Pop Buy
DRAFT — this policy is being finalized before launch.

Pop Buy Privacy Policy — DRAFT v1

Status: working draft for founder review. MUST be reviewed by a qualified attorney before launch — this is a strong starting skeleton written for Pop Buy's actual architecture, not legal advice. Bracketed items need founder decisions/details. Lives at docs/legal/privacy_policy_draft.md; final version publishes at [popbuy domain]/privacy.

Effective date: [DATE] · Last updated: [DATE]

Pop Buy ("Pop Buy," "we," "us") is a location-based deals platform operated by [LEGAL ENTITY NAME, e.g., Pop Buy LLC], [STATE] [ADDRESS]. This policy explains what we collect, why, and the choices you have. Plain-English summaries head each section; the summary never overrides the detail.

1. The short version

We use your location to show and unlock nearby deals — that is the product. We do not sell your personal information. We do not share your precise location with merchants; merchants see aggregate, anonymized deal statistics. Payments for subscriptions happen on our website via Stripe; we never store your card details.

2. What we collect

Account data: email, chosen handle/display name, optional profile photo and bio; password handled by our authentication provider (we never see or store plaintext passwords). Merchants additionally provide business name, address(es), phone, website, and category information — business info is public by design. Location data: (a) While using the app: your device location powers the nearby-deals feed and map. (b) Redemption check: when you tap Pop, your location at that moment is verified server-side against the deal's location and stored with the redemption record. (c) Background location (optional, off by default): if you enable proximity notifications, the app uses efficient background location (geofencing/significant-change) so we can alert you when a deal matching your preferences appears within your chosen radius. You can disable this anytime in Settings or your device's OS settings, and the app remains fully usable without it — you just won't receive proximity alerts. We store your most recent approximate location to route notifications; we do not maintain a history of your movements. [CONFIRMED 2026-07-15 (Phase 4 Batch 2): profiles.last_location + last_location_at are a single point, overwritten on each sync via set_last_location — there is no location-history table anywhere in the schema. The only other stored locations are per-redemption points (redemptions.unlocked_geo), which are disclosed in (b) above and are not a movement trail. Re-verify if any movement/history logging, geofence-event log, or location analytics is ever added — this claim then becomes false and this section must change.] Preferences & activity: deal categories/subcategories you select, notification radius, follows, Bubbles you share ("Blow"), redemptions ("Pops") and their timestamps/locations, blocked accounts. Device data: device type, OS version, app version, push notification token, and diagnostic logs (crashes, errors). Payments (web only): subscription purchases are processed by Stripe on our website. Stripe collects your payment details under its own privacy policy; we receive only subscription status, tier, and a customer reference — never card numbers.

3. How we use it

To operate the service (matching deals to your location and preferences, unlocking redemptions, delivering notifications you enabled); to enforce program rules (redemption caps, per-user limits, fraud and abuse prevention — including verifying you were at the deal location when you redeemed); to provide merchants aggregate statistics about their own deals (views, claims, confirmed redemptions — never your identity or precise location [CONFIRMED 2026-07-15 (Phase 4 Batch 2): redemptions RLS exposes rows only to the redeeming user ("users see own redemptions"), so merchants cannot read who redeemed. The sole merchant-visible figure is an aggregate count(*) from a SECURITY DEFINER helper (db/redeem_function_v0_2_3.sql) — no identity, no location. Re-verify when the merchant dashboard (screen 18) ships, since that is the surface most likely to want per-user detail.]); to communicate service messages; to improve the app via aggregate diagnostics; and to comply with law.

4. What we share — and what we never share

Never: we do not sell personal information; we do not share your precise location with merchants, advertisers, or data brokers; we do not use your data for third-party targeted advertising. [If ads are ever enabled for free tiers, this section MUST be revised first and users notified — house promos require no change; third-party ad networks do.] Service providers (processors) acting on our instructions: cloud database/hosting [Supabase], push delivery [Google Firebase Cloud Messaging], payment processing [Stripe], maps [Google Maps Platform], and web hosting [Vercel]. Each receives only what its function requires. Public by design: your handle, display name, profile photo, bio, follower counts, and deals you've publicly shared; merchant business profiles, locations, and live deals (including on our public website). Legal: we may disclose information if required by law, subpoena, or to protect rights, safety, or the integrity of the service. Business transfer: if Pop Buy is acquired or merged, data may transfer under this policy's protections; we will notify you of any successor's material changes.

5. Your choices & rights

Location permissions are controlled in-app and in your OS settings, per-permission (while-using vs. background). Push notifications can be disabled globally or per-category in Settings. You may edit profile data anytime. Account deletion is available in-app (Settings → Delete Account) and by request to [privacy@ popbuy domain]. Deletion is immediate and irreversible — not a scheduled purge. It removes your profile, preferences, follows, Bubbles you've shared, your Pops (including the location recorded with each redemption), your blocked list, your device/push tokens, and the photos you uploaded. If you own a merchant, deleting your account also deletes that business profile and its Bubbles — and, because those Bubbles cease to exist, the Pop records other people hold against them. We do not keep a de-identified copy. [DECISION for counsel — this sentence is written to match the shipped build (supabase/functions/delete_account), which deletes everything immediately with no legal/security/fraud-prevention retention carve-out. If a retention window is wanted (e.g., de-identified redemption records for fraud prevention, or a 30-day grace period), the deletion function must change first — this text must never promise retention we don't perform, or deletion we don't perform.] Depending on your jurisdiction (including California, Virginia, and others in the US, and the EU/UK if service expands there), you may have rights to access, correct, delete, or port your data, and to opt out of certain processing; requests to [privacy@ popbuy domain]. We honor these requests regardless of jurisdiction where feasible. We do not discriminate against users exercising privacy rights.

6. Children

Pop Buy is not directed to children under 13 and we do not knowingly collect their data. [DECISION: minimum age — 13 is the COPPA floor; many location-based apps set 16 or 18. Recommend 16+ given location features; discuss with counsel.] If we learn a user is under the minimum age, we delete the account.

7. Security & retention

Data is encrypted in transit; access is restricted by row-level security and least-privilege server functions; redemption codes are never exposed via public queries. No system is perfectly secure; we will notify affected users of breaches as required by law. We retain personal data while your account is active and as described in Section 5 thereafter; diagnostic logs are retained [90] days.

8. Changes

We'll post updates here and, for material changes, notify you in-app or by email before they take effect. Continued use after the effective date constitutes acceptance.

9. Contact

[LEGAL ENTITY] · [ADDRESS] · [privacy@ popbuy domain]

Founder checklist before this goes live

  1. Attorney review (state consumer-privacy statutes have registration/threshold nuances; also confirm CCPA applicability timeline).
  2. Fill every bracket. The two engineering claims were CONFIRMED against the build 2026-07-15 (§2 location: single overwritten last-location, no trail; §3: merchant analytics aggregate-only) — re-verify at submission, and whenever their noted triggers fire (any movement/history logging; the merchant dashboard shipping). §5 deletion now matches supabase/functions/delete_account exactly (immediate, irreversible, no retention carve-out) — if counsel wants a retention window, the function changes first.
  3. Minimum-age decision (Section 6).
  4. Matching in-app disclosures: App Store privacy "nutrition labels" and Play Data Safety form must match this document exactly — Claude Code generates both from this at submission time.
  5. Companion Terms of Service draft (separate document — request when ready; the 2015 ToS from the mocks folder is the starting reference).