Privacy Policy

PopIn ("we", "us", "our") is a social events platform operated from Australia. We respect your privacy and we have written this policy to make our practices clear. By using the Service or by responding to a PopIn invitation, you agree to the handling of your information as described here.

For the purposes of the GDPR, PopIn is the data controller in relation to the personal data it processes about its users and guests. You can contact us using the details in section 13.

We collect three broad categories of information: information you give us, information from non-account guests, and information we collect automatically.

When a host invites you to an event by email or SMS and you respond using the invite link, we collect:

We use your information for the following purposes:

Legal bases (GDPR). Where the GDPR applies, the legal bases we rely on are: performance of our contract with you (Article 6(1)(b)) for the operation of your account and event features; your consent (Article 6(1)(a)) for optional features such as geolocation and non-essential communications; our legitimate interests (Article 6(1)(f)) in keeping the Service secure, preventing abuse, and improving it; and legal obligations (Article 6(1)(c)) where applicable.

Some content on PopIn is intentionally visible to the public, including search engines such as Google. This section is a plain-language summary of what is and isn't publicly visible so you can make informed choices about what you share.

When you create an event you choose its visibility (Public, Friends, Private, or Invite-only). If you set an event to Public and toggle on "Let Google index this event", the event's name, date, location, description, cover photo, and host display name become visible to anyone with the link and may appear in Google search results. Guest lists are never indexed: individual RSVPs (Going / Maybe / Can't make it) remain private to you as host. You can change an event's visibility at any time from the event's edit page; switching away from Public automatically clears the indexing flag.

Profile pages on PopIn are not currently publicly accessible. Unauthenticated visitors are redirected to the sign-in page, and search engines are explicitly disallowed from indexing profile URLs via our robots.txt. Posts you create within PopIn follow the audience you pick when posting (Public, Friends, or Private), but only the in-app audience controls apply: signed-in users in the correct audience can see them; the open web cannot.

The help center articles, blog posts, and the public issues board are written or curated by the PopIn team and are intentionally public. They do not contain user-generated content. The issues board displays issue titles and summaries that you submit via the in-app feedback button; submit reports anonymously if you would prefer not to attach your identity to a public-facing report.

Auditing what's public about you. The simplest way to see what is publicly visible is to open popin.events in a private browser window without signing in. Anything you can see in that window is what the public sees; anything that redirects you to the sign-in page is not public.

We use a small number of carefully chosen third-party services to deliver PopIn. Each is listed below with the data shared, the purpose, and a link to their own privacy policy.

PopIn shows a small number of sponsored posts in the home feed. They're clearly labelled "Sponsored", you can hide individual ads from the card itself, and you can turn the whole feature off at any time from Settings → Feed → Sponsored posts.

Sponsored posts are served by Google AdSense. AdSense uses cookies, your device's IP address, and your activity on this site (and, when enabled, on other sites that participate in Google's advertising network) to choose ads and measure their performance. We do not share your PopIn account identifiers (email, username, friends, message content) with Google.

You can:

We do not sell your personal information to anyone, and we do not use it to show you advertising on PopIn.

We share your information in the following situations:

We keep your information only for as long as we need it for the purposes described in this policy.

You have the following rights in relation to your information:

To exercise any of these rights, please contact us at privacy@popin.events. We aim to respond within 30 days. We may need to verify your identity before we act on a request to protect your information.

We use cookies and similar technologies for three purposes: essential operation, user preferences, and (where you have not opted out) sponsored posts.

PopIn itself does not use cross-site analytics, fingerprinting, or third-party trackers that profile you across other websites. The only cross-site party we work with is Google AdSense, and only on the terms described in section 4.

We take reasonable steps to protect your information. Passwords are stored hashed, traffic to the Service is encrypted in transit using TLS, and access to production systems is restricted to administrators with a need to access them.

Admin access and moderation. A small number of PopIn administrators have the ability to view account data and content for the purpose of investigating reports, responding to legal requests, and keeping the Service safe. Admin actions are logged. Admins do not browse user data without a legitimate reason.

No system can be guaranteed to be perfectly secure. If we become aware of a data breach that is likely to result in serious harm we will notify affected users and the relevant regulator as required by law.

PopIn is only available to users aged 16 and over. This complies with the Australian Online Safety Amendment (Social Media Minimum Age) Act 2024, which requires age-restricted social media platforms to take reasonable steps to prevent Australians under 16 from creating or holding accounts.

When you create an account we collect your date of birth and store an age-verification record. We use this only to confirm that you meet the minimum age and to provide an audit trail for our regulator. Your date of birth is treated as personal information under the Australian Privacy Principles. Date of birth is not shared with third parties except where required by law or as part of any future age-assurance service we may engage (in which case the third party would be bound to use the data only for the verification purpose).

If you believe an account has been created by someone under 16, please contact us at support@popin.events and we will review the account. We may suspend or delete any account where we determine the account holder is under 16.

Existing users from before the minimum-age requirement took effect are prompted to confirm their date of birth at next sign-in. Until they do, certain social features (posting, commenting, messaging, RSVPing) are not available to them. We do not automatically suspend existing accounts during this transition period.

PopIn is operated from Australia. The third-party providers we rely on may store and process information in other countries, including the United States and the European Union. Where we transfer information outside Australia, the European Economic Area, or the United Kingdom, we do so under contractual terms designed to provide a level of protection broadly equivalent to that of the originating jurisdiction (such as the Standard Contractual Clauses approved by the European Commission).

We may update this Privacy Policy from time to time, for example to reflect changes in our practices, in the Service, or in the law. We will revise the "Last updated" date at the top of this page when we do, and for material changes we will give reasonable advance notice (for example by email or by an in-app notice).

For privacy questions, requests, or complaints, please contact us at privacy@popin.events. We aim to respond within 30 days. If you are not satisfied with our response you can also contact the regulator in your country (in Australia, the Office of the Australian Information Commissioner).