Privacy Policy – PopHop (EN)

1. What PopHop does

PopHop helps you discover the hidden value of the objects in your home. You take a photo of an object, and PopHop generates an item card with details like title, description, category, and an estimated price range so you can quickly decide whether to keep, protect, or sell it.

2. Data we process

• No account: You do not create an account and PopHop does not require you to provide your name, email or contact details to use the app.
• On‑device collection: Your objects, photos and item cards are stored locally on your device in a local database (SQLite) and are not uploaded to Krezus servers.
• Object analysis: When you request an item card, the app sends the photo and related technical request data to an EAS‑hosted backend route, which forwards it to the Gemini API to generate the content of the card.
• Analytics: PopHop uses Firebase Analytics to measure high‑level usage such as number of item analyses, paywall views and feature usage, without trying to identify you personally.
• Purchases: Purchases are handled by Apple App Store / Google Play Store in‑app purchases and by RevenueCat, which manages subscription status and receipts on Krezus’s behalf.

PopHop does not intentionally collect GPS location, IP address for its own use, precise identifiers, contact lists, or other sensitive personal data beyond what is technically handled by the stores and service providers mentioned above.

3. Purposes and legal bases (GDPR)

Krezus processes data for the following purposes under the EU General Data Protection Regulation (GDPR):

• Provide core features of PopHop: process photos via the Gemini API to generate item cards and store them locally on your device (performance of a contract – providing the app’s features).
• Measure usage and performance: use Firebase Analytics to understand generic app usage (for example, number of item analyses or paywall opens) and improve stability and features (legitimate interest in improving the service, with data minimisation).
• Manage subscriptions and purchases: verify and manage your subscription status via the app stores and RevenueCat (performance of a contract and compliance with store and tax rules).

You are free not to subscribe to Premium and can continue to use the basic features within the free tier subject to the monthly object limit.

4. Data retention

• Local item data: Item photos and cards are kept on your device until you delete them or uninstall the app; Krezus does not have access to them.
• Gemini API requests: Data sent to the Gemini API is processed to return the result; retention and logs on the provider side follow their own policies and are not controlled directly by Krezus.
• Analytics: Usage data in Firebase Analytics is kept for the standard retention periods configured in Firebase, which are limited and intended for aggregated reporting.
• Purchase data via RevenueCat: Subscription and purchase‑related data are kept as long as necessary to manage your subscription and comply with legal obligations such as accounting and tax laws.

5. Data sharing and service providers

Krezus does not sell your data.

For the purposes described above, Krezus uses the following service providers (data processors):

• Google Firebase (Analytics): collects aggregated usage information and technical event data for app analytics and crash reporting. Data may be stored in data centers located in or outside the EU depending on Google’s infrastructure.
• Gemini API (Google): processes images and prompts to generate content for your item cards in line with Google’s Gemini API terms and privacy rules.
• RevenueCat: processes subscription and purchase information (such as anonymous identifiers and purchase receipts) to manage your subscription and entitlements.
• App stores (Apple / Google): handle payments and may process personal data according to their own privacy policies.

These providers act on instructions from Krezus and implement technical and organisational security measures, as described in their own documentation.

6. International transfers

Some service providers, in particular Google (Firebase, Gemini) and RevenueCat, may process data in countries outside the European Economic Area. When such transfers occur, Krezus relies on appropriate safeguards required by GDPR, such as standard contractual clauses implemented by these providers.

7. Security

Krezus implements reasonable technical and organisational measures to protect data, including encryption in transit (HTTPS) for communications with the backend and third‑party services, access control to its tools, and limiting the data collected to what is necessary for the stated purposes.

Because item data is stored on your device only, you are also responsible for securing your device (for example by using a passcode or biometric lock and keeping your operating system up to date).

8. Children

PopHop is not specifically directed at children, and there is no strict age verification in the app. Parents or guardians should supervise the use of mobile apps by children and decide whether PopHop is appropriate for them.

9. Your rights (EU / France)

As a user located in the European Union, you have the following rights over your personal data, where applicable: right of access, rectification, erasure, restriction, objection, data portability, and the right to withdraw consent when processing is based on consent.

To exercise these rights, contact krezus.developer@gmail.com with enough information to identify you and describe your request. You also have the right to lodge a complaint with your local data protection authority; in France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL) (www.cnil.fr).

You can also delete local data directly by removing items in the app or uninstalling PopHop, which removes the local database from your device.

10. Cookies and similar technologies

PopHop does not use classic browser cookies inside the mobile app. The analytics SDKs used (such as Firebase Analytics) may use identifiers and similar technologies for measurement purposes, according to their own documentation and your device’s privacy settings.

If Krezus later publishes a website for PopHop that uses cookies or online trackers, the website will include a separate cookie banner or information as required.

11. Changes to this policy

Krezus may update this Privacy Policy from time to time, for example when PopHop adds new features or when laws change. The updated version will always be available on the PopHop privacy page hosted on Vercel (Next.js) and accessible from within the app, particularly from the paywall screen.

If changes are significant, Krezus may also display an in‑app notice so that you can review the new terms.