Privacy Policy — Popsticks

Introduction

Brightened Pty Ltd, trading as Popsticks ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our household chore management application ("Service").

By using the Service, you consent to the data practices described in this policy.

1. Information We Collect

1.1 Information You Provide Directly

Account Information:

Name (first and last)
Email address
Password (stored encrypted by our authentication provider)

Household Information:

Household name
Invite codes (for joining households)
Household member names

Chore and Task Information:

Chore names and descriptions
Room and location data
Completion records and notes
Assignment and scheduling information
Completion history and statistics

1.2 Information Collected Automatically

Usage Information:

Screen views and navigation patterns
App interactions and feature usage
Time spent in the app
Platform type (web, iOS, Android)

Account Activity Information: We record technical details about your sessions — for example, when you last signed in, which version of the app you were using, and which release group of the installed app it came from. This helps us support the versions people are actually running and identify accounts that have become inactive.

Device Information:

Device type and model
Operating system and version
Browser type and version
IP address
Device identifiers (for analytics only)

Analytics Data: With your permission, we use Microsoft Clarity and Google Analytics (through Firebase) to understand how the app is used and where it can be improved — for example, which features people use and where they run into difficulty. In the installed iOS and Android apps, Microsoft Clarity also records sessions, which produces a visual replay of how you moved through the app. You can turn both off — see §6.5.

To help us improve Popsticks, we anonymously record how features are used.

Error and Crash Reporting: We use an error-reporting service to capture errors and crashes so that we can diagnose and fix them. A report includes technical information about the failure and the app and device it happened on — for example, the version of the app you were running. If you send us feedback through the in-app "Report a Bug" option, your message is included with that report.

2. How We Use Your Information

2.1 To Provide the Service

Create and manage your account
Store and sync your household and chore data
Enable collaboration with household members
Calculate assignment algorithms and scheduling
Display statistics and progress tracking
Send necessary service communications

2.2 To Improve the Service

Analyze usage patterns to improve features
Identify and fix bugs and errors
Develop new features based on user behavior
Optimize performance and user experience

2.3 For Analytics and Research

Understand how users interact with the app
Measure feature adoption and engagement
Generate aggregate statistics (anonymized)
Improve onboarding and user flows

2.4 For Security and Compliance

Detect and prevent fraud and abuse
Enforce our Terms of Service
Comply with legal obligations
Protect our rights and property
Investigate security incidents

2.5 Communications

Send service-related notifications
Respond to your support requests
Send important updates about the Service
Send Popsticks news and advice, which you can turn off at any time (see §6.4)

We will never sell your personal information to third parties.

3. How We Share Your Information

3.1 Within Your Household

Information you create (chores, completions, notes) is shared with all members of your household. This is necessary for the Service to function as a collaborative tool.

3.2 Service Providers and Other Companies

We share information with companies that help us run the Service. Three are named because their own terms ask us to name them; the rest are described by what they do for us.

Google Analytics (Google LLC) — only with your permission:

Purpose: Understanding how the app is used. In the installed apps it runs through Firebase; on the web it is loaded by Google Tag Manager
Data Shared: The usage information described in §1.2
Privacy Policy: https://policies.google.com/privacy · How Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites

Microsoft Clarity (Microsoft Corporation) — installed apps only, and only with your permission:

Purpose: Understanding how the app is used, including session recording
Data Shared: How you interact with the app, including session replays
Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement

Google reCAPTCHA (Google LLC) — web app only:

Purpose: Protecting sign-up and sign-in from automated abuse
Data Shared: Device and browser signals, IP address, and interaction data that Google uses to score whether a visitor is human. reCAPTCHA loads on every page of the web app, not only on the forms.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply

Everyone else, by what they do:

Our cloud provider — hosts the database, sign-in and our server functions. It holds your account information and everything you create in the app (see §8.1 for where)
Our web host — serves popsticks.app, and counts visits without cookies. It receives IP addresses, request details, page performance and visit counts
An error-reporting service — receives technical details of an error and of the app and device it happened on, and the message in any bug report you choose to send
An app update and push service — installed apps only. It delivers app updates and, if you turn on push notifications, relays them, including the names of the chores they mention
Apple's and Google's push services — only if you turn on push notifications. They receive a device token and the notification content
An email delivery service — sends account emails and, if they are on, Popsticks news. It receives your email address and the email
A subscription-management service — installed apps only, from when you open the Popsticks Plus screen. It receives your account ID, basic app and device information, and the purchase details the App Store or Google Play report. Card details stay with the store
AI Services — we use AI tools to maintain and improve Popsticks. As such, your information may be processed by services and tools we employ

3.3 Legal Requirements

We may disclose your information if required to:

Comply with legal obligations (court orders, subpoenas)
Protect our rights or property
Prevent fraud or security threats
Protect user safety
Investigate violations of our Terms of Service

3.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

3.5 Aggregate Data

We may share anonymized, aggregate statistics that do not identify individual users (e.g., "70% of users complete chores within 24 hours of due date").

