Privacy Policy

Established: July 20, 2026 / Last updated: October 18, 2026

Poppin Studio ("we", "us") sets out this Privacy Policy ("this Policy") for how we handle users' personal information in the Android application "Poppin", the version of it that runs in a browser (the "browser version"; together with the Android application, the "App"), and the website poppin-studio.com (the "Site"; together with the App, the "Service"), in compliance with the Act on the Protection of Personal Information of Japan (the "APPI") and other applicable laws.

The browser version is provided at https://web.poppin-studio.com . We also provide a Chrome extension, "Poppin" (the "Extension"), on the Chrome Web Store. How the Extension handles information is set out in Article 11, section 3.

This English version is provided for convenience. If it differs from the Japanese version, the Japanese version prevails.

Article 1 (Definitions)

In this Policy:

1. "Personal information" means personal information as defined in Article 2(1) of the APPI.
2. "User" means anyone who uses the Service.
3. "On-device data" means the information a user creates, enters or saves in the App, and the information the App keeps only on the user's device (in the browser version, in the browser's storage) to work, including the contents of decks and cards (text, pictures, sounds), study progress and spaced-repetition schedules, settings, the usage of monitored apps, and media playback state.
4. "Backup data" means the information saved on our server when a user signs in with a Google account and uses the App's sync, including decks, cards, study progress, related media files (pictures, sounds), records of deletions, and study statistics (such as the number of answers).
5. "Account information" means the information our server receives through the proof of sign-in (ID token) that Google issues when a user signs in with a Google account, limited to the Google account ID and the email address Google has verified.
6. "Sign-in key" means a random string our server issues to keep a user signed in to the browser version after signing in with a Google account.
7. "Usage data" means statistics sent to our server only when a user turns on sending usage in the Android application, including the App's settings, counts such as the number of decks and cards, the number of answers, the identifiers of monitored services that are on a list built into the App, the total time spent in monitored apps, the App's version, and the installation identifier and account identifier defined in this Article. It does not include the contents of decks or cards.
8. "Account identifier" means a random string the App generates on the device when sending usage is turned on, used to count one person using several devices as one person. It does not represent a name, email address or other contact information. However, when a user uses sync, this identifier is included in the backup data and is stored on our server associated with the account information (which is why it carries over when the App is uninstalled and installed again). We do not use this association to identify individuals when aggregating usage data.
9. "Installation identifier" means a random string the App generates on the device when sending usage is turned on. It is unrelated to, and not derived from, the advertising ID or any device identifier.
10. "Advertising ID" means the advertising identifier assigned to an Android device.

Article 2 (Information We Handle)

The information handled in connection with the Service is as follows.

1. On-device data

On-device data is processed on the user's device for the App to work, and is saved in Android's SharedPreferences and internal storage in the Android application, and in the browser's storage (IndexedDB and localStorage) in the browser version. Except when the user uses sync as described in the next section, it is not sent off the device.

The browser version can be used only when signed in with a Google account. Its on-device data is a copy of the signed-in account's data, saved in that browser's storage. Signing out of the browser version deletes all data saved in that browser's storage (decks, cards, settings and so on). When a different account signs in, everything from the previous account is deleted before anything of it is shown.

2. Backup data and account information (sync)

Only when a user signs in to the App with a Google account does the App save backup data on a server we manage and sync it between the devices and browsers signed in to the same account. If a user does not sign in to the Android application, sync does not work and no backup data or account information is sent. The browser version cannot be used without signing in.

1. The data is stored on a server we manage, on infrastructure provided by Cloudflare, Inc. Backup data is kept separately for each Google account ID in the account information, and can be read or written only by the App signed in to that account. Other users cannot read it.
2. We do not look at the contents of backup data, except as needed to run the Service, investigate faults, deal with misuse, and comply with the law.
3. The email address in the account information is used only to identify the relevant data and confirm identity when a user contacts us or asks for deletion. It is not used for advertising, solicitation or any other purpose, and we do not send users email.
4. Each user can store up to 5 GB (20 GB while using Poppin Pro). Backup data and account information past the following periods may be deleted without prior notice:
   • when the App, signed in, has not communicated with our server for 6 months since it last did (including the sync that runs automatically when the App is opened and closed). This does not apply while Poppin Pro is in use
   • when 6 months have passed since Poppin Pro ended with more than 5 GB stored. The period counts from the day Poppin Pro ended and is not extended by syncing, reading or deleting in the meantime. It does not apply if the amount stored is brought down to 5 GB or less during the period, or if Poppin Pro is resumed
   
   On-device data is not lost by these deletions. After such a deletion, signing in again on the device and syncing saves the on-device data again. The previous contents of a deck that is overwritten or deleted are kept for 30 days so that mistakes can be undone, and then deleted. On-device data is not lost by these deletions.
5. Backup data and account information can be deleted entirely at any time with "Delete cloud data" in the App (from either the Android application or the browser version).
   • This also immediately deletes the previous contents kept for 30 days under the preceding item and every sign-in key (item 7)
   • The device or browser used is signed out after the deletion. On-device data remains
   • If another device or browser is still signed in, that device's decks are saved to our server again at its next sync. To delete everything, sign out on your other devices first
   • If you cannot use the App, contact us at the address in Article 13 and we will delete it
   
   Uninstalling the App does not delete backup data on the server. It is designed to remain, for example for a change of phone.
6. Earlier versions of the App saved backup data in the app-specific area (appDataFolder) of the user's own Google Drive. To move to our server, the Android application reads that data once. The only Google permission it asks for this is read/write access to that area (the drive.appdata scope); it does not ask for access to any other files, photos or documents in the user's Drive. The App never deletes the backup data in Google Drive; it can be deleted from Android Settings → Google → "Data from apps". The browser version does not access Google Drive.
7. Sign-in keys of the browser version
   • When a user signs in to the browser version, our server issues a sign-in key, valid for 30 days from issue.
   • Only if "Keep me signed in" is selected on the sign-in screen is the sign-in key saved in that browser's storage (localStorage). Otherwise it is kept only while the page is open and is lost when the page is closed.
   • Our server does not store the sign-in key itself; it stores only a value computed from it (a SHA-256 hash), its expiry, and the email address at the time of issue, together with the account information. Up to the 20 most recent are kept per account.
   • Signing out of the browser version deletes that sign-in key from our server as well, after which it cannot be used. Deleting under item 5 makes every sign-in key unusable.
   • Sign-in keys are not cookies and are not used for advertising or tracking.
8. The browser version and media files: the browser version does not save in the browser the pictures and sounds of decks that arrive by sync. It keeps in the browser's storage only a list of file names showing which deck has which files. The list is used only so that the pictures and sounds on other devices are not lost when a deck edited in the browser version is synced.

3. Usage data (optional)

The Android application sends usage data to our server at most once a day, and only when the user has turned it on. It is off by default and nothing is sent unless it is turned on. The setting can be changed at any time with "Send usage data" in the menu opened from the icon at the top right of the deck list. It can be changed whether or not the user is signed in to a Google account, and is independent of sync.

The browser version does not send usage data, and has no setting to turn it on.

1. The information sent is the following. It does not include the contents of decks or cards, text entered, pictures, sounds, or the URLs of pages viewed.
   • The App's settings (the interval between questions, the number of questions at a time, whether the schedule feature is on and how many schedules there are, the daily study limit, whether cards are shuffled, whether advanced editing is on, and so on)
   • Counts only (the number of decks, cards, levels of deck nesting, card types, monitored targets, and monitored targets the user added)
   • The identifiers of monitored services that are on the list built into the App
   • The number of answers in Pop Quiz and in Study
   • Whether Poppin Pro is in use, and whether automatic sync is on
   • The App's version, the date sent, the installation identifier and the account identifier
   • The device's Android version and display language
   • Whether three permissions (usage access, accessibility, display over other apps) are granted
   • Days since installation and days since the last answer
   • Total and today's time spent in monitored apps (seconds only; not which app was used when)
2. The following are never sent:
   • Deck names, card contents (text, pictures, sounds) and tags
   • The names and URLs of monitored apps and sites the user added
   • URLs and screen contents read by the accessibility service
   • Device identifiers, the advertising ID, Google account information, location
3. The installation identifier is used only to count sends from the same device as one. It is lost when the App's data is cleared or the App is uninstalled, and a different one is generated if sending is turned on again. Neither identifier on its own reveals a name or contact information, but the account identifier is associated with the account information when sync is used, as described in Article 1(8).
4. Usage data is stored on a server we manage, on infrastructure provided by Cloudflare, Inc. We use it only to improve the App, do not sell it, and do not provide it to third parties except as set out in Article 5.
5. When sending is turned off, nothing more is sent. To have data already sent deleted, contact us at the address in Article 13.

4. Feedback (optional)

The Android application sends feedback to our server only when the user enters text on the feedback screen and sends it. Nothing is sent unless the user sends it. This is independent of the usage data setting; feedback can be sent with sending usage turned off. The browser version does not send feedback to our server; its "Feedback and bug reports" opens the user's email app with a message to the address in Article 13.

1. The information sent is:
   • The text the user entered (including the kind of feedback chosen)
   • The App's version and display language
   • The device's Android version and model name
   • The time it was sent
2. The installation identifier, account identifier, Google account information and the contents of decks and cards are not sent, so we cannot link feedback to usage data. The model name is collected to investigate problems that occur only on certain models, and is not part of usage data.
3. The text is written by the user. Any personal information written in it is sent to us. We recommend not including any.
4. We do not reply to feedback. If you would like an answer, contact us at the address in Article 13.
5. Feedback is stored on a server we manage, on infrastructure provided by Cloudflare, Inc., and used only to improve the App. We do not sell it, and do not provide it to third parties except as set out in Article 5. To have it deleted, contact us at the address in Article 13.

5. Information collected by third-party services

The App includes the following third-party services, which handle information under their own privacy policies. See the links for details.

1. Google AdMob (Google LLC) — in the Android application, for delivering ads, may collect the advertising ID, approximate location and technical information about the device (How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/ads ). For users in the European Economic Area, the United Kingdom and Switzerland, and in US states whose laws require consent or an opportunity to opt out, we ask for consent to, or offer the opportunity to refuse, the use of information for advertising through Google's consent management (User Messaging Platform) (Article 7). The browser version shows no ads and does not include Google AdMob.
2. Google Account and Google Drive (Google LLC) — only when a user uses sync under section 2, the user's email address, display name and profile picture are provided to the App through Google's services for sign-in. The display name and profile picture are used only on the device to show the signed-in account, and are never sent to our server. Our server receives only the account information defined in Article 1. Google Drive is used only for the one-time read for the move described in section 2, item 6 (Google Privacy Policy: https://policies.google.com/privacy ).
   The browser version signs in with Google's sign-in button (Google Identity Services). The button is loaded from Google's servers, and Google may use cookies and similar technologies under its own policies. The App's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy ). We use information obtained from Google APIs only to provide the App's features to the user, do not sell or transfer it to third parties, and do not use it for advertising. No human reads it, except with the user's consent, as needed for security purposes (such as investigating misuse), to comply with the law, or when aggregated so that individuals cannot be identified and used to run the Service. It is not used to develop, improve or train general-purpose artificial intelligence or machine learning models.
3. Components used to display the browser version (Google LLC) — the browser version may load components for drawing the screen and font data from Google's servers (gstatic.com). As with viewing any web page, technical information such as the IP address and browser type reaches Google.
4. RevenueCat (RevenueCat, Inc.) — only when a user buys the paid feature in the Android application, handles the purchase token issued by Google Play, the identifier of the product bought, and an identifier generated for each installation of the App, to confirm the purchase and manage its period. When the user is signed in with a Google account, the Google account ID is used instead of the per-installation identifier, so that our server can check the space for sync under section 2. No name, email address or other contact information is sent (RevenueCat Privacy Policy: https://www.revenuecat.com/privacy/ ). The browser version cannot buy the paid feature and does not include RevenueCat.
5. Cloudflare (Cloudflare, Inc.) — used to deliver the Site and the browser version, to store the backup data, account information and hashes of sign-in keys under section 2, and, only when the user sends them, to receive and store the usage data under section 3 and the feedback under section 4 (Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/ ).

6. Summary

Following the approach of Google Play's data safety section, the information we handle is summarised below.

Article 3 (Purposes of Use)

The information handled under Article 2 is used only for the following purposes:

1. Providing and running the App's main features (studying with flashcards, spaced-repetition scheduling, Pop Quiz)
2. Controlling when pops are shown according to the use of apps the user specified
3. Turning Pop Quiz on and off automatically on the days and times the user set
4. Saving, syncing and restoring backup data when the user has signed in
5. Keeping the user signed in to the browser version
6. Aggregating and analysing usage data when the user has turned sending on
7. Improving the quality of the Service, investigating faults and improving features in future
8. Confirming purchases of the paid feature and managing their period
9. Managing ad delivery and consent for advertising

Article 4 (Android Permissions Used by the App)

The App (the Android application) asks the user for the following Android permissions to provide its main features. Each is used only as far as needed for that feature and for no other purpose, in line with Google Play's policy that sensitive permissions be used only as needed for an app's core functionality. The browser version uses none of these permissions and does not collect the use of other apps or web pages.

1. Usage access (PACKAGE_USAGE_STATS): used to detect the app in the foreground. Only package names and the times they came to the foreground are obtained, and only the recent period is consulted temporarily on the device. This information is not stored as a log or history and is not sent off the device.
2. Accessibility service: used, within browsers and other apps the user chose as Pop Quiz targets, to detect the URL of the page being shown, to tell whether a short video is playing, and to close the picture-in-picture window when Pop Quiz appears. URLs are held in memory only temporarily to check them against the URL patterns the user set; they are never stored or accumulated as a browsing history and never sent off the device. The App does not obtain screen contents (screenshots, form input, passwords and so on) and does not monitor apps that were not chosen as targets.
3. Display over other apps (SYSTEM_ALERT_WINDOW): used only to show study pops in front of the target app.
4. Foreground service (FOREGROUND_SERVICE_SPECIAL_USE): used, while the user has Pop Quiz on, as the resident service that detects the app in the foreground and shows cards when a monitored app is in use. While it runs, a persistent notification in the status bar shows that it is running.
5. Alarms and reminders (SCHEDULE_EXACT_ALARM): used only to run the automatic on/off schedule for Pop Quiz at the days and times the user set. Without it the schedule still works, but may run a few minutes late.
6. Notifications (POST_NOTIFICATIONS): used only to tell the user that the schedule turned Pop Quiz on or off. No promotional notifications are sent.
7. Run at startup (RECEIVE_BOOT_COMPLETED): used only to register the alarms again after the device restarts, so that the schedule keeps running.

Article 5 (Provision to Third Parties)

We do not provide personal information to third parties without the user's prior consent, except:

1. As required by law
2. When necessary to protect a person's life, body or property and it is difficult to obtain the person's consent
3. When especially necessary to improve public health or promote the healthy upbringing of children and it is difficult to obtain the person's consent
4. When necessary to cooperate with a national or local government body, or a party entrusted by one, in carrying out duties prescribed by law, and obtaining the person's consent would hinder those duties

Provision to the third-party services in Article 2, section 5 that we use as infrastructure for storing backup data, account information, hashes of sign-in keys, usage data and feedback is provision incidental to outsourcing under the APPI, and is not provision to a third party under this Article. We supervise these contractors appropriately. Information Google AdMob obtains directly from the device to deliver ads is not information we hold and provide, and so is likewise not provision to a third party under this Article.

Use of providers outside Japan

1. We use services of Cloudflare, Inc., a US company (Workers, Durable Objects, R2 and others), to store backup data, account information, hashes of sign-in keys, usage data and feedback. Cloudflare has data centres around the world, including in Japan, and we do not specify the country where data is stored.
2. We use these services under an agreement with Cloudflare (a data processing agreement) under which Cloudflare handles data only within our instructions.
3. The United States has no comprehensive federal law on the protection of personal information, but has state laws. For the US system for protecting personal information, see the information published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku ).
4. Where required by the APPI, we will provide, on request, an outline of the measures for handling personal information at Cloudflare and related information.

Article 6 (Security Measures)

We take necessary and appropriate measures to prevent the leakage, loss or damage of the information we handle. Since backup data, account information and usage data are stored on a server we manage, we encrypt communication, keep each user's reading and writing separate, store sign-in keys only as hashes, and limit the number of writes per day, among other measures against misuse. In the browser version, the contents of cards the user made are shown in an area separated from the App's screen, so that card contents cannot reach sign-in information or decks.

For on-device data, users are responsible for protecting their own devices against loss, theft and misuse, and for managing their own Google accounts properly. When using the browser version on a shared computer, do not select "Keep me signed in", and sign out when you finish.

Article 7 (Advertising ID, Consent and Opting Out)

The App (the Android application) uses the advertising ID to deliver ads through Google AdMob.

1. Users in the European Economic Area, the United Kingdom and Switzerland are asked, before ads are shown, for consent to the use of information for advertising. Without consent the App can still be used, and non-personalised or limited ads may be shown.
2. Users in US states whose laws require an opportunity to refuse the "sale" or "sharing" of personal information (including use for targeted advertising) are given that opportunity.
3. The choices in the two preceding paragraphs can be changed at any time with "Ad privacy settings" on the App's settings screen (this item appears only in regions where consent or an opportunity to refuse is required).
4. The advertising ID can be reset or deleted, and personalised ads turned off, at any time in the ad settings in Android Settings (Google settings > Ads) or in Google's ad settings (https://myadcenter.google.com/ ). After opting out, non-personalised ads may still be shown.
5. No ads are shown while the paid feature (Poppin Pro) is in use. The browser version shows no ads.

Article 8 (Response to Data Breaches)

If we learn that personal information has been or may have been leaked, lost or damaged in connection with the server storing backup data, account information, hashes of sign-in keys or usage data, the infrastructure of the Site and the browser version, or third-party advertising services, we will promptly take the necessary measures as far as reasonably possible in accordance with the APPI and related guidelines, including investigating the facts, reporting to the Personal Information Protection Commission and notifying the persons concerned.

Article 9 (Requests for Disclosure, Correction, Suspension of Use, etc.)

1. On-device data can be deleted entirely by uninstalling the Android application or, in the browser version, by signing out or clearing the browser's site data. We do not hold this data, so it is not subject to requests to us for disclosure, correction, deletion and so on.
2. Backup data, account information and hashes of sign-in keys can be deleted entirely at any time with "Delete cloud data" in the App (the Android application or the browser version), as described in Article 2, section 2, item 5, including the note about devices still signed in. If you cannot use the App, contact us at the address in Article 13, stating the email address of the Google account you signed in with. As noted above, uninstalling alone does not delete them. Backup data saved in Google Drive by earlier versions can be deleted from Android Settings → Google → "Data from apps".
3. Sending usage data can be stopped at any time with "Send usage data" in the menu opened from the icon at the top right of the deck list. To have data already sent deleted, contact us at the address in Article 13.
4. To seek disclosure or deletion of information handled by third-party services (such as the advertising ID), use the methods in Article 7 or the opt-out and contact points those services provide.
5. In addition, to request disclosure, correction, suspension of use or similar under the APPI regarding our handling of information, contact us at the address in Article 13, stating the kind and content of the request and information for confirming your identity (your name and details identifying the request). We will respond within a reasonable period required by law once your identity is confirmed.

Article 10 (Use from Outside Japan)

The Service is intended mainly for users in Japan, but can be used from outside Japan.

1. For users in the European Economic Area, the United Kingdom and Switzerland, we handle information on the following bases:
   • Sync, sign-in to the browser version and feedback: necessary to provide the features the user asked for (performance of a contract)
   • Usage data and personalised ads: the user's consent
   • Measures against misuse and investigation of faults: our legitimate interest in providing the Service securely
2. These users have rights under the General Data Protection Regulation (GDPR) and similar laws to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. They may also lodge a complaint with the supervisory authority of their country.
3. The laws of California and other US states apply to businesses that meet conditions such as size, and may not apply to us. Whether or not they apply, we respond to requests from US residents to know, delete or correct their personal information in the same way as under Article 9. We do not sell personal information for money. The opportunity to refuse the use of information for advertising is offered through Google's consent management and can be changed as described in Article 7, paragraph 3.
4. These rights can be exercised by contacting us at the address in Article 13, and we respond as far as reasonably possible. We do not treat users unfavourably for exercising their rights.

Article 11 (The Site and the Browser Version)

1. The Site consists only of static web pages. It does not collect personal information through forms or other means and does not use analytics tools. It does not use cookies for advertising or tracking. However, Cloudflare, which delivers the Site, may set technically necessary cookies to detect attacks and identify automated access.
2. The browser version uses the browser's storage for the App's features, as described in Article 2, section 1 and section 2, items 7 and 8. It does not use analytics tools, ads, or cookies for tracking. When the Google components in Article 2, section 5, items 2 and 3 are loaded, Google may use cookies and similar technologies under its own policies.
3. The Extension counts the time the user spends on the sites they choose and, when that time reaches the interval they set, opens the quiz screen of the browser version. For this it handles:
   1. The address (URL) of the tab on screen — only on the sites the user chose and allowed it to read — used only to tell whether the tab is one of those sites. The address itself is not stored.
   2. The settings the user enters (chosen sites, interval, number of cards, deck), the total time counted, and the list of deck names received from the browser version.
   3. Whether the user is idle (so that time is not counted when nothing has been touched for a while or the screen is locked).
   These are stored only in the user's browser and are not sent to us or anyone else. Uninstalling the Extension deletes them. The quiz screen is the browser version, whose handling of information is as described in section 2 of this Article.
4. Before introducing anything else, we will revise this Policy and announce it on the Site.

Article 11-2 (Age)

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly. If you become aware of such a case, please contact us at the address in Article 13.

Article 12 (Changes to This Policy)

We may revise this Policy as needed, for example because of changes in law or in the Service. The revised Policy takes effect when it is posted on the Site. Important changes will be announced separately in the App or on the Site.

Revision History

• October 18, 2026 — Added the Extension to the preamble and added Article 11, section 3, as the Chrome extension is launched
• October 11, 2026 — Revised the preamble, Article 1, Article 2 sections 1 to 6, and Articles 3 to 11, as sync moved from the user's own Google Drive to our server and the browser version was launched. Added definitions of account information and sign-in keys. Set out how consent for advertising is obtained (European Economic Area, United Kingdom, Switzerland, US states)
• September 26, 2026 — Added Article 2, section 4 on in-app feedback, renumbering the former sections 4 and 5
• September 14, 2026 — Aligned the definition of usage data with what is sent under Article 2, section 3
• September 9, 2026 — Added RevenueCat as a third-party service with the paid feature, and set out how purchase information is handled
• September 3, 2026 — Added provisions on sending usage data (optional)
• July 20, 2026 — Established

Article 13 (Contact)

For questions about this Policy and requests under Articles 9 and 10, contact:

Poppin Studio Email: contact@poppin-studio.com The name and address of the business operator will be disclosed without delay upon request.