The operator details below remain placeholders. The policy requires final operator confirmation and legal review before public release.
Web login cookies and agreement records
The web portal uses a first-party HttpOnly, Secure, SameSite session cookie to authenticate you. Authentication tokens remain on the server and are not stored in browser localStorage or sessionStorage. Standard sessions expire after 30 minutes without activity or 12 hours in total. If you choose Remember me, the session can last up to 7 days. Signing out invalidates the session cookie.
We record the Terms version you accept, the Privacy Policy version presented, the platform and the acceptance time. Terms acceptance is required for account features. It does not give consent for marketing or optional tracking. You can read policy documents, sign out, contact support and request account deletion without accepting updated Terms.
We use authentication cookies only for the login service you request. We do not use these cookies for advertising or analytics. Native apps use protected device storage for authentication instead of this web session cookie.
1. Controller and contact
[FULL LEGAL ENTITY NAME], company number [UK COMPANY NUMBER, IF APPLICABLE], of [REGISTERED POSTAL ADDRESS, UNITED KINGDOM], is controller of the information in this policy. Contact privacy@showmeyourpopup.com or [CONTACT TELEPHONE NUMBER].
This policy applies worldwide and should be read with short notices shown when requesting location, notification or photo access.
2. Information and sources
You provide: email, authentication credentials, date of birth, name, town or city, account type, settings, support messages and legal-policy acceptance records.
Issue and safety reports: selected category and subtype, description, affected screen, vendor, popup or location, reproduction steps, error text, requested outcome, submission time, authenticated account ID and email. We tell users not to include passwords, payment details, health information or other sensitive information, but a report may contain information the reporter chooses to provide about themselves or another person.
Vendor and public content includes business identity, description, categories, services, contact details, websites and social links, logos/images, popup locations and coordinates, dates, trading times, recurrence, check-in/out status and plan tier. Material submitted to a public profile or listing is visible to others and may be reshared outside our control.
Location includes places or map points searched or chosen; approximate or precise foreground device location, with permission, for nearby results, distances, placement or check-in; and a notification-area coordinate and update time. If separately enabled, the operating system supplies background location after significant movement so saved-vendor alerts follow your area.
Device and usage data includes Supabase user/authentication IDs, Expo push token, platform, notification preferences and delivery records, IP address, security/server logs, timestamps, app version and diagnostics generated by infrastructure. We do not use advertising trackers or sell personal information.
If a vendor selects a logo, we receive that selected image, not the rest of the library. Providers also supply information needed for authentication, notifications, maps, abuse prevention and fault diagnosis.
3. Purposes and lawful bases
Contract: registration, authentication, profiles, searches, maps, favourites, listings, vendor tools, check-ins, alerts, support, plans and enforcement. Requested account and vendor details are necessary to provide these services.
Consent: device location, background location, notifications or photos where consent is appropriate. Permissions are optional and withdrawable in device or App settings, but affected features stop. Withdrawal does not affect earlier lawful processing.
Legitimate interests: receiving, triaging and responding to reports; moderating listings and accounts; protecting users and Group Entities; security, fraud and misuse prevention; maintenance, troubleshooting and reliability; evidence of acceptance; non-privacy enquiries; and legal claims, balanced against your rights. Legal obligation or vital interests: tax, accounting, consumer, privacy and lawful-request duties, legal process, safeguarding where law requires it, and protection of life or safety in an emergency.
We do not use personal information for third-party advertising or make solely automated decisions producing legal or similarly significant effects.
4. Public information
Public vendor profiles and active listings may show chosen business content, logo, location, coordinates, schedule, live status and links. Do not publish a home address, private details, or another person's information without authority. Consumer profiles, birth dates, favourites, notification areas and push tokens are not intended to be public.
5. Recipients
We disclose only as needed to Supabase (authentication, database, storage, functions and logs); Resend/Plus Five Five, Inc. (transmission and delivery logging for support-report emails); our support mailbox provider (receipt, storage and reply); Expo and Apple Push Notification service or Firebase Cloud Messaging (push delivery); Google Maps Platform and device mapping/location providers; Apple and Google (OS and store services); and appointed hosting, security, support, legal, accounting and insurance providers.
We may share with a Group Entity supporting the same purposes; courts, regulators or law enforcement where required; parties protecting rights, safety and security; or a buyer, investor or successor in a corporate transaction under appropriate safeguards.
Processors act under contract and may not use data for unrelated purposes. Some platforms independently control information under their own notices. We do not sell or rent personal information or share it for cross-context behavioural advertising.
6. UK hosting and international transfers
Our primary application database is intended to be hosted in the UK. Global use and providers for maps, stores, notifications, email delivery, support, resilience or corporate operations can involve other countries. In particular, support-report email addresses, account identifiers, message content and metadata are transmitted through Resend, whose documented primary processing operations take place in the United States. UK hosting does not mean all processing stays in the UK.
For UK restricted transfers we use a lawful mechanism such as adequacy regulations, an applicable UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another UK GDPR safeguard, plus a data-protection test where required. Contact us for safeguard information. EEA transfers use an applicable adequacy decision, Standard Contractual Clauses or other EU GDPR mechanism.
7. Retention
Account, profile, preference and active vendor data is kept while the account is open. After deletion we delete or anonymise associated data within 30 days where reasonably practicable, subject to backups and lawful exceptions. Public listings are removed or de-identified unless law requires retention.
We retain legal-acceptance and account-security records up to 6 years after closure; payment/tax records as law requires; support reports, related emails and complaint records up to 3 years after closure or last action; notification deliveries and precise notification-area coordinates only while needed for alerts and troubleshooting; and routine technical logs up to 90 days unless longer is reasonably needed for security, fraud, safeguarding, disputes or claims. Email providers may retain delivery metadata and message content under their own documented retention and deletion cycles.
Encrypted backups may persist for a limited rolling period. Legal holds or claims may require longer restricted retention. These periods must be aligned with implemented deletion and backup settings before release.
8. Security
Measures appropriate to risk include encrypted transport, protected session storage on supported devices, access controls, database row-level security, provider review, backups and monitoring. No internet service is completely secure; notify us promptly of suspected compromise.
9. Choices and rights
Depending on location, you may have rights to information, access, correction, deletion, restriction, objection, portability, consent withdrawal and review of certain automated decisions. Contact privacy@showmeyourpopup.com. We may verify identity and refuse or charge only where law permits; lawful authorised agents may submit requests.
Change profile and alert settings in the App and permissions in device settings. Delete your account through Settings > Delete account, or request deletion at privacy@showmeyourpopup.com. Deleting the App does not delete the account, and deleting an account does not automatically cancel an App Store or Google Play subscription.
UK users may complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113; EEA users to their local supervisory authority; and others to their local regulator. You will not be discriminated against for exercising a right.
10. Children
The Service is not directed to children under 13 and we do not knowingly collect their information. Users 13–17 should read this with a parent or guardian. Vendor accounts require age 18 or over. We use high-privacy defaults and do not target advertising to children.
A parent or guardian who believes a child under 13 provided information, or has a lawful request concerning a child's data, should contact privacy@showmeyourpopup.com. We will investigate and delete data collected contrary to our age rule.
11. International and regional rights
We honour non-waivable local privacy rights. California and other US-state residents may have rights to know, access, correct, delete, obtain a portable copy, and opt out of sale, cross-context behavioural advertising or qualifying profiling. We do not currently perform those opt-out activities.
Where local law requires a representative, extra notice, consent, contract or transfer safeguard, it applies in addition. UK law does not replace mandatory privacy law in a user's country.
12. Changes and questions
We may update this policy for Service, provider or legal changes. We will show the new version/date and give prominent notice or seek renewed consent where required for material changes. App Store and Google Play privacy/data-safety declarations must be kept consistent with this policy and the App's actual data practices.
Send questions, complaints and requests to privacy@showmeyourpopup.com or by post to [FULL LEGAL ENTITY NAME], [REGISTERED POSTAL ADDRESS, UNITED KINGDOM].