PRIVACY
Privacy Policy
What Poppin collects, why, and what you can do about it. Effective October 11, 2026.
Who we are
Poppin (findwhatspoppin.com) is a local events directory run by its founder as a sole proprietorship doing business as Poppin, based in Redding, California. This policy covers the website, its emails and its feeds. We collect what running a directory needs and nothing for advertising.
What we collect and why
You can browse without an account, and then we keep almost nothing about you. The rest depends on what you do:
| When | What | Why |
|---|---|---|
| Account | Email address, password (stored hashed by our sign-in provider), display name, default city, role | To sign you in and run your account |
| Google or Apple sign-in | Your name and email address as that service shares them | To create and sign in to your account |
| Passkeys | The passkey credential, the name you give it, when it was created and last used | To sign you in without a password |
| Saves and follows | Events and searches you save, hosts you follow | To show them to you again |
| Views and clicks | Views, saves, shares and ticket-link clicks on listings and host pages. Signed in: tied to your account. Signed out: a salted one-way hash of your network address, never the address itself. No browser fingerprint, user agent or referring page is stored | To show hosts their counts, to decide the view guarantee, and to stop fake views |
| Who's in? plan links | The first names people type into a plan, a one-way hash of each one's network address, and the account that made the plan when its maker is signed in. Anyone with the link sees the names. A plan and its names are deleted 30 days after the event is over | To show friends who is going |
| Town votes | The place and zip code, an email address if you give one, and a one-way hash of your network address | To count demand, and to tell you when Poppin opens there |
| Weekend email | Email address, area, where you signed up, when you confirmed or unsubscribed | To send the email you asked for, and to never mail an address that unsubscribed |
| Hosting | Your application (name, email, organization, website, bio, experience, links, references, plan), team members and invites, listings and uploaded images, venues | To review hosts, run host pages and publish listings |
| Payments | Your Stripe customer and subscription identifiers and what you bought. Card details go to Stripe and never reach Poppin | To bill plans, boosts and sponsor slots |
| Sponsors and Partners | Business name, contact email, website, logo, the line you supply; for Partners, the order and feed usage | To run the slot or the Partner service |
| Reports | The listing, your reason and details, an email address if you give one, the copyright notice details if you send one, and a one-way hash of your network address | To review the report and answer you |
| Business contacts | A work email address and the page it was published on, taken only from an organization's own public website | To invite the organization to claim its listings or to offer it Poppin |
| Abuse limits | A one-way hash of your network address or email, per action, deleted after 2 days | To limit repeated attempts |
We do not collect your precise location. The “near me” button asks your browser for it and uses it in the browser to pick the closest area; it is never sent to us. “When should I leave?” on an event asks your browser for it and sends it straight from your browser to Mapbox to get the drive time; it is not sent to us or kept. We do not locate you from your network address.
How we use it, and what we never do
We use the data above only for the reasons in the table: to run your account and the directory, to bill, to send email you asked for, to keep Poppin safe, to fix problems, and to meet legal duties. Hosts see counts for their own listings, never who viewed them.
We do not sell personal information. We do not share it for advertising, build advertising profiles or segments, or let advertising or analytics companies track you on Poppin. We do not share personal information with other businesses for their own direct marketing.
Emails to organizations
We sometimes email an organization whose events are listed on Poppin, at a work address published on its own website, to invite it to claim its listings or to offer it a Poppin plan. Every such email says who we are, gives our postal address, and has a one-click way to stop further email. An address that opts out goes on a do-not-email list and is not mailed again. To have an address removed now, email hello@findwhatspoppin.com.
