Your data on Bipe (LGPD)

Bipe, test version. Updated 14 October 2026.

Every piece of data Bipe keeps, what it is for, its LGPD legal basis, how long we keep it and where it lives. The page is built from the same record the team uses to manage the data. The Portuguese version is the reference text.

The plain-language text is in the privacy policy.

Who can read your chats.

What we keep

Your account

What: Username, display name, the connected devices, the encryption keys and who may message you.
Why: To create the account, deliver your messages and apply your choices.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as the account exists.
Where it lives: Bipe server in São Paulo (in Brazil)

PIN and access

What: A protected form of your PIN, of the password the app makes by itself and of the recovery code, and how many times the PIN was entered wrong. We never see the PIN or the password itself.
Why: To let you sign in and to protect the account from someone guessing the PIN.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as the account exists.
Where it lives: Bipe server in São Paulo (in Brazil)

Terms acceptance

What: Which version of the Terms of use and the Privacy policy you accepted, and when.
Why: To show that you agreed to the terms when you created the account or after a change.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as the account exists.
Where it lives: Bipe server in São Paulo (in Brazil)

Code to get back into your account (iPhone)

What: A code the app makes and keeps in iCloud Keychain, in your Apple account. Bipe gets no copy of it.
Why: On a new iPhone with the same Apple account, the code takes you back into your account. It does not open old messages.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as it stays in your iCloud Keychain.
Where it lives: iCloud Keychain, in your Apple account (country to be confirmed)

Recovery email (optional)

What: The email you choose, your language and your account recovery requests.
Why: To help you get back into the account and to tell you when something changes in it, such as a new PIN or a new device. No marketing.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: Until you remove the email from the account.
Where it lives: Bipe server in São Paulo (in Brazil); The service that delivers Bipe's emails (country to be confirmed)

Your @handle

What: The @handle you choose. When you release a handle, it stays reserved for you for 90 days.
Why: So people find you by @handle without seeing your phone number.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: Until you remove the handle. The reservation lasts 90 days.
Where it lives: Bipe server in São Paulo (in Brazil)

Handle history

What: Each account's handle changes, with the date.
Why: To tell the people you talk to that a handle changed recently. That is a common scam sign.
Legal basis: Legitimate interest (LGPD, art. 7, IX)
How long: One year, and at most the last 20 changes.
Where it lives: Bipe server in São Paulo (in Brazil)

Invites

What: Who invited whom, and a protected form of each invite code.
Why: During testing, only people with an invite can join. The record helps find fake accounts and abuse.
Legal basis: Legitimate interest (LGPD, art. 7, IX)
How long: No time limit set yet.
Where it lives: Bipe server in São Paulo (in Brazil)

Messages

What: Private conversations are end-to-end encrypted: the server stores them scrambled and cannot read them. In rooms without encryption, the server stores the text. In all rooms, the server knows who is in each conversation, when each message arrived, and the room's name and photo.
Why: To deliver messages to all your devices.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as the conversation exists on the server.
Where it lives: Bipe server in São Paulo (in Brazil)

Photos and files

What: What you send, up to 50 MB per file. In encrypted conversations, the file is scrambled too.
Why: So the people who receive it can download it.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as the conversation exists on the server.
Where it lives: Bipe server in São Paulo (in Brazil)

Connection logs

What: IP address, date and time of each connection.
Why: Brazil's Marco Civil da Internet (article 15) requires us to keep these logs.
Legal basis: Legal obligation (LGPD, art. 7, II)
How long: 6 months.
Where it lives: Bipe server in São Paulo (in Brazil)

iPhone notifications

What: Your device's notification address and the IDs of the conversation and the new message. The message text does not go with it: the app fetches the content directly from the Bipe server.
Why: To tell you a message arrived.
Legal basis: Performing the service you asked for (LGPD, art. 7, V)
How long: As long as notifications are on for that device.
Where it lives: Bipe server in São Paulo (in Brazil); Apple, the iPhone notification service (outside Brazil)

Site visits

What: The page visited, the site you came from, device and browser type, language and approximate city. No cookies, no IP address and nothing that says who visited.
Why: To know which pages and campaigns bring people to Bipe.
Legal basis: Legitimate interest (LGPD, art. 7, IX)
How long: 13 months.
Where it lives: Bipe server in São Paulo (in Brazil)

App milestones

What: Per day, which milestones an account reached: account created, first sign-in, first message, contact verified, invite sent, invite used, group created, call started and day of use. The account shows only as a code derived from it, never by username. No content, no IP address, no room and nothing about who the person talks to. The app sends nothing: the server takes this from what it already sees.
Why: To know whether Bipe is useful to people who join and at which step people give up.
Legal basis: Legitimate interest (LGPD, art. 7, IX)
How long: 13 months.
Where it lives: Bipe server in São Paulo (in Brazil)

Waitlist

What: Your email, your phone's system, your language, the site page where you signed up and the headline version you saw.
Why: To send your invite when your turn comes. Nothing else.
Legal basis: Consent (LGPD, art. 7, I)
How long: Until the invite is used or expires. Earlier, if you ask.
Where it lives: Bipe server in São Paulo (in Brazil); The service that delivers Bipe's emails (country to be confirmed)

Partner request

What: The organisation's name and type, the name and email of the person who wrote, the message and the language.
Why: To answer the request. The team gets a copy by email.
Legal basis: Legitimate interest (LGPD, art. 7, IX)
How long: One year. Earlier, if you ask.
Where it lives: Bipe server in São Paulo (in Brazil); The service that delivers Bipe's emails (country to be confirmed); The team's email inbox (country to be confirmed)

What passes outside Brazil

Almost everything stays on the Bipe server in São Paulo. These are the cases where data passes through another service:

Apple, the iPhone notification service (outside Brazil): iPhone notifications.
The service that delivers Bipe's emails (country to be confirmed): Recovery email (optional), Waitlist, Partner request.
The team's email inbox (country to be confirmed): Partner request.
iCloud Keychain, in your Apple account (country to be confirmed): Code to get back into your account (iPhone).

What stays on your phone

Bipe does these on the device. None of it goes to the server.

Scam warnings and link checks. No text, match or score leaves the phone.
Voice message transcripts. The text leaves the phone only as the message caption, with the same protection as the message.
The password the app makes by itself. It stays in the device's secure storage.

On the site, we test which home page headline works best. The server only counts visits and clicks per version and per day. It keeps no IP address and nothing that identifies a visitor.

Your rights

Know whether we process your data and see what it is.
Correct data that is wrong or out of date.
Ask us to delete your data and your account.
Get your data in an open format.
Know who we share your data with.
Withdraw consent, where consent is the legal basis.
Complain to the Brazilian data protection authority (ANPD).

For any request, contact us. During testing, accounts are deleted on request.

Who looks after your data

During testing, Bipe is run by Envisioning, the data controller.

The data protection officer (encarregado) is not yet named. Until then, requests go to the same contact.