Our Commitment to Privacy
POPINID is built around protecting your professional identity, not exploiting it. Three principles guide everything we do:
- We don't sell your data to advertisers or third parties — ever
- We don't use third-party tracking pixels (no Meta Pixel, no Google Ads tracking, no behavioral profiling)
- We collect only what's needed to provide the service
This isn't marketing copy. It's a contract with you.
Information We Collect
- Account information: email, hashed password, name, country
- Profile information: bio, links, country code, optional avatar
- Authentication data: from Google or LinkedIn (only if you sign in via OAuth)
- Usage data: aggregated link click counts (not individual user tracking)
- Support communications: messages you send us through the contact form
How We Use Your Information
- To create and maintain your POPINID profile
- To send transactional emails (signup confirmation, password resets)
- To improve the service through aggregated, anonymous analytics
- To respond to your support requests
We do NOT use it for: advertising profiles, behavioral targeting, sale to third parties, or surveillance.
Data Storage and Security
- Data stored on Supabase (PostgreSQL) with row-level security policies
- Passwords hashed using bcrypt (industry standard)
- HTTPS encryption for all data in transit
- Limited access to user data (only authorized POPINID team members)
- Cloudflare protection against attacks
Your Rights
You have full control over your data:
- Access: View your data anytime in your dashboard
- Edit: Update your profile, links, country, bio
- Export: Download your contact info via Save Contact (vCard); full data export coming in Phase 1.5
- Delete: Delete your account anytime — all data permanently removed within 30 days
Service Providers
To deliver POPINID, we work with carefully selected service providers:
- Cloud database provider — stores your account and profile information securely with row-level security policies
- Transactional email service — sends signup confirmations, password resets, and notifications
- Hosting and content delivery providers — serve the popin.id and popon.id websites globally with HTTPS encryption
- Authentication providers (optional) — when you choose to sign in with Google or LinkedIn, those services handle the authentication step only
All of our service providers are bound by data processing agreements that align with GDPR and Saudi PDPL standards. We share only the minimum data necessary for each provider to perform its function. We never share your data for advertising, profiling, or resale.
The POPINID App
Scanning business cards
When you scan a business card, the photo is sent once to Anthropic's Claude AI to read the name, job title, company, phone and email. We don't store the photo, and it isn't used to train AI models. Only the details you choose to save are kept, in your contacts. The app asks for your consent before your first scan.
Importing contacts from your phone
Only the contacts you tick are copied into your POPINID contacts (name, phone, email, company). We never read or upload your address book in the background, and we never contact anyone in it. You can edit or delete imported contacts at any time.
Camera and photos
The app uses your camera only when you scan a card, and your photos only when you pick a profile, cover or link picture.
Purchases in the iPhone app
In the iPhone app, Pro is bought through Apple's in-app purchase. Apple handles the payment. We only receive the subscription status (active or not, the plan and the renewal date) so we can turn Pro on. You can manage or cancel it in your Apple ID settings.
Payments
When you buy a paid plan or a short username, payments are handled by Tothiq AI Services & Solutions, which owns popin.id, through UPayments. You enter your card details on the UPayments page; they never reach POPINID.
We keep what we need for the purchase and for accounting: your name, email, the plan, the amount and currency, the payment status and its reference. We do not store card numbers.
AI and Search Engines
We allow major AI platforms (Claude, ChatGPT, Perplexity, Gemini) to index public profiles. This helps people find you when they ask AI-powered search assistants. Only PUBLIC profile information is indexed (name, bio, country, public links). Account information, passwords, and private settings are never exposed to AI crawlers.
Cookies
We use essential cookies for authentication (keeping you signed in). We do NOT use:
- Advertising cookies
- Behavioral tracking cookies
- Third-party analytics cookies
Children's Privacy
POPINID is meant for professionals and adults. We don't knowingly collect personal information from anyone under 16. If you're a parent or guardian and believe a child has shared data with us, tell us through the contact form and we'll remove it promptly.
International Users, GDPR, and PDPL
POPINID is built and operated from Kuwait and serves users in MENA and worldwide. We follow common-sense privacy practices aligned with GDPR-style rights (access, correction, deletion, portability where applicable) and respect obligations under Saudi Arabia's Personal Data Protection Law (PDPL) where they apply. If you have questions about how the law applies to you, we're happy to help — reach out through the contact form.
Changes to This Policy
When we update this policy, we'll change the "Last updated" date at the top and, for important changes, notify you by email or a notice in the product.
Questions?
Send us a message through our contact form.