Regulation S-P privacy notice — provided to you inside the combined disclosure brochure you review and acknowledge when you open your account. Contact us at support@maryandpip.com for another copy at any time.
6.1 Our Service Providers
We use the following companies to operate the Services. Each receives only the information it needs to perform its function:
Provider
What it does
What it receives
Amazon Web Services
Hosting and storage
All App data, stored in the United States
Clerk
Account sign-in
Name, email, phone number
Sentry
Error and crash reporting
IP address, user identifier, application logs
Expo
App updates and push notification delivery
Device and notification token
Postmark
Email delivery
Email address and message content
Google Workspace
Document storage and recordkeeping
Statements, trade confirmations, tax documents, verification and compliance records
Slack
Internal operational and compliance alerts
Limited account information
Sanity
Educational content delivery
No account information
Typeform
Website contact and waitlist forms
Information you enter on those forms
Apple
App distribution and beta feedback
Feedback you submit through TestFlight
This Policy does not cover, and Pip Tech is not responsible for, the privacy practices of these companies beyond the information we provide to them as described above.
7. Cookies, Tracking, and Analytics
We do not use advertising or retargeting cookies, tracking pixels, or advertising networks — in the App or on our Website. We do not work with ad platforms, and we do not allow anyone to track you across other sites or apps.
We and our service providers use cookies and similar technologies for two purposes only:
• Essential: required for core features like signing in and keeping your session secure. These cannot be turned off without affecting how the App works.
• Functional: remembering your preferences and settings.
Analytics. We measure how the Services are used — which features are opened, how long sessions last, where people get stuck — using our own systems. This data is stored in our own database and is linked to your account rather than being anonymous. We do not send it to Google Analytics, Firebase, Segment, Mixpanel, Amplitude, or any similar service.
Because we do not sell or share personal information and do not run targeted advertising, there is nothing to opt out of. Our systems do not respond to browser “Do Not Track” signals.
8. Data Security
We use reasonable administrative, technical, and physical safeguards designed to protect your information, including:
• Encryption of data in transit and at rest. Databases and document storage are encrypted, connections to the App and to our database require TLS, and sensitive fields such as Social Security numbers are separately encrypted.
• Multi-factor authentication for employee and administrative access to systems containing your information, which we enforce centrally through our identity provider wherever a system supports it.
• Audit logging. Administrative activity across our infrastructure is recorded in a tamper-evident, multi-region audit trail.
• Access controls limiting account data to the small number of people whose role requires it, with periodic review of who has access.
• Security practices aligned with SOC 2 Type I control objectives.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Thus, all use of the Services and transmission of information is at your own risk. Protecting your account also depends on you: use a strong, unique password, enable biometric unlock if your device offers it, and keep your device secure.
If we experience a security incident affecting your personal information, we will notify you and any applicable regulators as required by law, including the New York SHIELD Act and — for information connected to your advisory relationship — Regulation S-P, which requires notice to affected customers within 30 days.
9. Data Retention
We keep different types of information for different lengths of time, depending on why we collected it and what the law requires.
Type of information
How long we keep it
Financial records
At least seven years after your investment account closes, and longer where we or our partners preserve them. This covers account applications, statements, trade confirmations, tax documents, identity verification records, and compliance disclosures, which we and our partners are required to retain.
Payment records
Seven years after your last payment, or after you cancel your subscription, whichever is later. This includes the authorization you gave us to debit your bank account.
Consent records
Seven years after you delete your Mary & Pip account. This is the record of your acceptance of our terms and this Policy, and your agreement to identity verification.
Biometric data
We never store it. Plaid holds it and its published policy is to destroy it within three years.
Everything else
Deleted when you delete your account — your transactions, budgets, goals, journal entries, app activity, and preferences.
Deletion records
Kept indefinitely, so we can show that we honored your request.
Three clocks run separately. Financial records are measured from when your investment account closes. Payment records are measured from your last payment, or from when you cancel your subscription, whichever is later — the authorization to debit your bank account belongs to your subscription rather than to your investment account, so if you close your investment account and keep subscribing, we keep it for as long as we are still debiting you. Consent records are measured from when you delete your Mary & Pip account, because they evidence your agreement to the terms governing the App itself. That means your records may still be retained after you delete your account, because we are required to keep them.
When we actually delete. We run the deletion process twice a year rather than continuously. A record whose retention period ends shortly after a run waits until the next one, so the longest anything above is kept is seven and a half years.
