Privacy Policy

Last updated: October 9, 2026

Pilly ("us", "we", or "our") operates the Pilly mobile application (the "App"). We are committed to protecting your personal information and your right to privacy. This policy explains what we collect, how we use it, and the choices you have. Because Pilly handles health-related information, we hold ourselves to a stricter standard than a typical app.

1. Your medication data stays on your device

Your medications, schedules, dose history, notes and settings are stored on your device, and backed up to your own private iCloud so they survive reinstalling the App. We do not run user accounts. Our servers hold your medications only if you turn on Family sharing (section 2), and see them briefly when you use Ask Pilly or package scan (section 3). Deleting the App and clearing its iCloud backup deletes the copy on your devices. To delete what our servers hold, see section 13.

If you use the in-app export or doctor-report features, the data goes only where you choose to send it.

2. Family sharing (optional)

If you subscribe to Pilly Family and invite a caregiver with a code, we store on our servers: your name as you entered it, your medication names and schedule, whether each dose was taken, your time zone and language, this device's notification address, and a phone number if you choose to add one. We use them to show the caregivers you chose a read-only view of your day, alert them when a dose is missed, let them call you, and let them send your phone one reminder for a missed dose. For each caregiver we store their name, language and device notification address, so you can see who was told and they can be alerted.

Your phone makes a random code of its own and sends it when it shares, updates or ends your sharing. We keep only a one-way hash of that code, filed under your phone's Family ID. Once we hold it, we refuse those requests from any phone that does not send the matching code. The hash says nothing about you or your medications. We keep it after sharing ends, so that no other phone can take your sharing over later, and delete it when you ask us to.

Missed-dose alerts, "took it" updates and caregiver reminders are delivered through Expo's push service and Apple's push service. Their text includes the patient's name, the medication name and the dose time.

When you turn off sharing, every caregiver loses access and we delete your stored schedule, dose history, alerts, phone number, notification addresses and invite codes from our servers. This happens once the request reaches our servers. If your phone is offline when you turn sharing off, the App sends the request again until it arrives. When the last caregiver unpairs, we delete the same data at once, except an invite code you have not used yet: it keeps working until it expires, 15 minutes after you made it. When one of several caregivers unpairs, that caregiver loses access and we delete their notification address.

In App versions before 1.3.0, turning off sharing only stops new updates. Caregivers stay linked, can still see what was last shared and can still get missed-dose alerts, until you update the App or a caregiver unpairs. The updated App asks our servers to end those pairings the first time it opens.

If our servers cannot confirm that a request comes from your phone, they refuse it. The App then says so under Family, with a button that opens an email asking us to delete your Family sharing data, and a caregiver can still unpair from their own phone. You can ask for that deletion at any time with Settings → Delete what our servers hold (section 13). We never sell this data or use it for advertising.

3. Ask Pilly and package scan

These two optional features send data through our server to our AI provider, OpenAI, to answer your request. The App asks for your permission before the first one, and you can turn it off in Settings.

• Ask Pilly: your conversation (the last 12 messages), your name, your age, the name of the person you care for (if you set one), and your medications (name, dosage, schedule, instructions, pills left) with today's doses and your 7-day adherence.
• Package scan: the photo you take of a medication package.

Neither request includes Apple Health data. We do not store your chats or your photos. OpenAI may keep API requests for up to 30 days to monitor abuse, then deletes them, and does not use API data to train its models. For package scans, we keep the text read from the package (name, dosage, instructions) with no link to you or your device, so the same package reads faster next time. We do not sell any of it.

4. Apple Health (HealthKit)

If you choose to connect Apple Health, Pilly reads the health measurements you authorize (such as weight, blood pressure, blood glucose and heart rate) to show them alongside your medication insights on your device, and to include them in doctor reports you choose to create and share.

HealthKit data is never sent to our servers, never shared with or sold to third parties, and never used for advertising, marketing, analytics or AI processing. It leaves your device only inside a report you yourself create and send. You can revoke access at any time in the iOS Health app under Sharing.

5. Subscriptions and in-app purchases

Pilly Plus, Pilly Pro and Pilly Family are optional auto-renewing subscriptions sold and billed by Apple. Pilly receives the transaction information Apple provides: product, price, currency, storefront country, purchase, renewal and expiry dates, and transaction numbers. It never includes your payment details. We use it to unlock paid features, to count our revenue (it is also sent to Mixpanel, section 7), and to see which of our Apple Ads lead to subscriptions (section 9). Apple's handling of your purchase is governed by Apple's privacy policy.

