Your data
We cannot read your audit.
Not “we promise not to”. There is nowhere for it to go: no account, no login, no PYFFO server and no content database anywhere.
The apps
Everything stays on the device.
- Your audits, friction items, figures and plans live in a file on your device.
- There is no account to create and nothing to log in to.
- PYFFO works with no network connection at all.
- Nothing leaves unless you export or share it yourself.
The apps contain no networking code. Not disabled, not opt-out — there is no HTTP client in them to switch on. That is the simplest way to keep a promise like this one, and the easiest for someone else to check.
It also means there is no content database to breach, no backup of your company's problems on somebody else's hardware, and no analytics carrying what you wrote.
A detail that gives the game away
Shared reports use your reader's own font.
The apps ship with the Inter typeface and use it everywhere. A report you share does not: it uses whatever sans-serif the reader's device already has.
That is deliberate, and it costs us a little typographic polish. A report is a file that leaves your device, and loading a web font would make that file call out to a font host from somebody else's machine — a request PYFFO said it would not make. The promise has to survive the file leaving, or it is not a promise.
Sharing
Sharing is something you do, not something that happens.
When you share a report, PYFFO hands a file to your operating system's share sheet. Where it goes next is your choice and your email or messaging app's business — PYFFO is not involved and never sees it.
You can also export everything as a single readable, documented file, and import it back. That is how you move to a new phone. It is your data in a shape you can keep.
There is no cloud sync.
If it is ever added it will be platform sync — your own iCloud or Google account, under your control — and never a PYFFO server. Anything else would break the promise this page is about. It is not built today.
Erasing
Erase everything means everything.
One action deletes every audit, friction item and improvement on the device. It asks twice, and offers to export a copy first, because there is no copy anywhere else for us to restore from.
That is the honest consequence of local-first: nobody can recover your data for you, including us.
The exception, stated plainly
The one thing we do hold.
If you ask to be told when PYFFO launches, we keep the email address you gave us for that.
- You type it in yourself, on its own page, and tick a box to confirm.
- We store the address, which edition you were looking at, and the wording you agreed to.
- One email, when PYFFO launches. Nothing else, and never sold or passed on for anyone else's use.
- It is held on our server and by our email provider, SendGrid, who send that email for us and nothing more.
- It is not an account and there is nothing to log in to.
It is kept entirely apart from everything else on purpose. If you use Find My Friction, none of your answers are sent with it — the assessment runs in your browser and never submits anything anywhere.
A mailing list does not weaken the promise that PYFFO cannot read your operational data, but only for as long as the two never mix. So they do not mix.
This website
What the site itself does.
- The assessment runs entirely in your browser. No answer is sent to us, and no email is needed to see your result.
- The typeface is served from this site, not from a font host, so reading this page does not tell a third party you were here.
- No advertising, no trackers, no third-party scripts.
If analytics are ever added, this page will say what is collected before it is collected, and it will never include the content of an assessment answer.