Privacy policy

Last updated: 08 Oct 2026

This policy covers the PopPond app for iPhone, iPad and Android, version 1.0.8, and the website poppond.com. PopPond is made by Waseem Sayegh, a sole developer in the United Arab Emirates. "We" and "us" in this policy mean him.

The short version

  • PopPond has no accounts, no sign-up, and nowhere to type a name or email address. It shows no ads.
  • The app sends usage events to PostHog so we can see what gets used and what breaks. It may also record what appears on the screen while the app is open, so we can see where families get stuck.
  • It sends a smaller set of events to Meta and TikTok to measure PopPond's own ads on their platforms. On iPhone and iPad they get your device's advertising identifier only if you allow tracking. On Android they read the advertising ID unless you have deleted it.
  • OneSignal lets us show short messages inside the app.
  • None of this carries a name or email address. It is tied to random codes and device identifiers, which still count as personal data under laws such as the GDPR.

What the app collects

  • A random install identifier, created the first time the app opens. Deleting the app and installing it again creates a new one.
  • Usage events, such as screens and cards viewed, words played, books opened and finished (with the book's name), dialect and language changes, the subscription page opened, prompts shown and answered, links followed, the app opening and closing, how long a book took, and three milestones: 10 words heard in one session, a second day of use, and three days of use in the first week. On iPhone and iPad the app also records when the screen is tapped quickly several times in one spot, with the screen's name and the tap position.
  • Screen recordings: about one screenshot a second of the app's own screens while the app is open, and where the screen was touched. They show what is on screen, such as books, words, pictures and the subscription page with its price. Anything typed into a text field is hidden, and the app has no text field. A recording carries the random install identifier and no name or email address, and PostHog keeps it for 30 days. A parent can turn screen recording off in the app's Settings, under Privacy.
  • Purchase details from the app store: the subscription product, its price and currency, whether a free trial or a code applied, whether the purchase was real or a test, and the store's transaction ids. On iPhone and iPad that includes Apple's original transaction id, which stays the same across renewals. On Android it is Google Play's order id, plus a one-way hash of the purchase token, so we can match a purchase without ever holding the token. We never see card or payment details. Apple and Google handle payment.
  • Your subscription status: never subscribed, active, canceling, or lapsed.
  • Device and app details such as device model, operating system and version, app version, screen size, language and region settings, time zone, and whether the device is on Wi-Fi or mobile data.
  • Error reports, with the error message and the place in the app's code where it happened.
  • Your IP address, which every internet request carries. What each company does with it is below.

The app does not collect names, email addresses, phone numbers, contacts, photos, location from the device's location services, or anything typed. It has no text field, and it never uses the camera or microphone.

Who receives it, and why

PostHog, for usage analytics

PostHog receives the install identifier, usage events, purchase details, subscription status, device and app details, error reports, and the IP address. It also receives the screen recordings described above. We use it to see which books and features get used, where the app breaks, and whether the subscription page works. PostHog keeps one record for each install, tied to the random install identifier. It holds the dialect and language chosen, the store's country, the app version, the subscription status and the dates a subscription began or lapsed. For installs that came from an ad or a link, it also holds which campaign they came from. PostHog processes this data in the EU (Frankfurt). A setting in our PostHog project discards the IP address when an event arrives.

OneSignal, for messages inside the app

OneSignal lets us show short messages inside the app, for example about new books, subscription codes or our social pages, to groups of installs chosen by subscription status, number of books finished, or language. It receives the install identifier, its own identifiers for the install, subscription status, the number of books finished, the app's language, device and app details, and the IP address, from which it works out a country. It also records sessions (how many, how long, first and last use) and which messages were shown or tapped. OneSignal is a US company. PopPond sends no push notifications, but on Android OneSignal's software still registers the device with Google's Firebase messaging service, so Google receives a Firebase installation id and a messaging token.

Meta and TikTok, for ad measurement

PopPond shows no ads. We pay Meta and TikTok to show PopPond's ads on their platforms, and the app includes their measurement software so we can tell whether those ads lead to installs, use and subscriptions. The software runs on every install and starts a few seconds after the app opens. Nothing in the app turns it on or off.

It tells each company that the app was installed and opened, and sends ten of our events: a book opened (with the book's name), the subscription page shown, the subscription page opened on purpose, Subscribe tapped (with price and currency), a free trial started, a subscription bought (with price, currency and the store's transaction details), and the three milestones above. Each event also names the chosen dialect.

Both companies also receive device details, including the mobile carrier, and IP addresses. Each keeps its own random identifier for the install and logs some events of its own, such as launches and sessions, and Meta may also record the purchase itself. Their software can send them its own error reports. On iPhone and iPad, TikTok also receives the device's vendor identifier, a code Apple gives each app maker for a device. On Android, both receive the install referrer, a short text Google Play hands the app at install to say where the install came from, and with each purchase, Google Play's order id.