Backups. Deleted information may remain in encrypted backup copies, and in previous versions of our file storage, for up to 30 days before those copies are overwritten and permanently removed.
We may retain de-identified or aggregated information indefinitely, since it no longer identifies you.
10. Children’s Privacy
The Services are not directed to, and is not intended for use by, anyone under the age of 18, consistent with Pip Tech’s account eligibility requirements. We ask your age during sign-up and do not permit anyone under 18 to continue. We do not knowingly collect personal information from children. As mentioned above, we do not sell, lease, trade, or share users’ personal information for purposes of targeted advertising, including any information of children age 16 or under. If we learn that we have collected personal information from a child in violation of this Policy, we will delete it. If you believe a child has provided us information, contact us using Section 16.
11. Managing and Deleting Your Data
11.1 Deleting Your Account
You can delete your Mary & Pip account from within the App: go to Settings, then Manage subscription, then Delete my account. Deleting your account is permanent, and it is separate from cancelling your subscription. Before anything is deleted we check whether something is in the way — an investment account still open or closing, money still moving in or out of it, an account transfer in progress, an advisory fee not yet settled, or a subscription payment still processing — and if there is, we tell you what it is and how to resolve it. When nothing is in the way, you confirm by typing DELETE. Deletion happens immediately and cannot be undone.
If you hold an investment account, it must be closed before your Mary & Pip account can be fully deleted — your money has to be returned to you first, and Alpaca has to close the account. You can start that from the same place, and we will complete the deletion once the closure finishes.
Deleting your account removes your linked accounts, transactions, budgets, goals, journal entries and app activity, and disconnects our access to your bank accounts at Plaid. It does not erase records we are required to keep, which are described in Section 9.
11.2 Requesting Deletion Another Way
You may also ask us to delete or de-identify your personal information by contacting us at support@maryandpip.com. We will honor your request except where the law allows or requires us to keep certain information.
11.3 If We Can’t Fully Honor Your Request
If part of your request can’t be completed, we will tell you which part and explain why.
12. U.S. State Privacy Rights
If you live in a state with a comprehensive consumer privacy law, you may have some or all of the rights below, subject to that state’s specific requirements and exceptions. As of the effective date of this Policy, states with such laws include California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island.
• Right to know what personal information we have collected about you and how we have used and disclosed it.
• Right to request a copy of your personal information in a portable format.
• Right to request correction of inaccurate personal information.
• Right to request deletion of your personal information.
• Right to opt out of the sale or sharing of personal information, or of targeted advertising.
• Right to non-discrimination for exercising any of these rights.
12.1 Sensitive Personal Information
Some information we collect is considered sensitive personal information under state law: your Social Security number, your financial account information, and the biometric identifier collected during identity verification. We use it only to open and service your account, verify your identity, and meet our legal obligations — never for advertising, profiling, or any other purpose.
12.2 We Do Not Sell or Share Your Information
Pip Tech does not sell personal information, does not share it for cross-context behavioral advertising, and does not engage in targeted advertising, as those terms are defined under state privacy laws. We do not work with advertising partners, and we do not place advertising or tracking technologies in the App or on our Website.
13. Exercising Your Rights
To submit a request, contact us at support@maryandpip.com. We will need enough information to verify it’s really you before we act on the request, and we will respond within the time your state’s law allows.
You may designate an authorized agent to submit a request on your behalf, consistent with applicable state law.
To opt out of marketing emails, use the unsubscribe link in any marketing message or contact us at the address above.
If we deny your request, you may appeal by replying to our response or writing to support@maryandpip.com with “Appeal” in the subject line. Your appeal will be reviewed by someone other than the person who made the original decision, and we will respond within the time your state’s law requires. Some states also let you file a complaint with your state Attorney General if you’re not satisfied with our response.
14. Where Your Data Lives
The App is currently offered only to residents of the United States, and your information is stored in the United States. Our hosting, databases, and document storage for the Services are all located in U.S. data centers. If that changes, we will update this Policy to describe how we handle any cross-border data transfers.
15. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will notify you through the App or by email before the changes take effect. The effective date at the top of this Policy shows when it was last updated, and we keep previous versions available on request so you can see what has changed.
16. Contact Us
If you have questions about this Policy or want to exercise any of the rights described above, contact us at:
Pip Tech LLC
447 Broadway #223, New York, NY 10006
support@maryandpip.com