Privacy
Your visit, your choice.
Mister Pop uses data to run the service, keep it secure, and understand what needs improving. We keep those purposes narrow—and the optional parts in your control.
Mr Pop, Inc. operates Mister Pop’s public websites, Studio, and mobile app. In this policy, “Mister Pop,” “we,” “us,” and “our” refer to Mr Pop, Inc.
Public websites.
We use Cloudflare Web Analytics to understand page traffic and site performance. Cloudflare describes this service as privacy-first analytics that does not use cookies, local storage, or personal data to identify visitors.
When Analytics is enabled, we also use Google Analytics through Cloudflare Zaraz to understand how people find and use the public website and blog. This can include the page and referrer, browser and device details, approximate location, and browser identifiers used to distinguish visits.
On the production public websites, Google Analytics remains off until you consent. Preview environments may enable it by default so we can validate instrumentation before release. In either environment, you can change the choice using Cookie settings. We use these reports to measure and improve the public websites; we do not enable advertising analytics through this choice.
Studio.
Studio processes the account, organization, role, profile, content, and activity information needed to provide its authenticated tools. We use operational logs and traces to protect the service and troubleshoot failures. We also use Google Analytics through Cloudflare Zaraz to understand Studio navigation and performance.
Studio uses an HttpOnly cookie to keep an authenticated session for up to 30 days. During email-code sign-in, a separate HttpOnly cookie carries the sign-in attempt between pages for up to ten minutes. These cookies are necessary to provide the sign-in and Studio sessions you request, and are not used for advertising or optional analytics.
Mobile app.
The mobile app stores its opaque sign-in token in secure device storage and keeps app preferences on the device. It does not use browser cookies.
Location is used when you ask the app to find nearby Places or align a spatial experience. Exact coordinates are excluded from analytics and collection receipts. Camera frames used for spatial alignment are processed on the device and are not uploaded or retained.
When Share app analytics is enabled, the app sends performance, screen navigation, and product interaction events to EAS Observe. These events use an identifier unique to the app installation, but exclude precise location, camera frames, sign-in details, and account identifiers. Production builds keep analytics off unless you enable it. Preview builds may enable it by default for validation, and you can turn it off at any time.
Payments and payout accounts.
We use Stripe to process managed payments, refunds, and payouts, and to onboard and verify payout accounts. When you use these features, we share the account references, purchase description, amount, currency, and transaction context needed to connect the payment to your purchase or payout account. Payout setup may also send the contact email you provide to Stripe.
Payment details entered through Stripe’s checkout and identity, business, tax, and bank information entered through its onboarding are collected by Stripe. Our payment integration does not store full card numbers, security codes, bank account numbers, or copies of verification documents in Mister Pop’s application records. Stripe may also collect device and connection information to provide its services and help prevent fraud.
Mister Pop keeps references linking your account to Stripe, payment and payout amounts and status, fees, verification requirements and account readiness, and records of purchases, transfers, refunds, disputes, and related reviews. We use these records to fulfill purchases, account for money owed and paid, provide support, and resolve payment issues. Financial and review records remain part of our transaction history after a refund or account replacement.
Stripe processes information both to provide services to us and for its own purposes, including security, fraud prevention, and compliance. Its Privacy Policy explains its practices, retention, and available privacy choices. If you choose to save a payment method through Stripe, Stripe stores those details for the uses described in that flow.
Your choices.
On the production public websites, you can accept or reject Analytics when the consent panel appears. Preview environments may begin with Analytics enabled. You can change either choice later using Cookie settings in the footer.
In the mobile app, open the actions menu and choose Privacy & Analytics to change app analytics at any time. Turning analytics off stops future dispatches and discards pending analytics events.
Optional analytics settings do not disable the processing needed to make a payment, receive a payout, verify an account, or keep financial records. Stripe’s own privacy choices are described in its Privacy Policy.
Account deletion.
You can request deletion of your account and associated personal data on the web, or choose Delete Account in the mobile app's actions menu. Guest profiles can request deletion from the device through Delete Guest Data. We verify ownership before accepting a request and aim to complete processing within 30 days. You receive confirmation when deletion is complete.
Deletion covers your account, sign-in credentials, profile, saved items, Collection and associated personal activity, and your external Mr. Pop agent history and associated memory. Anonymous aggregate statistics may remain when they cannot be linked back to you. Economy transaction and accounting history is preserved for accounting, tax and dispute obligations. Operational logs and recovery copies expire under their retention policies and are not individually purged by an account deletion request. Shared organizations and other people's accounts are not deleted. Account deletion does not automatically refund purchases.
Service and security.
Cloudflare delivers and protects Mister Pop services and processes request information needed for security, traffic management, storage, and the features you request. Necessary service storage is separate from optional analytics.
Service providers.
Service data is processed by Cloudflare; payments and payout-account verification are processed by Stripe; website and Studio analytics may be processed by Google; and optional mobile analytics is processed by Expo when Share app analytics is enabled. Studio may use Gravatar to display a profile image associated with a sign-in address.
Contact us.
For privacy questions or requests about your personal information, contact Mr Pop, Inc. at help@mrpop.io.
Last updated October 19, 2026.