On iPhone and iPad, after the first finished book, the app explains Apple's tracking prompt on one short screen and then shows the prompt once. If you allow tracking, Meta and TikTok also receive the device's advertising identifier. If you don't allow it, or haven't answered yet, TikTok receives nothing on iOS 17 and later because Apple blocks the connection, and Meta still receives the events and device details without the advertising identifier. On iOS 15 and 16, both receive them without the identifier. You can change your answer at any time in Settings > Privacy & Security > Tracking.

On Android there is no prompt. Meta and TikTok read the advertising ID when their software starts, unless you have deleted it in your device settings.

Meta and TikTok process this data on their own servers under their own privacy policies. If you have a Meta or TikTok account, its settings for activity from other apps and websites let you see and disconnect what businesses such as PopPond send.

Apple and Google

Apple and Google run the app stores. They handle purchases, restores, review prompts and updates under their own policies. On iPhone and iPad the app asks the App Store whether a newer version exists; the request names the app and your region's country, not you. On Android, updates and the install referrer come from Google Play.

PopPond asks Apple whether the app was installed from an Apple Search Ads ad. If it was, Apple tells us the campaign, ad group and keyword identifiers for that ad. These identifiers do not identify you, your child or your device, and we use them only to measure which ads bring families to PopPond. This does not use the advertising identifier and does not need tracking permission.

If you install PopPond on Android, Google Play tells the app which link or campaign led to the install, for example a link shared from the app. We record this with our usage analytics to understand how families find PopPond.

When an ad in another app or on a website leads to a PopPond install, Apple sends us a copy of the report it sends to that ad network. The report contains no information about you, your child or your device.

poppond.com

Each time the app opens, it downloads a small file from poppond.com with the current links to our social and store pages. The request carries no identifier. Cloudflare, which hosts poppond.com, sees its IP address, as with any web request.

We do not sell data. What the Meta and TikTok section describes goes to them for ad measurement.

The website

poppond.com has no analytics, no ad pixels, and no third-party scripts, fonts or embeds. It sets one cookie, pp_lang, only when you choose a language, so the site opens in that language next time. The cookie lasts one year. Cloudflare hosts the site and processes each visit's IP address and browser details to serve it, and may set a short-lived security cookie to filter automated traffic.

Links to the App Store, Google Play, Instagram, TikTok and YouTube take you to those companies, and their policies apply from there. They can see that you came from poppond.com. Our App Store and Google Play links also carry a short label naming which of our links was used, such as tiktok and bio, so each store can count the installs that link produced. The label says nothing about you. On Android, Google Play passes it to the app as part of the install referrer.

The support form sends your name, email address, topic, message and the site's language. It passes through Cloudflare (Workers and Email Routing) to our inbox at Gmail, which Google runs. We use it only to answer you and keep messages only as long as it takes to answer.

Children

PopPond is used by young children and by adults starting Arabic. The app asks no age and treats every install the same way, so everything in this policy applies to every install, including a child's.

There are no accounts, no chat, and no way for another person to reach a child through the app. The only messages inside it come from us, through OneSignal.

A grown-up check, a short arithmetic question, comes before a purchase can start, before Settings opens, and before any link leaves the app. One exception today: on iPhone and iPad, the Update button in the update prompt opens the App Store directly. Tapping a book that isn't unlocked opens the subscription page, and buying from there needs the grown-up check.

What stays on your device

The app keeps its settings on the device: dialect and language, library view, how often it has opened, which prompts were shown, word and day counters, the dates of active days, subscription state, a copy of the links file, and the identifiers and queued events of the measurement and messaging software. Deleting the app removes all of it, and on Android so does Clear data. Android never backs it up or moves it to a new phone. On iPhone and iPad, device and iCloud backups include the app's settings and the Meta, TikTok and OneSignal software's data, but not PostHog's, so a restored device gets a new install identifier. Purchases stay with your Apple or Google account and can be restored.

How long data is kept

  • On your device, until you delete the app.
  • PostHog discards the IP address on arrival.
  • PostHog, OneSignal, Meta and TikTok keep what they receive for the periods set by their own rules and our account settings with them.
  • The pp_lang cookie lasts one year.
  • Support messages are kept only as long as it takes to answer.

Where data is processed

PostHog processes app events in the EU. OneSignal, Meta, TikTok, Google and Cloudflare process data in the United States and other countries.

Your choices

  • On iPhone and iPad, allow or refuse tracking in Settings > Privacy & Security > Tracking. Refusing stops the advertising identifier going to Meta and TikTok, and on iOS 17 and later stops TikTok receiving anything.
  • On Android, reset or delete the advertising ID in your device settings.
  • Deleting the app erases what it stored on the device. Installing it again starts a new install identifier.
  • The app has no switch for analytics, in-app messages or ad measurement.
  • For questions or a deletion request, use the support form. The records above carry no name or email address, and the app doesn't show its install identifier, so we usually can't find yours from a message. We will tell you what we can do.

Changes

When what the app or the website does changes, we update this page and the date at the top.

Company policies

Each company's own privacy policy: