Pip privacy policy
Last updated October 22, 2026
This policy covers the Pip watch face for Garmin and its sync service, made by Tiny Glance (developer name GarDev on the Connect IQ Store). Questions: contact@tinyglance.com.
In short: Pip uses your step counts to run the game. It never reads your location or heart rate, has no ads or analytics, and never sells data.
On your watch
Pip reads your daily step count to decide how Pip feels and when a prize is ready. It reads the time, date, battery level and, when your watch has it, the current temperature and weather to show them on the face. It reads sunrise and sunset times from your watch to switch between day and night. It reads the bedtime and wake time from your Garmin user profile so Pip sleeps when you do (this is why the store lists the User Profile permission). Pip does not read heart rate, sleep, location or other body measurements.
The watch stores its settings, a random device key, the cached game (friends, outfits, prizes and Pip's mood) and a list of animations it already played. Daily step totals for the last seven days let Pip count missed days while the watch is offline.
Sync
About every 30 minutes, when your watch and phone allow it, the watch sends the sync service: today's step total and up to six previous daily totals, the time and time-zone offset, the prizes you opened on the watch, the identifiers of lines and animations already shown, and, if the watch reports one, its current altitude. The service does not keep the altitude. The watch never sends GPS coordinates.
The service stores: daily step totals for the last seven days, Pip's life (missed days, status, birthday), the friends and clothes you won and which ones Pip wears, a prize history, the time zone, one inbox message, and request receipts that stop a prize counting twice. No external AI service receives your data.
Accounts and phone pairing
The watch creates its own random key on first use. The service stores a one-way hash of that key, an account ID, creation and last-sync times, a sync count and request-limit counters. There is no name, email or password.
The optional phone page uses a single-use pairing code that expires after 20 minutes. Pairing sets an essential Secure, HttpOnly session cookie for up to 30 days. The server stores only its hash, the account reference and the expiry time. Pairing does not reveal your watch key.
Hosting
The service runs on Google Cloud Run and Firestore in Finland. Google Cloud can process IP addresses, request times and technical metadata. The website has no advertising, analytics or tracking cookies.
Retention and deletion
Game data remains until the account is deleted. The device console can delete a connected account and revoke access. Deletion removes the game, prize history, receipts, sessions and pairing codes. Hosted recovery copies can remain for up to seven days in backups.
Removing Pip from your watch deletes its key and cache from the watch. To delete the copy on the server, email contact@tinyglance.com from any address with the date you installed Pip, or use the device console, and we delete it within 30 days. Provider logs and support emails have separate retention.
Your choices
Pip works offline: the face, steps, prizes and friends keep working without sync. You can ask us for access, correction or deletion at any time. Do not send device keys or private settings by email.