4. Data Security

4.1 Security Measures

We implement reasonable security measures to protect your information:

Encryption: Data in transit uses HTTPS/TLS encryption
Authentication: secure password hashing by our authentication provider
Access Controls: Multi-tenant data isolation in Firestore
Security Rules: Server-side enforcement of data access permissions
Regular Updates: Dependencies and security patches kept current

4.2 Limitations

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You use the Service at your own risk.

4.3 Your Responsibilities

Keep your password secure and confidential
Use a strong, unique password
Log out of shared devices
Report suspected unauthorized access immediately

5. Data Retention

5.1 Active Accounts

We retain your information for as long as your account is active and as necessary to provide the Service.

5.2 Account Deletion

When you delete your account:

Your account, profile, preferences, statistics and push tokens are deleted immediately, and your authentication record with them
Any remaining personal information held in our own systems is deleted within 30 days
If you belong to a shared household, you choose at deletion whether to delete the chores and completion history you created, or keep them for the remaining members — in which case your name is removed and your past entries are shown as "Deleted User"
Aggregate, anonymized analytics data may be retained indefinitely
We may retain certain information as required by law (e.g., for tax or legal purposes)
Records held by the companies in §3.2 — session recordings, error reports and analytics events — are subject to each provider's own retention period and are not deleted by this process. You can ask us to request their deletion at support@popsticks.app

On leaving a household, completions visible to the household will be retained, to maintain household history. If you want that history removed, email support@popsticks.app.

5.3 Inactive Accounts

Free accounts may be permanently deleted after 12 months of inactivity. We will attempt to contact you via email before such a deletion but cannot be held liable for information loss if your account is deleted due to inactivity.

6. Your Rights and Choices

6.1 Access and Portability

You have the right to:

Access your personal information
Request a copy of your data in a portable format
Review what data we have collected about you

To request access: Contact us at support@popsticks.app

6.2 Correction and Update

You can update your information at any time:

Profile information: Via the Profile screen in the app
Chore data: Via the Chores section
Household information: Via Household Management

6.3 Deletion

You have the right to request deletion of your personal information:

In-app: Via the Profile screen → Delete Account
Email: Contact support@popsticks.app

We will comply with deletion requests within 30 days, subject to legal retention requirements.

6.4 Marketing Communications

In addition to service messages, which are sent to all users, we may occasionally send news and tips to help you use Popsticks better. Optional messages can be unsubscribed in settings or by using the link in the footer.

6.5 Analytics — Your Choices

We treat three kinds of data differently:

Error and crash reports are needed to keep the Service working, with identifiers removed.
Anonymous usage statistics are on by default. These help us to continue improving Popsticks, with identifying information removed. You are able to opt out.
Analytics can be turned off. We use industry-standard third-party analytics services to help us understand how features are used and how we can better serve you. You are offered a choice on sign-up, and you can change either choice at any time in Settings → Privacy.

Saying no does not affect your use of the Service. Your choices are kept with your account, so they apply wherever you sign in.

7. Cookies and Tracking Technologies

7.1 Cookies We Use

Essential Cookies:

Authentication session cookies (required)
App functionality and preferences

Analytics and Security Storage (web app):

Google Analytics, loaded by Google Tag Manager
Google reCAPTCHA (bot protection — a security measure rather than analytics)
Our web host's visit counter, which sets no cookies

Google Analytics and Google Tag Manager wait for your consent on popsticks.app — your answer to the cookie banner or, once you sign in, the choice kept with your account (§6.5) — and do not load unless you agree. ⚠️ Google reCAPTCHA and the visit counter load when the page loads, before you take any action: reCAPTCHA protects sign-up and sign-in from automated abuse, and the visit counter sets no cookies and only counts visits. §7.3 describes what you can do if you would prefer they did not run.

