PrivacyPolicy

Pipo is an independent macOS utility for LPU Cavite students. It connects directly to the LPU Cavite Moodle service and keeps its working data on your Mac. Pipo does not operate an account or cloud-sync service.

Pipo sends your sign-in credentials to https://lms.lpucavite.edu.ph only to obtain an LMS access token. Your password is discarded after that exchange. Pipo then uses the token for read-only Moodle requests.

Pipo can retrieve your identity, enrolled courses, assignments, due dates, schedules, announcements, message metadata, grade feedback, submission status, and course resources when available from the LMS. Pipo does not submit assignments, send messages, mark LMS items read, or upload content.

• Your LMS token and cache-encryption key are stored in macOS Keychain.
• An encrypted local database stores the latest dashboard snapshot and local state such as seen items, snoozes, pinned courses, and hidden courses.
• Refresh, notification, reminder, and quiet-hour preferences are stored in macOS user defaults.

The Pipo website sends one anonymous visit increment to a server-side counter shared across its domains and devices. The counter stores only an aggregate total. It also uses Vercel Web Analytics to measure aggregate page views and website usage.

Download requests pass through Pipo’s download endpoint so aggregate download starts can be counted before the DMG is served. This does not prove that a download finished or that Pipo was installed.

Clicking “Send feedback” sends your message to Resend for delivery to the Pipo maintainer’s feedback address. The form does not ask for your identity or email address. The hosting provider and Resend may process standard request data under their own terms.

If “Share anonymous usage” is enabled in Pipo, the app sends a random install ID, app version, platform, and launch or periodic heartbeat event to count active installations. Pipo does not send LMS content, account identity, tokens, grades, messages, or student IDs. The server hashes the install ID before storage. Hashed activity memberships expire after 31 days. Turning reporting off cancels future reporting in the app; previously received aggregate data remains until its expiry.

Pipo interacts with LPU Cavite Moodle, macOS Keychain, Notifications, Calendar, GitHub Releases, GitHub Issues, GitHub-hosted update feeds, Vercel Web Analytics, Upstash Redis, and Resend only for the functions described above. Those services apply their own privacy practices.

Signing out removes Pipo’s LMS token, encrypted dashboard cache, encrypted local state, and Pipo notifications from your Mac. App preferences may remain until you remove Pipo’s app data. Removing Pipo does not delete data held by your school, GitHub, Apple, hosting providers, or device backups.

Pipo can create a diagnostic report when you choose to export one. Reports are designed to redact credentials and sensitive LMS content, but review any report before sharing it.

For policy questions, use GitHub Issues without posting credentials or private LMS data. Report security problems through GitHub’s private vulnerability reporting when available.

This policy may change when Pipo’s features or data practices change. The effective date above identifies the current version.