Privacy Policy

Effective Date: July 1, 2025

Last Updated: September 6, 2026

PopJoy, Inc. ("PopJoy," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web platform and services (collectively, the "Services").

1. Information We Collect
2. How We Use Your Information
3. How We Share Your Information
4. Data Security
5. Data Retention
6. Your Privacy Rights
7. Cookies and Tracking Technologies
8. International Data Transfers
9. Children Under 13
10. Automated Decision-Making
11. U.S. State Privacy Rights (CCPA/CPRA and State Laws)
12. Changes to This Policy
13. Contact Us

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide to us, including:

Account Information: Name, email address, phone number (if provided), username, password, and profile information, including optional demographic details such as gender and location/country of residence, and banking or payout-related details where you monetize
Content: Series, pops, comments, images, and other content you create or share on the Services
Communications: Messages you send to us, including customer support and privacy requests
Feedback & Preferences: In-product preference settings, feedback you submit, and similar responses you choose to provide
Purchases & Payments: Payments are processed directly by third-party processors (e.g., Stripe). We do not collect or store full credit card numbers or security codes. We maintain records of transaction metadata (including card type, last 4 digits, purchase amount, and payment status/identifiers) to process orders, handle support, and meet legal accounting obligations
Payout Information: For users receiving payouts, payment distribution is managed via third-party payment processors. We store associated payment account identifiers (e.g., Stripe Account IDs) to route transfers and fulfill regulatory reporting requirements
Age Screening: Date of birth, collected at account creation to determine eligibility and provide age-appropriate content and experiences
Marketing Preferences: Your choice to opt in or out of marketing emails

1.2 Information We Collect Automatically

When you use our Services, we automatically collect:

Device Information: IP address, browser type, operating system, device and session identifiers, locale, and timezone
Usage Data: Pages visited, features used, time spent on the platform, click patterns, and interaction data (including first-party analytics events when permitted by your cookie preferences)
Location Information: General location data based on IP address (we do not collect precise GPS location)
Log & Diagnostic Data: Server logs, error reports, and technical diagnostics about your use of our Services (including optional session replay when you consent)
Inferences: We may draw limited inferences about your content interests and usage patterns based on your interactions with our Services (for example, to power recommendations and age-appropriate experiences)

1.3 Information from Third Parties

We may receive information from:

Payment Providers: Transaction status, payment method metadata, and payout account status from processors such as Stripe
Infrastructure & Observability Providers: Technical and security signals from providers that host, deliver, or monitor the Services
Connected Features: If we offer or you later use account-connection or social features, information those providers share with us subject to your settings with them
Public Sources: Publicly available information that you have made available online, where relevant to safety, fraud prevention, or profile display

2. How We Use Your Information

We use your information for the following purposes:

2.1 Providing and Improving Services

Creating and managing your account
Delivering requested features and functionality
Personalizing your experience and content recommendations
Analyzing usage patterns to improve our platform
Developing new features and services
Verifying your age and providing age-appropriate content and experiences

2.2 Communication

Sending service-related notifications and updates
Responding to your inquiries and providing customer support
Sending promotional materials and newsletters (with your consent)
Notifying you about changes to our policies or terms where practicable

2.3 Safety and Security

Preventing fraud, abuse, and unauthorized access
Monitoring for suspicious activity and security threats
Enforcing our Terms of Service and community guidelines
Protecting the rights and safety of our users and the public

2.4 Legal Compliance

Complying with applicable laws and regulations
Responding to legal requests and court orders
Protecting our legal rights and interests
Conducting internal audits and investigations

2.5 Business Operations

Processing payments, Star Awards, and creator payouts
Conducting research and first-party analytics
Marketing our Services (for example, email marketing with your consent)
Managing business transactions and partnerships

2.6 Analytics, Measurement, and Planned Advertising

We use first-party analytics and related technical data (subject to your cookie preferences where required) to understand how the Services are used, improve performance and reliability, and measure feature effectiveness.

