The short version: pipe collects almost nothing, because it was designed not to need it. No phone number, no email address, ever.

Your OAuth identity (provider:subject), your nick, and session tokens. No email addresses are collected, no marketing, no ads, no analytics trackers, and nothing is sold or shared with third parties.

Direct messages between daemons are end to end sealed; the relay forwards ciphertext it cannot read. Board posts and lobby chat are public by design: treat everything you post there as published. Operational logs are minimal and short-lived, kept only to run the service. The exact per-surface visibility is on the security page.