7.2 Third-Party Cookies

The companies in §3.2 may set their own cookies or equivalent browser storage. Refer to their privacy policies for details.

7.3 Your Choices

Web users can:

Manage cookies via browser settings
Use browser privacy/incognito mode
Install cookie-blocking or tracker-blocking extensions
Send a Global Privacy Control signal, which we honour where your browser sends one

Note: Blocking essential cookies will prevent the Service from functioning properly. Blocking the analytics storage described in §7.1 does not affect the Service.

Note on lawful basis: browser settings are a choice we offer, not the legal basis on which the analytics storage above operates. Google Analytics and Google Tag Manager run on your consent, given through the cookie banner or the choice kept with your account (§6.5). We rely on legitimate interests for security measures such as reCAPTCHA and for our web host's cookieless visit counts.

8. International Data Transfers

8.1 Where We Store Data

Your chore data, account record and completion history are stored in Google Cloud Platform's australia-southeast1 region — Sydney, Australia. Our Cloud Functions run in the same region.

Some of the companies in §3.2 operate outside Australia and receive data where they are — mostly the United States. That includes analytics, session recording, error reporting, app updates and push delivery, email delivery, subscription management and bot protection.

8.2 Cross-Border Transfers

If you use Popsticks from outside Australia, or where a company in §3.2 operates elsewhere, your information may be transferred to another country. Where the law requires a safeguard for that transfer, we rely on Standard Contractual Clauses or another mechanism the law allows.

9. Children's Privacy

9.1 Age Requirement

The Service is not intended for children under 13. We do not knowingly collect information from children under 13.

9.2 Parental Consent

If you are between 13 and 18, you must have parental consent to use the Service.

9.3 If We Learn of Child Data Collection

If we become aware that we have collected information from a child under 13 without parental consent, we will delete that information promptly.

10. Regional Privacy Rights

10.1 GDPR (European Union)

If you are in the EU, you have additional rights under GDPR:

Legal Basis for Processing:

Consent (for analytics)
Contract performance (to provide the Service)
Legitimate interests (to improve and secure the Service)

Your GDPR Rights:

Right to access your data
Right to rectification (correction)
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing
Right to withdraw consent
Right to lodge a complaint with a supervisory authority

Privacy Contact: support@popsticks.app

10.2 CCPA (California)

If you are a California resident, you have rights under CCPA:

Your CCPA Rights:

Right to know what personal information we collect
Right to know if we sell or disclose your information
Right to opt out of sale (we do not sell information)
Right to request deletion
Right to non-discrimination for exercising your rights

Categories of Information We Collect:

Identifiers (name, email)
Internet activity (usage data)
Device information

We do not sell personal information.

To exercise your rights: Contact support@popsticks.app

10.3 Australia

Brightened Pty Ltd is an Australian company and this Service is operated from Western Australia. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and your data is stored in Australia (§8.1).

You may complain to us at support@popsticks.app, and if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Governing law: this Privacy Policy is governed by the laws of Western Australia, Australia, consistent with §14.2 of our Terms of Service.

10.4 Other Jurisdictions

We comply with applicable data protection laws in other jurisdictions. Contact us to learn about your specific rights.

11. Changes to This Privacy Policy

11.1 Updates

We may update this Privacy Policy from time to time to reflect:

Changes in our data practices
Changes in legal requirements
New features or services

11.2 Notification

When we make changes, we will post the updated policy in the app and update the "Last Updated" date at the top. We encourage you to review this policy periodically. Your continued use of the Service after an update constitutes acceptance of the revised policy.

11.3 Your Acceptance

Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: support@popsticks.app Website: https://popsticks.app Response Time: We aim to respond within 7 business days

For GDPR-related requests: support@popsticks.app For CCPA-related requests: support@popsticks.app

13. Third-Party Links

The Service may contain links to third-party websites or services (e.g., Grocy for import). We are not responsible for the privacy practices of these third parties. Please review their privacy policies before providing them with information.

14. Data Breach Notification

In the event of a data breach that is likely to affect your personal information, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of it, where the law requires that — including the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and any applicable EU or UK supervisory authority
Notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms
Describe the nature of the breach and explain the potential impact
Provide steps you can take to protect yourself

Acceptance

By using the Popsticks Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described.

Version: 1.1 Effective Date: June 13, 2026

Note: This document mirrors the version shown inside the Popsticks app. For any questions, contact support@popsticks.app.