6. Notifications

Dose reminders and refill alerts are scheduled on your device. Their content (medication names, dosages) is composed on your device and shows on your lock screen according to your iOS notification settings.

If you use Family sharing, our server also sends notifications: missed-dose alerts and "took it" updates to your caregivers, and a caregiver's reminder to you. These go through Expo's push service and Apple's push service, and include the patient's name, the medication name and the dose time.

7. Usage analytics

From the first time you open the App, it sends usage events to Mixpanel, our analytics provider, which stores them in the EU. The events record app opens, screens you view, onboarding steps, which features you use, and subscription purchases (product, price, whether it was a trial). Each event carries a random identifier the App creates on first launch, plus the App version and platform. Events never contain medication names, dosages, doses taken, your chat messages, your phone number or Apple Health data. From version 1.3.0 the App tells Mixpanel not to work out a location from your IP address; earlier versions let Mixpanel estimate your city and country from it.

We use this to see how the App is used and to count revenue. We do not use it for advertising, and we do not combine it with data from other companies. When Apple tells our server that a subscription renewed, was refunded or expired, our server sends that event (product, price, transaction number) to Mixpanel too.

8. Server logs

When the App contacts our server, we log the request with your IP address, the App version and your device type. We do not store a location worked out from the IP address; logs from before October 9, 2026 may hold one until they are deleted. For Ask Pilly and package scan we also log your device's vendor identifier. We use these logs for reliability, abuse prevention and usage statistics, and delete them automatically after 90 days.

We also count how many free Ask Pilly and package-scan uses each device has used, keyed by that vendor identifier.

Apple may give us aggregated statistics (downloads, crashes) through App Store Connect. The App contains no advertising SDK and never reads Apple's advertising identifier (IDFA).

9. How we measure our Apple Ads

When you install Pilly on an iPhone or iPad, Apple tells us whether the install came from an Apple Ads campaign we ran. If it did, Apple also tells us which campaign, ad group and search keyword it came from, and the country or region. Apple provides this without identifying you.

We keep Apple's answer with a random identifier the App creates when it is first opened. The same identifier is attached to subscriptions you buy in the App, so we can see which of our ads lead to subscriptions. It contains no name, email address or medication data, and we do not store it with your device's vendor identifier.

We use this only to measure our own advertising. We do not use it to track you across apps or websites owned by other companies.

10. How long we keep information

• Chats and package photos: not stored by us. OpenAI may keep requests up to 30 days.
• Server request logs: deleted after 90 days.
• Family sharing data: kept while you share. Deleted once the request to end sharing reaches our servers, or at once when the last caregiver unpairs (section 2).
• The hash that lets only your phone change its Family sharing: kept until you ask us to delete it.
• Free-use counter: kept while the App offers free uses, or until you ask us to delete it.
• App Store purchase records and Apple Ads answers: kept for as long as we measure our revenue and advertising.
• Analytics events: kept in Mixpanel until we delete them. We delete your phone's events when you ask.
• Medication data you never share: stays on your device and your own iCloud.

11. How we keep information safe

Requests between the App and our servers are encrypted in transit. We apply appropriate technical and organizational measures on our servers. No method of electronic transmission is 100% secure, and transmission is at your own risk.

12. Children

The App is not directed to children under 13, and we do not knowingly collect data from them. A parent, guardian or caregiver may use the App to manage a dependent's medications.

13. Your rights

Depending on where you live, you may have rights to access, correct, erase or restrict processing of personal information.

You control the data on your device and iCloud directly: edit or delete it in the App, or use Settings → Clear all data. Clear all data does not reach our servers. Turning off Family sharing deletes what our servers hold for it, except the hash described in section 2, once the request reaches them. The App sends the request again until it arrives, unless our servers refuse it (section 2).

To get a copy of, or delete, what our servers or Mixpanel hold about your phone (Family sharing data, the free-use counter, purchase and Apple Ads records, analytics events), use Settings → Delete what our servers hold. It opens an email to inquiries@zaatar.tech with your phone's identifiers filled in, and we act on it within 30 days.

14. Changes to this policy

We may update this policy from time to time. The updated version is effective as soon as it is accessible, and is indicated by the "last updated" date above.

15. Contact us

Questions or comments about this policy? Email inquiries@zaatar.tech.