We intend to use Google advertising and measurement services (for example, Google Ads) on the Services to show ads and measure ad and campaign performance. Those Google advertising technologies are not enabled on the Services today. Until they are enabled, we do not operate third-party advertising networks on the Services and we do not sell or share personal information for cross-context behavioral advertising. Before we enable Google Ads or any similar advertising, we will update this Privacy Policy as needed and provide any required choices (including cookie preferences and, where required, a "Do Not Sell or Share My Personal Information" control and Global Privacy Control handling).

3.1 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

3.2 Service Providers

We share information with trusted third-party service providers who help us operate our platform:

Cloud Hosting & Delivery: Cloudflare, Supabase
Analytics Infrastructure: Cloudflare (including Web Analytics/Insights where enabled) and PopJoy first-party analytics
Communication: Resend
Payment Processing: Stripe
Observability: Sentry (error monitoring; optional session replay when you consent)
Advertising (planned): Google Ads — intended for advertising and measurement on the Services, but not enabled today. We will update this policy and provide required choices before enabling it.

These service providers are contractually restricted from using your information for purposes other than providing services to us.

3.3 Advertising and "Sale" or "Sharing"

We do not currently sell personal information or share personal information for cross-context behavioral advertising within the meaning of California and similar state privacy laws. We also do not currently share personal information with third-party advertising networks for targeted ads on the Services.

We plan to enable Google advertising and measurement services. When that happens, we may share certain information with Google (and any other advertising partners we disclose) for advertising and measurement — for example device or advertising identifiers and browsing/interaction data related to ads. Depending on how those services are configured, that activity may constitute a "sale" or "sharing" of personal information under California and other state privacy laws. Before we begin such practices, we will update this policy and provide required opt-out mechanisms (including any "Do Not Sell or Share My Personal Information" control and Global Privacy Control handling where required).

3.4 Business Transfers

If PopJoy is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

3.5 Legal Requirements

We may disclose your information when required by law or when we believe disclosure is necessary to:

Comply with legal obligations, court orders, or government requests
Protect the rights, property, or safety of PopJoy, our users, or others
Investigate potential violations of our Terms of Service
Prevent or address fraud, security, or technical issues

3.6 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for research, analytics, or business purposes.

4. Data Security

We implement appropriate technical and organizational measures to protect your information:

4.1 Technical Safeguards

Encryption: Data encrypted in transit using TLS and at rest using industry-standard encryption provided by our infrastructure providers
Access Controls: Authentication controls, including multi-factor authentication options for eligible accounts, and role-based access restrictions
Network Security: Firewalls, intrusion detection, and regular security monitoring where provided by our hosting and edge providers
Secure Development: Security testing, code reviews, and vulnerability assessments as part of our development practices

4.2 Organizational Measures

Employee Training: Privacy and security expectations for staff with access to systems that process personal data
Access Minimization: Access to personal data limited to personnel who need it to perform their roles
Incident Response: Established procedures for detecting and responding to security incidents
Vendor Oversight: Use of reputable providers under contractual data-protection terms

4.3 Data Breach Response

In the event of a data breach, we will:

Notify affected users without undue delay and in accordance with applicable law
Report to relevant authorities as required by law
Provide information about the incident as required
Take prompt steps to secure affected systems

5. Data Retention

We retain your information for as long as necessary to provide our Services and fulfill the purposes outlined in this policy:

Account & Content Data: Retained while your account is active. When you delete your account through self-service deletion, we purge account credentials and associated personal content from active systems as part of that deletion process (it is permanent and cannot be undone)
Deletion Audit Records: After account deletion, we may retain a limited audit record (such as former user ID, email, username, deletion timestamp, IP address, and user agent) for security, abuse prevention, and compliance. This record is not used to restore your account
Usage & Analytics Data: Retained as needed for product analytics and security, then deleted or de-identified according to our operational practices and provider settings
Communication Data: Support and similar communications may be retained in our email/support systems as needed to handle your request and for legitimate business records
Legal/Compliance Data: Payment, tax, and other records retained as required by applicable laws and regulations
Backups: Residual copies may remain in encrypted backups for a limited period until those backups rotate out in the ordinary course

