Privacy policy · Poppins

Jersey Dev Inc. runs Poppins (“the app”, “we”). This policy covers the iPhone app, this website, and the browser extension. Questions go to info@jerseydev.io.

The short version

We collect what the household puts in, so the app can plan around it.
We don’t sell it, rent it, or use it for advertising.
Some of it is processed by the companies listed below, only to do the job it was given to.
Ask, and we delete it.

What we collect

Your account. Your name and email address, and an identifier from the sign-in you chose (Google, Apple, or an email and password, all through Firebase Authentication). We never see a Google or Apple password.

The household’s own information. The members of the household, including people without an account, such as children, whom an adult adds by name. Recipes and the recipe box, meal plans, ratings, food preferences, and dietary constraints such as allergies. Tasks, events, notes, grocery lists and the lines you add to them yourself, shopping requests, and the messages you send the assistant. A record of what the assistant did and who asked for it, shown in Activity to the household members who can see what it changed.

Photos you choose to send. A cookbook page, a flyer, a fridge. Photos sent to read a recipe or an event are read and then discarded; what’s kept is the text you confirm. Files you attach to a task are stored with the task. Recipe pictures are stored at web addresses that aren’t access-controlled, so anyone with the exact address could open one.

Your calendar, if you allow it. With calendar permission, the app reads events from the calendars you pick so the household can see them. It doesn’t write to your phone’s calendar.

A calendar account, if you connect one. You can also connect a Google Calendar account, which lets the app read the calendars you choose without your phone being open — so an event somebody adds still reaches the household’s screens. You sign in at Google and grant permission to see your list of calendars and read their events; the app stores that permission encrypted, along with the address of the account it belongs to, for as long as the account is connected. The list of calendars itself isn’t stored. The permission also allows creating events, which the app asks for now so you don’t have to grant it again later; it does not create, change or delete anything on your calendar today, and this policy will say so before that changes. Disconnecting hands the permission back to Google, and you can also withdraw it yourself from your Google account at any time.

Your email, if you connect it. If you connect a Gmail, Outlook or Yahoo Mail account, the app reads messages to find plans in them, such as a booking or a school notice. Message bodies are not stored; what’s kept is what was found. It reads your inbox only, and never marks a message read, moves it or changes it. You can disconnect at any time in Settings.

How the app gets in, which differs by provider. For Gmail and Outlook you sign in at Google or Microsoft and grant permission to read mail, and that is all the app ever holds. Yahoo offers no such permission for mail, so connecting it means giving the app an app password you generate in Yahoo Account Security. That is a credential which opens the mailbox directly rather than a permission limited to reading, and the app stores it encrypted for as long as the account is connected. Disconnecting makes the app forget it; deleting it in Yahoo Account Security is what ends it for good.

Location, if you give it. A ZIP code for the household’s weather, and, when you ask what’s on nearby, your phone’s current town. We don’t track location in the background.

Payments. Stripe handles subscriptions, the monthly amount you choose, and any one-time purchase of extra credits. We see the name and billing details Stripe returns, never the full card number.

Device and usage. A push notification token for your phone, error reports when something crashes, and a record of the app’s own actions and of usage that counts toward the household’s plan.

A copy on your phone. So the grocery list still works in a shop with no signal, the app keeps a copy of the week’s dinner plan, its grocery list, any occasion’s own list, and what home draws — the next couple of days in full, a count for each day a fortnight out, and the titles of your oldest late tasks — along with anything you check off while offline. Each of those copies is discarded a week after it was last fetched; a tick waiting to go out is kept until it has been sent. Beside them it keeps what it needs before it can reach us at all, which is whose app this is: your name, the address you signed in with, your language, whether you’re an admin, any notes on you — food preferences, allergies, habits — and the name, time zone, ZIP and town of each household you belong to, along with what its founder said isn’t working at home. That part isn’t dropped for age, because without it an app opened with no signal can’t tell “you’re in a household” from “you aren’t”, and shows nothing. All of it sits in the app’s own storage and goes nowhere else, and all of it is deleted when you sign out, when you switch household, and on the first launch after a week of not opening the app. It is also why the app asks our server once a minute whether it can be reached, while it is open.

This website. If you use the contact form, your name, email address and message are sent to us by email, along with which version of the home page you saw. To learn which pages people read and what brings them to get in touch, the site counts visits and clicks with Mixpanel. That records the pages viewed and their addresses (including any campaign tags in them), the buttons pressed, the page you came from, which version of the home page you saw, and your browser, operating system, device type and screen size, under a random identifier kept in your browser’s local storage. It sets no cookies, doesn’t store your IP address, and never receives what you type into the contact form. If your browser sends a Global Privacy Control signal, or blocks local storage, the site measures nothing.

How it’s used

To run the service: plan meals, build lists, send the reminders and notifications you’ve turned on, answer the assistant’s questions, bill the subscription, and fix what breaks. Approvals, ratings and feedback shape future plans for your household only. We don’t use your information to train models.

What the dinner plan is told about your calendar. So that a night with something on gets a dinner that fits it, planning is given how much of each evening is committed and when the last thing starts — the times only. It is never given an event’s title, description or location, and that holds for a private or masked event too: its times count towards the night being busy, and its words are not read. The reason shown beside each dinner says the evening is short, never what is on.