Cookies and browser storage
Poppin sets only these, and none of them is for advertising or tracking you across sites. Fonts are served by Poppin, not loaded from another company.
| Name | Kind | Lasts | Purpose |
|---|---|---|---|
| poppin_seen | Cookie | 1 year | A return visit opens on discovery |
| poppin-theme | Cookie | 1 year | Remembers light or dark theme |
| poppin-host-follow | Cookie, signed | 30 minutes | Finishes following a host after you sign in |
| sb-… (sign-in) | Cookies | Session, refreshed while you use Poppin | Keeps you signed in |
| poppin:recent-searches | Browser storage | Until you clear it | Your recent searches, on this device only |
| poppin:swipe-hint-seen | Browser storage | Until you clear it | Hides the swipe hint after you have seen it |
| poppin:visited | Browser storage | Until you clear it | Marks your first event view as a first visit, so Poppin can count how many new people come; nothing else is stored |
| host-directory:… | Tab storage | Until the tab closes | Keeps your filters on the hosts list |
Loading a map, or signing in with Google or Apple, connects you to that company, which applies its own privacy policy.
Who processes it for us
These services process data on our behalf to run Poppin. They may use it only to provide their service to us.
| Service | Job | What it sees |
|---|---|---|
| Supabase | Database, sign-in, passkeys, file storage | All account and listing data |
| Vercel | Hosting and scheduled jobs | Each request, including your network address in transit |
| Stripe | Payments | Name, email, card and billing address you give it |
| Resend | Sending email | Your email address and the message |
| Mapbox | Maps, driving times, and address search for hosts | The map area you view; the address a host types; your location, when you ask when to leave for an event |
| U.S. Census Bureau geocoder | Turns event addresses into map points | Event addresses only |
| Google, Apple | Optional sign-in | What you approve when you sign in with them |
| Ticketmaster | A source of public event listings | Nothing about you |
We also disclose information when the law requires it, to protect people from harm or fraud, or to a business that takes over Poppin, which would be bound by this policy. Our data is stored and processed in the United States.
What is public
Host pages and listings, including the host’s name, logo, website and the events it posts, are public and can be shared and indexed. Your saves, follows and account details are not.
How long we keep it
- Your account and everything tied to it: until you delete the account.
- View and click counts: kept so hosts can see their history. After your account is deleted they stay only as anonymous counts.
- Weekend email: until you unsubscribe or delete your account; an unsubscribed address stays on the do-not-email list so it is never mailed again.
- Past listings: marked past, kept as the host’s history.
- Payment and booking records: as long as tax and accounting law requires.
- Reports and records of moderation decisions: kept so decisions can be checked later.
- Abuse-limit records: 2 days.
- Backups: deleted data leaves our database backups within 30 days.
Your choices
- Delete your account yourself in Account settings. It takes effect at once: your account, saves, searches and follows are deleted, your weekend email subscription is removed, and any town vote keeps only the anonymous count. If you own a host page, ask us to close it or hand it to a teammate first.
- See or correct your data: most of it is on your account pages. Ask hello@findwhatspoppin.com for a copy of the rest, or to correct it.
- Stop email: use the unsubscribe link in any email.
- Clear storage: your browser can delete Poppin’s cookies and storage at any time; you will be signed out and lose recent searches on that device.
We answer every request within 30 days and never charge for it, and we do not treat you differently for making one. Whatever state you live in, these choices are yours. Poppin is below the size at which the California Consumer Privacy Act applies; if it grows past it, this policy will say so and explain those rights.
Do Not Track and Global Privacy Control
Poppin does not track you across other sites and does not let anyone else track you on Poppin, so it behaves the same whether or not your browser sends a Do Not Track or Global Privacy Control signal. We do not sell or share personal information, which is what those signals ask us not to do.
Children
Poppin is not for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, email hello@findwhatspoppin.com and we will delete it.
Security
Data is encrypted in transit, access to our database is restricted, passwords are never stored in readable form, and network addresses are stored only as one-way hashes. No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires, without unreasonable delay.
Changes to this policy
When this policy changes, the date at the top changes. If a change matters, such as a new use of your data, we email account holders before it takes effect. The Terms of Service say how changes to them work.
Contact
Email hello@findwhatspoppin.com. Post: PO Box 0000, Redding, CA 96001.