You can request deletion of your account and associated data at any time through your account settings or by contacting us via our support page, User Data Deletion page, or support@popjoy.app.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

6.1 Access and Portability

Request access to your personal information
Receive a copy of available account data in a portable format via Download My Data in Privacy Settings (coverage may expand over time)
View and update your account information in Settings

6.2 Correction and Updates

Correct inaccurate or incomplete information
Update your account details and preferences
Modify your privacy and cookie settings

6.3 Deletion and Restriction

Request deletion of your personal information or delete your account in Settings
Restrict certain types of optional data processing (for example, optional analytics and session replay cookies)
Object to processing based on legitimate interests where applicable law provides that right

6.4 Communication Preferences

Opt out of marketing communications
Manage notification settings
Unsubscribe from promotional emails

6.5 Right to Lodge a Complaint

If you are located in the European Economic Area (EEA) or UK, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal information infringes applicable law. You may do this without prejudice to any other administrative or judicial remedy. We encourage you to contact us first at support@popjoy.app so we can try to resolve your concern directly.

6.6 Exercising Your Rights

To exercise these rights, you can:

Use the privacy controls, cookie preferences, data export, and account deletion tools in your account settings
Submit a request through our support form (Privacy category)
Contact us at support@popjoy.app

We will respond to your request within the time required by applicable law and may require verification of your identity.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

Essential Cookies: Required for the Services to function properly (including sign-in and security). These stay on.
Analytics Cookies: Optional first-party analytics that help us understand how the Services are used
Session Replay / Diagnostics: Optional enhanced diagnostics (currently via Sentry Session Replay) used only if you consent
Advertising Cookies (planned): When Google Ads or similar advertising is enabled, advertising and measurement cookies or similar technologies may be used. They are not used on the Services today. Before enabling them, we will update this section and your cookie preference options as required.

7.2 Managing Cookies

You can control optional cookies through:

Our cookie banner and Cookie Preferences dialog (Accept all, Reject non-essential, or Customize)
Privacy Settings → Cookie preferences when signed in
Your browser settings (accept, reject, or delete cookies)

Disabling optional cookies may limit diagnostics and product analytics but will not prevent essential sign-in and security functions. Because we do not currently sell or share personal information for cross-context behavioral advertising, Global Privacy Control (GPC) signals are not used today as a sale/share opt-out. Before we enable Google Ads or other sale/sharing for cross-context behavioral advertising, we will honor GPC where required by law and update this section.

7.3 Third-Party Technologies

Our service providers (such as Cloudflare, Stripe, and Sentry) may set or process technical cookies or similar technologies as needed to deliver their services to us. These providers have their own privacy policies. Optional session replay is gated by your PopJoy cookie preferences. If and when we enable Google Ads, Google may also set or read advertising/measurement cookies or similar technologies as described in Sections 2.6, 3.3, and 7.1, subject to the choices we provide at that time.

8. International Data Transfers

PopJoy operates globally and may transfer your information to countries other than where you reside. We use appropriate safeguards for such transfers, which may include:

Standard Contractual Clauses: EU-approved data transfer agreements with vendors where applicable
Adequacy Decisions: Transfers to countries recognized as providing adequate privacy protections
Vendor Contractual Protections: Data processing terms and security commitments with our service providers
Your Consent: Explicit consent for transfers where required by law

For EEA/UK users, the data controller responsible for your personal information is:

PopJoy, Inc.
649 Central Avenue, San Francisco, CA 94117
Email: support@popjoy.app

9. Children Under 13

9.1 Age Requirements and Verification

PopJoy is not meant to be used by children under 13 years of age. We collect date of birth at account creation to determine whether a user is under 13 and to provide age-appropriate content and experiences to all users.