Who else handles it

These companies process data on our behalf, for the purpose listed:

Google Cloud: hosting, the database, file storage, and the language models that run the assistant (Anthropic’s Claude and Google’s Gemini, both through Vertex AI).
Google Firebase: sign-in.
Stripe: payments.
Resend: sending email, such as an invitation to a household.
Expo: delivering push notifications.
SearchApi: product, recipe and event searches. It receives the search terms, not who asked.
The US National Weather Service: forecasts. It receives an approximate location.
GlitchTip: error reports.
Mixpanel: counting visits and clicks on this website.
Google: reading the Gmail account and the Google Calendar account you connect, under your authorization.
Microsoft: reading the Outlook or Microsoft 365 account you connect, under your authorization.
Yahoo: reading the Yahoo Mail account you connect, with the app password you give the app.
Instacart: putting the grocery list into a cart, if you connect it, under your authorization.
An AI assistant you connect: if you connect the household to Claude, or to another app that speaks the Model Context Protocol, that app can read and change anything you can yourself — the week’s dinners and the grocery list it is built to ask about, and also your tasks, your calendar, and who is in the household — under your authorization, and it keeps whatever it is told to keep. In practice this means Anthropic. Connecting is something a member does deliberately, and nothing is connected until they do.

We share information outside this list only if the law requires it.

Connecting one of those assistants sets a single cookie in your browser, for ten minutes, on the address it is connecting to. It holds a random value and nothing about you; it is there so the sign-in that comes back can be matched to the browser that started it. Nothing else in the app uses cookies.

Google user data

Poppins’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to find plans for your household, and Google Calendar data only to show and plan around the household’s events. Neither is used for advertising, neither is transferred to anyone except as needed to provide that feature, neither is used to train generalised artificial-intelligence or machine-learning models, and neither is read by people except with your permission, for security, or as the law requires.

Who can see what

Most of what a household adds is visible to the household. Some things are private to the person who made them: a chat with the assistant, and events and tasks marked private. Household admins can add and remove members.

Keeping and deleting

We keep the household’s information while the household uses the app. An admin can remove a member, and when they do:

The tasks, events, shopping requests, projects and tags the member made pass to the admin who removed them, or to a member that admin names. That includes ones marked private, which the new owner can then see.
What they wrote to the household, such as messages, ratings and feedback, stays with it. Their private chats with the assistant are kept but can no longer be opened by anyone, except a chat preparing for an event, which passes to the next member who prepares for that event. For an event they had kept private, that is whoever the event passed to.
Their food and shopping preferences, allergies included, become the whole household’s, so plans and searches keep honouring them until someone edits or removes them.
A shopping service they connected, such as Instacart, stays connected for the household until someone in the household disconnects it. Disconnecting here doesn’t revoke it with the service itself; that is done in their account there.
The address of a mailbox they connected is kept after it stops being read, whichever provider it was with. For a Gmail account we also can’t delete it on request, because Google limits how many accounts the app may ever connect and counts each one for good.
A mailbox they connected stops being read either way. For Gmail the app also gives its access back to Google. Microsoft offers no way to do that, so for an Outlook account the app only forgets its own access — remove the app in your Microsoft account to clear it there too. For a Yahoo account the app forgets the app password it was given; delete that password in Yahoo Account Security to be sure nothing holds it.
A calendar account they connected stops being read, and the app gives its access back to Google. The address of the account is kept, as a mailbox address is.

You can delete your own account in the app, under Settings → Account. It happens at once and can’t be undone, and nothing you made passes to anyone else. Your sign-in is deleted, and in every household you belong to, so is what you made there: your tasks and the files attached to them, your events, shopping requests, projects and tags, your chats with the assistant, your food and shopping preferences, and a shopping service you connected, such as Instacart (remove the app in your account there too, since disconnecting here doesn’t revoke it). So are the lines in the household’s Activity about you, done for you, or about what you made. What was the household’s all along stays with it without your name on it, such as recipes you added, your ratings and feedback, messages and options you added to other people’s shopping requests, messages and files you added to other people’s tasks, nights you were down to cook and notes on the week. A mailbox or a calendar account you connected stops being read and is treated as it is for a removed member, above: its address is kept, the app gives its access back to Google where it can, and the same steps with Microsoft and Yahoo apply. If you are the only admin of a household, the household itself is deleted, for everyone in it: its subscription is cancelled, and everything in it goes, including the photos on its recipes, the files attached to its tasks and the addresses of any mailboxes or calendar accounts connected there. The app gives back the access each of those granted it before deleting them. Stripe keeps its own record of past payments.

Write to us to delete anything the app doesn’t delete itself, and we will, apart from the billing records the law requires us to keep and a connected Gmail address in a household that still exists, for the reason above. Database backups, and deleted photos and attachments, are kept for seven days, so a deletion reaches them within a week.

Children

The app is for adults running a household. Children don’t have accounts. A parent may add a child’s name and food preferences so the household’s plans account for them, and can edit or remove those preferences at any time. One the app learned rather than one you typed is kept, marked as removed, so it isn’t suggested again; write to us to have it erased. Removing a child from the household leaves their food preferences in place as the household’s own until someone removes them, so an allergy isn’t dropped by accident.

Security

Data is encrypted in transit and at rest, every request is checked against the household it belongs to, and connected accounts’ tokens are stored encrypted. No system is perfectly secure; if something goes wrong that affects you, we’ll tell you.

Changes

If this policy changes in a way that matters, we’ll email account holders before it applies. The date at the top says when it last changed.