Privacy policy – Popcorn

Controller

The controller is JVMG GmbH, Vienna, Austria – the publisher of Popcorn. Postal address, company register number and further details are in our imprint.

For any privacy question and to exercise your rights, contact us at support@jvmg.at.

At a glance

Popcorn is funded by paid plans – not by ads in the apps and not by selling data.
Your account and content data are stored on servers in the EU.
Usage statistics and error reports only with your consent. The Android app sends none.
Popcorn only uses Google, Microsoft and AI input when you turn them on or use them yourself.
You can export your data and delete your account yourself at any time.

Website (www.popcorntask.com)

Visiting the website

The website is hosted by Vercel in the Frankfurt region (fra1). When you visit it, the servers process technically necessary connection data: IP address, time, requested address, browser identifier (user agent) and, where applicable, the previous page. We use it only to deliver the website, find errors and fend off attacks; Vercel keeps these logs for at most 30 days. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

We serve fonts ourselves. Nothing is loaded from Google Fonts or other third-party servers.

Strictly necessary storage in your browser

Without consent, we only store in your browser what is strictly necessary for a feature you asked for (§ 165(3) Austrian Telecommunications Act 2021, Art. 6(1)(b) and (f) GDPR):

your choice in the cookie banner (local storage, 12 months; then we ask again),
sign-in and session cookies when you buy a plan or delete your account on the website – only for this website, not readable by scripts, valid for at most 2 hours,
where you came from, if you arrive via a referral or challenge link and want to sign up (local storage, 30 days), so the referral can be attributed when you register,
a random guest ID for the guest round on a challenge page (local storage), not linked to you as a person.

Ad measurement and error reports – only with consent

Only if you agree in the cookie banner does the website load these services:

Meta Pixel (Meta Platforms Ireland Ltd.): measures whether our ads work – page views and clicks on buy and download buttons. Meta sets cookies for this (_fbp, _fbc), may link the data to a Meta account and transfer it to the USA. We are joint controllers with Meta for the collection on the website and the transmission to Meta (Art. 26 GDPR, section 14).
PostHog (EU cloud, Frankfurt): page views and button clicks, without automatic capture of input and without session recording. Storage entries with the prefix ph_.
Sentry (EU region, Frankfurt): technical error reports. Email addresses, keys, content and similar details are filtered out before sending.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). You can withdraw it at any time via “Cookie settings” in the footer of the home page; we then stop the services and remove their cookies and storage entries. If you decline, none of these services is loaded.

Downloads

When you download the desktop app from our website, we only count the number of downloads per day and version. We store neither your IP address nor your browser identifier and set no cookie.

Waitlist

If sign-up is temporarily closed, you can join the waitlist with your email address. You receive a confirmation email; the entry only counts once you confirm it (double opt-in). Legal basis: your request (Art. 6(1)(b) GDPR). We delete unconfirmed entries after 30 days and confirmed ones after 12 months. If you create an account, we delete the entry at most two days later, immediately when you delete your account, and at any time on request to support@jvmg.at.

Popcorn account

You need a Popcorn account to use the apps. You sign in with a link sent by email, with Google or with Microsoft; there is no password. For this we process:

your email address and a random account ID,
your display name and, where available, the address of your profile picture – taken from the provider's account when you sign in with Google or Microsoft,
language, time zone and settings (e.g. dock side, appearance, notifications, consent to statistics),
the factor for two-factor sign-in, if you turn it on,
plan and subscription status as well as the times of sign-up and sign-in.

When you sign in with Google or Microsoft, we only receive your address, name and profile picture. Access to calendars or tasks is separate and only possible after a separate consent (sections 8 and 9).

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Abuse prevention, such as limiting sign-in attempts, is based on our legitimate interest (Art. 6(1)(f) GDPR).

Your content and sync

We store what you create in Popcorn so it is the same on all your devices: tasks with notes, due dates, repeats and subtasks, lists, projects, milestones, clients, time entries, the history of your changes (for “Undo”) and notifications, for example about assignments.

The data is stored in a database at Supabase in the EU (Frankfurt). The database checks access rights on every request: you only see your own data and the projects you are a member of.

On your devices, Popcorn keeps an encrypted copy (SQLCipher) so the apps also work offline. The key is kept in the Windows Credential Manager or the Android Keystore.

We do not analyse your content and use it neither for statistics nor for advertising. Server logs, statistics and error reports contain no content. Legal basis: Art. 6(1)(b) GDPR.

AI input

From the Check plan, you can enter tasks in natural language in the command bar. Only when you do so, we send to Anthropic (USA): the text you entered, date, time and time zone, the app language and the names of your projects so the AI can suggest the right project.