9.2 Children Under 13 (COPPA)

PopJoy does not permit users under the age of 13 to create accounts or use our Services. If you are identified as being under 13 during the account creation process, your account will not be created and any information entered will not be registered. If we become aware that we have inadvertently collected personal information from a user under the age of 13, we will delete that information as quickly as practicable. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately via our support page or at support@popjoy.app.

9.3 Teens and Minor Users (13–17)

For users between 13 and 17, we apply additional protections consistent with applicable law and our product design:

We do not sell or share personal information of users under 16 for targeted advertising. We do not currently sell or share personal information for cross-context behavioral advertising for any users.
We provide age-gated content experiences (including mature-content restrictions) based on the date of birth associated with the account.
We monitor evolving minor-protection frameworks (including the UK Age Appropriate Design Code and the EU Digital Services Act) and will update our practices as required.

10. Automated Decision-Making

We use automated systems to personalize content recommendations and experiences based on your usage patterns, preferences, and age-appropriateness signals. These systems do not make decisions that produce legal or similarly significant effects solely through automated processing without human review. Where applicable law gives you rights regarding profiling or automated decisions, you may contact us as described in Sections 6 and 11.

11. U.S. State Privacy Rights (CCPA/CPRA and State Laws)

This section applies to residents of California and other U.S. states with applicable privacy statutes (including Virginia, Colorado, Connecticut, Texas, and others). It supplements the rest of this Privacy Policy.

11.1 Categories of Personal Information We Collect

We collect the following categories of personal information:

Identifiers (name, email address, IP address, device/session identifiers, account name)
Commercial information (purchase and transaction history, payout-related identifiers)
Internet/electronic network activity (browsing and interaction with the Services, subject to cookie preferences for optional analytics)
Demographic information you choose to provide (such as gender or location)
Inferences (drawn from the above to reflect content preferences and usage patterns)

We do not currently sell personal information or share personal information for cross-context behavioral advertising. We share personal information with service providers as described in Section 3.2. As described in Sections 2.6 and 3.3, we plan to enable Google advertising and measurement services; before that begins, we will update this section and provide any required opt-out mechanisms.

11.2 Your Rights Under State Privacy Laws

Subject to applicable law and exceptions, you may have the following rights:

Right to Know: The categories and specific pieces of personal information we have collected about you, and the categories of sources, purposes, and third parties involved.
Right to Delete: Request deletion of your personal information, subject to certain exceptions (including self-service account deletion).
Right to Correct: Request correction of inaccurate personal information.
Right to Data Portability: Receive available personal information in a portable, machine-readable format.
Right to Opt-Out of Sale/Sharing: Opt out of the sale or sharing of your personal information for targeted advertising. Because we do not currently sell or share personal information for these purposes, there is no separate "Do Not Sell or Share" control today. Before we enable Google Ads or other sale/sharing for cross-context behavioral advertising, we will provide one and update this policy. You may still contact support@popjoy.app with questions.
Right to Opt-Out of Profiling: In certain states, you may opt out of profiling that produces legal or similarly significant effects.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

11.3 Submitting a Request

To submit a request to know, delete, correct, or ask about sale/sharing practices, contact us at support@popjoy.app, use the Privacy category on our support form, or use the controls in your account settings (including Download My Data and Delete Account). We will verify your identity before processing applicable requests and will respond within the time required by law (for example, within 45 days under CCPA/CPRA, extendable where permitted with notice). You may also designate an authorized agent to submit requests on your behalf by emailing support@popjoy.app.

11.4 Minors (Under 16)

We do not sell or share the personal information of users we know to be under the age of 16 for targeted advertising. As noted above, we do not currently sell or share personal information for cross-context behavioral advertising for any users.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Post the updated policy on our website with a revised "Last Updated" date
Provide additional notice through the Services and/or email to account holders where practicable
Request your consent for material changes where required by law

Your continued use of our Services after the changes take effect constitutes acceptance of the updated policy, except where applicable law requires a different form of consent.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please go to our support page (Privacy category) or contact us: