Privacy Policy

This policy explains what personal data Poppin processes, why, where it is kept, how long, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it. "Poppin", "we" and "us" mean the people who make and run Poppin.

Poppin is a money planner. It never holds, moves or receives money, and it never connects to your bank.

1Your entries are kept on your phone

Spends, money in, bills, goals, splits, categories, notes and settings are stored only on your phone, in the app's private storage. They are never sent to us and we cannot see them. The name you can give Poppin ("What should we call you?") is optional, is kept on your phone and is never sent to us.

No account. Poppin currently has no sign-up or sign-in, and we do not collect your email address, phone number or name.

App lock. Your PIN and fingerprint or face unlock are kept on your phone. Biometric checks are done by your phone's system; Poppin never receives your fingerprint or face data.

Entries are not separately encrypted by Poppin on the phone, so please protect your phone with a screen lock.

2Copies you control

• Android backup. If Android backup is on for your phone, Android may copy Poppin's app data (including your entries) to your own Google account, encrypted, as it does for other apps. That copy is between you and Google; we cannot access it. The app lock PIN is not included.
• Exports and backup files. When you export a CSV or send yourself a backup file, it goes wherever you choose through your phone's share sheet. Anyone you send it to can read it.
• Reminders are local notifications scheduled on your phone. Nothing about your bills is sent to us or to a notification service.

3Usage counts (optional, off by default)

Poppin asks once, after a few days of use, whether you want to share usage counts. They stay off unless you say yes. You can change your choice any time in Account → Privacy & lock → Share usage counts.

If you turn it on, the app sends us, at most once a day, a count per day of these events:

• app opened; plan set; spend logged; reminder turned on; backup saved;
• features used, from a fixed list: afford check, goals, splits, bills, spread, Hinglish, export, backup, reminders;
• how long a visit lasted, as a band (under 1 minute, 1 to 5 minutes, over 5 minutes);
• how long logging a spend took, as a band (under 8 seconds, 8 to 20 seconds, over 20 seconds, or closed without saving);
• reminders scheduled, opened, silenced, blocked by phone settings or turned off, with which reminder it was (bills, evening, payday, weekly or come-back);
• your answer to a monthly 1 to 5 "how useful was Poppin" question, if you answer it.

Each day's counts carry: the date (no time of day), a random install id made on your phone, the app version, the language, the platform (for example Android), a plan-state label (on track, tight or over; never an amount) and how long you have used Poppin as a band (0–2, 3–6, 7–13, 14–29, 30–59 or 60+ days).

We never receive amounts, notes, names, categories you typed, exact times, advertising ids, contacts or anything else you type.

The install id is not your name or email, but because it links one phone's counts together we treat these counts as personal data (pseudonymous). We use them only to learn which parts of Poppin help people and to improve the app. We do not use them for advertising, and we do not try to identify you.

Where and how long. Counts wait on your phone for at most 60 days, are deleted from the phone once sent, and are stored with Supabase (our hosting provider, acting on our instructions) in Mumbai, India (ap-south-1). We delete them automatically after 400 days, or sooner when you turn sharing off or use Delete all my data.

IP addresses. Our own database tables do not store IP addresses. Like any internet service, Supabase's infrastructure may log request details such as IP address and time for security and operations, under its own retention periods. We do not combine those logs with your counts.

A version of Poppin that is not set up to send counts never asks, shows no switch and sends nothing.

4Feedback

"Send feedback" (Account → Help) opens your email app with a message addressed to info@popp-in.com that includes only the app version and Android version. What you write and send is up to you. We use your email and message only to reply and to improve Poppin, and delete them when no longer needed.

5What Poppin never does

No ads. No third-party trackers or analytics SDKs. No access to SMS, contacts, location or your bank. We never sell your data or share it with anyone for their own use.

6This website

popp-in.com sets no cookies and loads nothing from other sites. It saves your language choice (English or Hinglish) in your browser's local storage, on your device only. Our hosting provider may log requests (such as IP address and pages asked for) for security and operations.

7Why we process data, and on what basis

We process usage counts only with your consent (DPDP Act, section 6), given when you turn sharing on, and only to improve Poppin. Feedback emails are processed because you choose to send them to us. You can withdraw consent at any time as easily as you gave it; that does not affect processing done before.

8Delete your data

• Delete everything: Account → Your data → Delete all my data. This erases your entries and settings from the phone, deletes counts waiting on the phone, and asks our server to delete the counts stored for your install id.
• Stop sharing: turn off Account → Privacy & lock → Share usage counts. This deletes waiting counts on the phone and the counts we hold for your install id.
• Uninstall: removing Poppin removes its data from the phone. Counts already sent are then deleted after 400 days at most; if you want them gone sooner, turn sharing off or use Delete all my data before uninstalling.

If your phone is offline, the delete request waits and is sent the next time you open Poppin. A copy in your Google account backup is controlled by you through your Google account settings.

9Your rights

Under the DPDP Act you have the right to:

• Access: your entries are on your phone; export them any time (Account → Your data). You can also ask us what kinds of data we hold and whom we share it with (only our hosting provider).
• Correction: edit any entry, your nickname or your plan in the app at any time.
• Erasure: as described in "Delete your data" above, or by writing to us.
• Grievance redressal: complain to our Grievance Officer (below).
• Nominate: name another person to exercise these rights for you if you die or become unable to, by writing to us.

Because we don't know who you are, we usually cannot match an email to a phone's usage counts. The quickest way to stop or erase them is in the app (turn sharing off, or Delete all my data), which works without telling us who you are. We will never ask for more information than we need to act on a request.

10Age

Poppin is for people aged 18 or over. We do not knowingly process children's data, track children or show them ads.

11Security and breaches

Data sent to us travels only over encrypted connections (HTTPS), and access to our database is restricted. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

12Grievance Officer and contact

We acknowledge complaints within 7 days and resolve them within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

13Changes

We will update this page and its effective date when the policy changes. If a change is significant, we will tell you in the app before it takes effect and ask for your consent again where the law requires it.

Poppin is free today. If we ever add paid extras, we'll tell you in the app first, nothing is charged automatically, and the everyday features you already use stay free.