Privacy Policy

1. About Leaptory and Pop

Pop is a low-pressure social signal application operated by Leaptory Tech Limited, a private company limited by shares incorporated under the laws of Hong Kong, with its registered office in Hong Kong S.A.R.

2. Data Controller and Contact

Leaptory Tech Limited acts as the data controller for personal data collected through the Services. For all privacy inquiries: info@leaptory.com.

3. Personal Data We Collect

Phone number (mandatory), email (optional), display name, avatar, profile fields (bio, MBTI, date of birth, location label as text, interests, links), Pop bubble content, Timetable schedules, direct messages, reactions, friend relationships, hashed phone contacts (only when you opt in), server-issued user UUID, push tokens, session metadata, server access logs, crash reports.

We do not collect: GPS, contact names, browser history, payment data, sensitive personal data, or third-party advertising identifiers (IDFA, AAID).

4. Lawful Basis for Processing

Performance of contract, legitimate interests, consent, legal obligation, vital interests — as required by GDPR, UK GDPR, PDPO, and other applicable laws.

5. How We Use Personal Data

To operate, secure, and improve the Services; deliver Pops and notifications; match friends; prevent abuse; comply with law. We do not engage in behavioral advertising, do not sell personal data, do not train AI models with your data, and do not track you across other apps.

6. How We Share Personal Data

We do not sell your personal data. We share with limited service providers (Apple APNS, Google FCM, Fly.io, Supabase, Sentry, Resend, Twilio Verify), other users (only what you choose to share), legal authorities when required, and in the context of business transactions.

7. Cross-Border Data Transfers

Primary servers in Tokyo, Japan. Transfers across jurisdictions rely on Standard Contractual Clauses, the UK IDTA, and other lawful safeguards.

8. Data Retention

Active account data retained for the duration of your account. After deletion: profile/Pops/messages/friends removed immediately; push log 14 days; access logs 30 days; crash reports 30 days; backups up to 30 days; deletion audit trail 7 years; aggregated statistics indefinite.

9. Security

TLS 1.2+, encryption at rest, bcrypt password hashing, refresh-token rotation with reuse detection, multi-factor authentication for sensitive operations, need-to-know access. Report incidents to info@leaptory.com.

10. Your Rights

Access, correction, deletion, restriction, objection, portability, consent withdrawal, complaint to Hong Kong's Privacy Commissioner for Personal Data (PCPD) or your local data protection authority. Exercise via info@leaptory.com.

11. California Privacy Rights (CCPA / CPRA)

California residents: right to know, delete, correct, opt out of sale/sharing (we do neither), limit sensitive personal information, and non-discrimination. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

12. Children

Not directed to users under 13 (or higher minimum age where applicable). We do not knowingly collect personal data from children below the applicable minimum age.

13. Apple App Store and Google Play Disclosures

iOS Privacy Manifest and Google Play Data Safety form match the categories in Section 3. Pop does not use App Tracking Transparency and does not track across other apps or websites.

14. Changes to This Policy

Material changes communicated via in-app notification or email at least 7 days before they take effect.

15. Contact

info@leaptory.com · Leaptory Tech Limited, Hong Kong S.A.R.

16. Language and Authoritative Version

The English version is the authoritative and legally binding version. If there is any conflict, ambiguity, or discrepancy between the English version and any translation, the English version shall prevail in all respects.