Privacy

The short version

Pirogi protects your saved contacts, notes, groups, and reminders with end-to-end encryption. They are encrypted on an authorized device before they are synchronized. Pirogi stores the encrypted vault but does not receive the vault key and cannot decrypt that stored content. AI features temporarily process the specific information needed for your request, as explained below. Any older data awaiting migration remains server-readable until its migration is verified and the old copy is deleted. We do not sell your personal information or use it for advertising.

Information we handle

• Account information: your name, email address, profile image, and sign-in identifiers supplied through Clerk and your chosen sign-in provider.
• Pirogi content: the profile details, contacts, groups, notes, reminders, and related information you choose to save.
• Voice and AI input: text you dictate or submit and, when server transcription is available and used, a temporary audio recording.
• Feedback: messages, screenshots, and basic page and device context you intentionally submit through the feedback form.
• Technical information: ordinary security, request, and diagnostic information processed by our hosting and authentication providers.

How we use information

We use this information to authenticate you, operate and secure Pirogi, save and retrieve your content, provide features you request, troubleshoot problems, and improve the service.

Storage and separation

Contact photos are cropped and resized on your device before saving. Only a small thumbnail is stored in your encrypted vault and included in your data export; the original photo is not uploaded. Contact photos are not sent to AI providers.

In client-encrypted mode, Pirogi content is stored as an encrypted vault on Railway-hosted infrastructure. Encryption and decryption happen on authorized devices using a key that is not sent to Pirogi. A valid Clerk session and a signed request from an authorized device are required to download or replace the encrypted vault. A new device must be approved from an existing device or recovered with the user’s recovery code. Account authentication information is handled by Clerk and your chosen provider, such as Google.

This protection applies to stored vault content and synchronization. It does not prevent someone who can use an unlocked authorized device from seeing the content already available on that device. Revoking a device prevents future synchronization unless it is authorized again; it cannot remotely erase information that device previously decrypted or rotate the vault encryption key. Someone with your recovery code and access to your sign-in account can authorize a new browser. If a removed browser may hold that code, replace the recovery code and end its sign-in session.

Vaults created with the older recovery method require a one-time update from an already authorized browser. That update can keep your existing saved recovery code or replace it with a new one. Until the update is complete, the older recovery method cannot authorize another browser.

Drafts and older copies

In encrypted-vault mode, unsent Log anything text, bulk contact lists, and feedback text or screenshots saved in this browser are encrypted with your vault key and separated by account. Signing out clears that account’s local drafts. They do not sync to your other devices. Without an unlocked encrypted vault, drafts remain only in the current tab. Upgrading from the previous shared draft storage clears old unsent drafts because their account owner cannot be established.

Some data from before encrypted-vault mode, including legacy databases, import files, and retained backups, remains server-readable until its migration is verified and the older copies are retired. Encrypting the synchronized vault does not automatically erase those earlier copies. Account information and feedback you submit are also outside the encrypted vault and are readable by Pirogi and the providers needed to handle them. Contact us about deletion of these copies as well as your current vault.

Voice and optional AI processing

Keyboard or device dictation is governed by your device and dictation provider. Recorded-audio server transcription is disabled when the client-encrypted vault is active. Standard search runs on the authorized device.

Log anything interpretation, bulk contact upload, and Deep Search are AI-powered features. When AI is available, continuing from Log anything to its preview starts AI interpretation. Bulk upload sends the pasted or uploaded list you submit so AI can propose contact drafts; existing contacts stay on your device while duplicate names are checked. Search automatically starts Deep Search when standard search returns no matches, and you can also request Deep Search from search results. Manual contact and note forms and standard search do not require AI. When one of those features is used, the authorized device decrypts the information needed for that request and sends it over an encrypted connection through Pirogi’s relay to OpenRouter and a server-selected model. Log anything interpretation sends the submitted text and a limited contact identity index; it does not send historical notes or reminders. Deep Search sends the question and bounded contact, group, fact, and note excerpts; it does not send reminders or raw dictation transcripts. Log anything and Deep Search prompts and responses are not persisted by Pirogi’s relay.

A submitted bulk upload can continue after you close Pirogi or move the app to the background. Pirogi temporarily holds the submitted list in server memory while the model processes it and does not write that readable source text to its database. The authorized browser generates and retains a one-time result key; Pirogi receives that key transiently to encrypt the completed draft and does not persist it. The job status and encrypted result are available for up to 24 hours, and the result is deleted after the contacts are created. Expired jobs are removed from the live database by cleanup that runs every five minutes while the server is running and at startup after downtime; cleanup failures are retried and may delay removal. Removing a job from live storage does not remove encrypted copies in retained backups. If that browser’s local key is removed, the stored result cannot be decrypted.

Pirogi’s application request logs record route and operational metadata rather than request bodies. Pirogi’s relay, OpenRouter, and the selected model provider must temporarily process the submitted plaintext to answer the request. Provider requests require zero-data-retention handling and deny provider data collection. AI output is returned to the authorized device and encrypted before it is synchronized as Pirogi content.

When information is shared

We share information only with service providers needed to run Pirogi. Clerk and a chosen sign-in provider such as Google process account and authentication information. Railway stores the encrypted vault and operational data. Resend delivers beta emails and feedback alerts to our team; feedback alerts contain only the submission ID, time, and screenshot count. When an OpenRouter-powered feature is used, OpenRouter and the selected model provider process the content selected for that request. We may also disclose information when legally required, to protect users or the service, or as part of a business transfer. We do not sell your personal information.

Your choices

You can edit or delete individual Pirogi records, export a decrypted copy locally from an authorized device, review authorized devices, and revoke a device from future synchronization. Keep the recovery code private and available: if every authorized device and the recovery code are lost, Pirogi cannot recover the encrypted vault. We retain account information and encrypted content while your account is active or as reasonably needed to operate the service, meet legal obligations, resolve disputes, and protect the service. To request account or data deletion, contact us at team@pirogi.ai.

Security and age

We use reasonable safeguards designed to protect your information, but no service can guarantee absolute security. Pirogi is not intended for children under 13.

Changes and contact

We may update this policy as Pirogi changes and will revise the effective date above. Questions or privacy requests may be sent to team@pirogi.ai.