The AI only makes suggestions; nothing is carried out until you confirm it. We do not store the text you entered; our logs only contain counts and durations. For the daily limit, we count your requests per day and delete the counter after 7 days.

Zero Data Retention applies to Popcorn at Anthropic: Anthropic does not store inputs and outputs beyond processing the respective request, unless the law requires it, and does not use them to train AI models. Anthropic processes the data on our behalf. Legal basis: Art. 6(1)(b) GDPR (the feature you use). For the transfer to the USA, see section 15.

Google Calendar and Google Tasks

Connecting Google is optional (from the Check plan). It only starts when you trigger it in the settings and consent at Google. Popcorn requests these permissions:

Read events (calendar.events.readonly): show events in “Today” and in the calendar and calculate free time slots.
Read the calendar list (calendar.calendarlist.readonly): know the calendars of your account so you can choose which ones are shown.
Manage its own calendars (calendar.app.created): create a separate calendar “Popcorn” and add tasks with a time to it as events. Other calendars, including your primary calendar, are not changed.
Google Tasks (tasks): sync selected task lists with Popcorn in both directions.

Which data: name and address of the Google account; from the selected calendars, title, start and end, location, meeting link, series, “busy” status and calendar colour of events from the last 7 and the next 30 days (we do not store cancelled or declined events); from the synced Google Tasks lists, title, notes, due date and completion status.

How: we store the access key (refresh token) encrypted in Supabase Vault (EU). Only our sync service on a server at Hetzner in the EU uses it; the apps never see it. Events are cached in our database (EU) and shown to you in the apps; tasks from Google become tasks in your account.

What not: we use data from Google APIs only to provide and improve the features you see in Popcorn. We do not sell it, do not use it for advertising, do not share it with third parties (except the service providers named in section 14 for operation and storage, where required by law, or with your consent), do not send it to AI services and do not use it to develop, improve or train AI or machine-learning models. No human reads this data – except with your explicit consent, where necessary for security and abuse prevention, or where required by law.

Popcorn Task's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion: you can disconnect Google in the settings at any time. We then revoke access at Google within a few minutes, delete the access key and remove cached events and links. Your data at Google, including the “Popcorn” calendar and your tasks, stays unchanged. You can also remove access at myaccount.google.com/permissions. If you delete your account, the same happens automatically.

Legal basis: Art. 6(1)(b) GDPR (the connection you asked for).

Microsoft calendar (Outlook)

Connecting Microsoft accounts (Microsoft 365 and Outlook.com) is optional as well (from the Check plan). When connecting, Popcorn only requests read permissions: sign-in and account address (openid, email, profile, User.Read), ongoing access for syncing (offline_access) and reading calendars (Calendars.Read). Only if you want tasks with a time added to Outlook does Popcorn additionally ask for Calendars.ReadWrite.

Popcorn reads events from the calendars you select in the last 7 and the next 30 days: title, start and end, location, Teams link, series, “busy” status and calendar colour. It only writes to a separate calendar “Popcorn”; other calendars stay unchanged.

We store the access key encrypted in Supabase Vault (EU); only our sync service at Hetzner (EU) uses it. We use the data only for these features – not for advertising, not for AI services and without sharing it with third parties.

When you disconnect, we delete the access key immediately, along with cached events and links; your data at Microsoft stays unchanged. Microsoft does not offer revoking individual tokens – you remove the permission itself at myapps.microsoft.com (work and school accounts) or account.live.com/consent/Manage (personal accounts). Legal basis: Art. 6(1)(b) GDPR.

Payment via Stripe

You buy paid plans via Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your payment details, such as your card number, directly at Stripe; we do not receive them. We send Stripe your email address, your account ID, the chosen plan and your language, and receive from Stripe the status and term of your subscription or purchase.

An invoice is issued for every purchase. Invoices and accounting records are kept for as long as the law requires (in Austria generally seven years, § 132 Federal Fiscal Code) – also after you delete your account. Stripe is itself responsible for its own purposes such as fraud prevention and legal obligations; the Stripe privacy policy applies to that.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR).

Emails

We only send emails that belong to a feature: sign-in links, project invitations, the waitlist confirmation and the daily summary email with notifications (can be turned off). Sign-in emails are sent by Supabase Auth (EU) through our email provider Resend; we send invitations, waitlist and summary emails directly via Resend. Resend sends from the Ireland region (EU). Stripe sends invoices. Our emails contain no tracking pixels. Legal basis: Art. 6(1)(b) GDPR.

Desktop app (Windows)

Local data: encrypted database; sign-in key (refresh token) and database key in the Windows Credential Manager. When you sign out, the app removes the local data.
Hiding during screen sharing and in full screen runs only on your device; nothing is transmitted.
Updates: if update checks are active, the app regularly fetches an update file from our storage at Supabase (EU). This technically transmits your IP address; we do not analyse it.
The app loads the weekly game from www.popcorntask.com and runs it isolated; the game itself has no network access.
Usage statistics and error reports only with consent: during onboarding and under Settings → Privacy you can turn on “Send anonymous usage statistics and error reports” (off by default). We then send PostHog (EU) events such as “app opened” or “task completed” – without content, without account ID and without email address, only with a random installation ID and without location lookup – and Sentry (EU) crash and error reports from which personal details, content, user folders and keys are removed beforehand. Turning it off takes effect immediately. Legal basis: consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021).
If you get the app via the Microsoft Store or winget, Microsoft's terms also apply to the download.

Android app

The Android app syncs your account and content as described above. In addition:

no ads, no advertising ID, no usage statistics and no crash reports,
the only permission is notifications: the app schedules reminders locally on the device, there is no push service,
local data in an encrypted database, key in the Android Keystore, no cloud backup,
sign-in runs in a browser tab on www.popcorntask.com,
if you get the app via Google Play, Google processes data under its own terms.

Recipients and service providers

We do not sell your data. We use the following service providers, who process data only on our behalf and according to our instructions (Art. 28 GDPR):

Supabase – database, sign-in, file storage and server functions; EU region (Frankfurt)
Vercel – website hosting; Frankfurt region (fra1)
Hetzner Online GmbH, Germany – server for calendar sync and the summary email; data centre in the EU
Resend – sending emails; sending region Ireland (EU)
Anthropic – AI input, only when you use it
PostHog – usage statistics, EU cloud, only with consent
Sentry – error reports, EU region, only with consent

Independently responsible are Stripe for payments (section 10), Google and Microsoft for their services you connect Popcorn to, and Google Play and the Microsoft Store as download sources. For the collection via the Meta Pixel on the website and the transmission to Meta (only with consent), we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR); Meta alone is responsible for any further processing. You can exercise your rights against us and against Meta.

Within Popcorn, other people only see what you share with them (section 6). Authorities only receive data if we are legally obliged to provide it.

Transfers to third countries

We store your data in the EU. Some service providers are based in the USA (including Supabase, Vercel, Resend, Anthropic, Sentry, PostHog, Stripe and Meta) or may access data from there. For AI input, Anthropic processes the data in the USA.

For Anthropic, Stripe, Resend and Meta, we base the transfer on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For the other service providers, the Data Privacy Framework applies where the provider is certified under it, and otherwise the standard contractual clauses. You can request a copy of the safeguards at support@jvmg.at.

Retention and deletion

We keep your account and content for as long as your account exists.
Deleting your account: in the desktop app under Settings → Data and account, in the Android app under Settings → Account, or at www.popcorntask.com/en/delete-account. After the request you have a 7-day grace period in which you can cancel the deletion. We then delete the account in the next daily run, at the latest 8 days after the request. Shared projects and clients pass to the longest-standing member; your tasks in them remain without your name.
Connections to Google and Microsoft remain until you disconnect them or delete your account. We only keep events from the last 7 and the next 30 days.
Invoices and payment records: statutory retention period (generally seven years).
Counter for AI input: 7 days.
Waitlist: unconfirmed entries 30 days, confirmed entries or entries unlocked with a beta code 12 months. If you create an account, we delete the entry at most two days later.
Status links: until they expire (14 days by default) or you revoke them.
In the browser: cookie choice 12 months, session cookies at most 2 hours, origin from referral links 30 days.
Database backups: Supabase creates a backup every day and keeps it for 7 days. Deleted data therefore also disappears from the backups at most 7 days after deletion.
Server logs: website logs at Vercel at most 30 days, platform logs at Supabase (e.g. database and sign-in requests) 7 days, logs of our sync service at Hetzner at most 14 days. They contain no content.

If you have no access to the app or your account, an email to support@jvmg.at is enough.

Security

All connections are encrypted (HTTPS). The database checks access rights on every request. Access keys for Google and Microsoft are stored encrypted in the vault and never on your devices; local data is encrypted. You can turn on two-factor sign-in.

We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR).

Children

Popcorn is intended for adults aged 18 and over and is not meant for children. We do not knowingly collect data from children; if we learn of it, we delete the account.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Access and data portability: in the desktop app under Settings → Data and account you can download all your data as a JSON file – free on every plan. You change your profile and settings directly in the app.

For any request, an email to support@jvmg.at is enough. If you believe we process your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde).

Changes

We update this policy when Popcorn or the law changes. The version published here applies; the date is shown at the top.