Privacy policy

Last updated: 25 Oct 2026

This policy covers the PopPond app for iPhone, iPad and Android, version 1.0.10, and the website poppond.com. PopPond is made by Waseem Sayegh, a sole developer in the United Arab Emirates. "We" and "us" in this policy mean him.

The short version

  • PopPond has no accounts, no sign-up, and nowhere to type a name or email address. It shows no ads.
  • The app sends usage events to PostHog so we can see what gets used and what breaks. It may also record what appears on the screen while the app is open, so we can see where families get stuck.
  • It sends a smaller set of events to Meta and TikTok to measure PopPond's own ads on their platforms. On iPhone and iPad they get your device's advertising identifier only if you allow tracking. On Android they never get the advertising ID.
  • Google Firebase lets us send notifications and change some settings without a new version of the app. Google Analytics for Firebase measures which of our Google ads lead to a subscription; it is not used to personalize ads.
  • None of this carries a name or email address. It is tied to random codes and device identifiers, which still count as personal data under laws such as the GDPR.

What the app collects

  • A random install identifier, created the first time the app opens. Deleting the app and installing it again creates a new one.
  • Usage events, such as screens and cards viewed, words played, books opened and finished (with the book's name), dialect and language changes, the subscription page opened, prompts shown and answered, links followed, the app opening and closing, how long a book took, and three milestones: 10 words heard in one session, a second day of use, and three days of use in the first week. On iPhone and iPad the app also records when the screen is tapped quickly several times in one spot, with the screen's name and the tap position.
  • Screen recordings: about one screenshot a second of the app's own screens while the app is open, and where the screen was touched. They show what is on screen, such as books, words, pictures and the subscription page with its price. Anything typed into a text field is hidden, and the app has no text field. A recording carries the random install identifier and no name or email address, and PostHog keeps it for 30 days. A parent can turn screen recording off in the app's Settings, under Privacy.
  • Purchase details from the app store: the subscription product, its price and currency, whether a free trial or a code applied, whether the purchase was real or a test, and the store's transaction ids. On iPhone and iPad that includes Apple's original transaction id, which stays the same across renewals. On Android it is Google Play's order id, plus a one-way hash of the purchase token, so we can match a purchase without ever holding the token. We never see card or payment details. Apple and Google handle payment.
  • Your subscription status: never subscribed, active, canceling, or lapsed.
  • Device and app details such as device model, operating system and version, app version, screen size, language and region settings, time zone, and whether the device is on Wi-Fi or mobile data.
  • Error reports, with the error message and the place in the app's code where it happened.
  • Your IP address, which every internet request carries. What each company does with it is below.

The app does not collect names, email addresses, phone numbers, contacts, photos, location from the device's location services, or anything typed. It has no text field, and it never uses the camera or microphone.

Who receives it, and why

PostHog, for usage analytics

PostHog receives the install identifier, usage events, purchase details, subscription status, device and app details, error reports, and the IP address. It also receives the screen recordings described above. We use it to see which books and features get used, where the app breaks, and whether the subscription page works. PostHog keeps one record for each install, tied to the random install identifier. It holds the dialect and language chosen, the store's country, the app version, the subscription status and the dates a subscription began or lapsed. For installs that came from an ad or a link, it also holds which campaign they came from. PostHog processes this data in the EU (Frankfurt). When an event arrives, PostHog works out the country from the IP address, and nothing more precise than the country, and stores that country with the event and with the install's record. A setting in our PostHog project then discards the IP address.

Google Firebase, for notifications, remote settings and ad measurement

The app uses three Firebase services from Google: Cloud Messaging, so that we can send notifications; Remote Config, so that we can change some settings without a new version of the app, for example to ask you to update an old version; and Google Analytics for Firebase, so that our Google ads can measure which of them lead to a subscription. When the app starts, Firebase receives an installation ID and a messaging token created for this install of the app, the app's version, the device's platform and language, and the IP address of the connection. Google Analytics for Firebase receives a random identifier for this install, the device model, operating system and language, the app's version, the country Google works out from the connection, where the app was installed from (for example Google Play), when the app was first opened, which screens are viewed in the app, each session and how long the app is in use, and three of our events: a free trial started, a subscription bought and the first paid period after a trial, each with the subscription's product, the store's transaction id and, where the app knows them, the subscription's price and currency. On Android it never reads the advertising ID or the Android ID. On iPhone and iPad it never reads the device's vendor identifier or the advertising identifier. It is not used to personalize ads. It is switched off on our own test devices. Firebase and Google Analytics receive no name, email address or account, and nothing else about what your child does in the app beyond what is listed here.

Notifications. On iPhone and iPad, the app can deliver notifications quietly to Notification Center, without sound or banners, until you choose whether to allow them. On Android 13 and later, nothing is shown unless you allow notifications. On Android 12 and earlier, notifications are on unless you turn them off in your phone's settings. You can turn notifications off at any time in your phone's settings. There are no in-app messages.

Meta and TikTok, for ad measurement

PopPond shows no ads. We pay Meta and TikTok to show PopPond's ads on their platforms, and the app includes their measurement software so we can tell whether those ads lead to installs, use and subscriptions. The software runs on every install and starts a few seconds after the app opens. Nothing in the app turns it on or off.

It tells each company that the app was installed and opened, and sends ten of our events: a book opened (with the book's name), a book finished, the subscription page shown, the subscription page opened on purpose, Subscribe tapped (with the product, its price and currency, and whether the purchase would be real or a test), a free trial started, a subscription bought (with price and currency), and the three milestones above. Each event also names the chosen dialect. With a free trial started and with a subscription bought, each company also receives the store's transaction details: the store's transaction id; on iPhone and iPad, Apple's original transaction id, which stays the same across renewals; on Android, Google Play's order id and a one-way hash of the purchase token, so a purchase can be matched without the token itself ever leaving the device; and whether the purchase was real or a test. With a free trial started, they also receive the subscription's price after the trial, as the trial's predicted value. None of these details names you or your child.

Both companies also receive device details, including the mobile carrier, and IP addresses. Each keeps its own random identifier for the install and logs some events of its own, such as launches and sessions, and Meta may also record the purchase itself. Their software can send them its own error reports. On iPhone and iPad, TikTok also receives the device's vendor identifier, a code Apple gives each app maker for a device. On Android, both receive the install referrer, a short text Google Play hands the app at install to say where the install came from, and with each purchase, Google Play's order id.

On iPhone and iPad, after the first finished book, the app explains Apple's tracking prompt on one short screen and then shows the prompt once. If you allow tracking, Meta and TikTok also receive the device's advertising identifier. If you don't allow it, or haven't answered yet, TikTok receives nothing on iOS 17 and later because Apple blocks the connection, and Meta still receives the events and device details without the advertising identifier. On iOS 15 and 16, both receive them without the identifier. You can change your answer at any time in Settings > Privacy & Security > Tracking.

On Android there is no prompt. The app does not let Meta or TikTok read the advertising ID or use Android's Privacy Sandbox ad features.

Meta and TikTok process this data on their own servers under their own privacy policies. If you have a Meta or TikTok account, its settings for activity from other apps and websites let you see and disconnect what businesses such as PopPond send.

Apple and Google

Apple and Google run the app stores. They handle purchases, restores, review prompts and updates under their own policies. On iPhone and iPad the app asks the App Store whether a newer version exists; the request names the app and your region's country, not you. On Android, updates and the install referrer come from Google Play.

PopPond asks Apple whether the app was installed from an Apple Search Ads ad. If it was, Apple tells us the campaign, ad group and keyword identifiers for that ad. These identifiers do not identify you, your child or your device, and we use them only to measure which ads bring families to PopPond. This does not use the advertising identifier and does not need tracking permission.

If you install PopPond on Android, Google Play tells the app which link or campaign led to the install, for example a link shared from the app. We record this with our usage analytics to understand how families find PopPond.

When an ad in another app or on a website leads to a PopPond install, Apple sends us a copy of the report it sends to that ad network. The report contains no information about you, your child or your device.

poppond.com

Each time the app opens, it downloads a small file from poppond.com with the current links to our social and store pages. The request carries no identifier. Cloudflare, which hosts poppond.com, sees its IP address, as with any web request.

We do not sell data. What the Meta and TikTok section describes goes to them for ad measurement.

The website

poppond.com has no analytics, no ad pixels, and no third-party scripts, fonts or embeds. It sets one cookie, pp_lang, only when you choose a language, so the site opens in that language next time. The cookie lasts one year. Cloudflare hosts the site and processes each visit's IP address and browser details to serve it, and may set a short-lived security cookie to filter automated traffic.

Links to the App Store, Google Play, Instagram, TikTok, YouTube and LinkedIn take you to those companies, and their policies apply from there. They can see that you came from poppond.com. Our App Store and Google Play links also carry a short label naming which of our links was used, such as tiktok and bio, so each store can count the installs that link produced. The label says nothing about you. On Android, Google Play passes it to the app as part of the install referrer.

If you email us at support [at] poppond.com, we receive your message, your email address and anything you choose to include. Our mailbox is hosted by Zoho Mail. We use these details only to answer you.

Children

PopPond is used by young children and by adults starting Arabic. The app asks no age and treats every install the same way, so everything in this policy applies to every install, including a child's.

There are no accounts, no chat, and no way for another person to reach a child through the app. Notifications, when we send them, come only from us.

A grown-up check, a short arithmetic question, comes before a purchase can start, before Settings opens, and before any link leaves the app. One exception today: on iPhone and iPad, the Update button in the update prompt opens the App Store directly. Tapping a book that isn't unlocked opens the subscription page, and buying from there needs the grown-up check.

What stays on your device

The app keeps its settings on the device: dialect and language, library view, how often it has opened, which prompts were shown, word and day counters, the dates of active days, subscription state, a copy of the links file, and the identifiers and queued events of the measurement and messaging software. Deleting the app removes all of it, and on Android so does Clear data. Android never backs it up or moves it to a new phone. On iPhone and iPad, device and iCloud backups include the app's settings and the Meta and TikTok software's data, but not PostHog's, so a restored device gets a new install identifier. Purchases stay with your Apple or Google account and can be restored.

How long data is kept

  • On your device, until you delete the app.
  • PostHog keeps only the country worked out from the IP address, then discards the address.
  • PostHog, Google Firebase, Meta and TikTok keep what they receive for the periods set by their own rules and our account settings with them.
  • The pp_lang cookie lasts one year.
  • Support messages are kept only as long as it takes to answer.

Where data is processed

PostHog processes app events in the EU. Meta, TikTok, Google (including Firebase), Cloudflare and Zoho Mail (Zoho Corporation) process data in the United States and other countries.

Your choices

  • On iPhone and iPad, allow or refuse tracking in Settings > Privacy & Security > Tracking. Refusing stops the advertising identifier going to Meta and TikTok, and on iOS 17 and later stops TikTok receiving anything.
  • Deleting the app erases what it stored on the device. Installing it again starts a new install identifier.
  • The app has no switch for analytics or ad measurement. You can turn notifications off in your phone's settings.
  • For questions or a deletion request, email support [at] poppond.com. The records above carry no name or email address, and the app doesn't show its install identifier, so we usually can't find yours from a message. We will tell you what we can do.

Changes

When what the app or the website does changes, we update this page and the date at the top.

Company policies

Each company's own privacy policy: