Privacy Policy

1. Information we collect

• Account information: your name and email address. Sign-in is handled by Google Firebase Authentication; if you use a password, Firebase stores it in hashed form and we never see it. If you sign in with Google, we receive the basic profile Google shares (name, email address and profile photo).
• Workspace and collaboration: workspace names, members and their roles, invitations you send (including the invitee’s email address), comments and activity records.
• Websites you submit: the URL, the publicly accessible pages we crawl from it (text, titles, links, structured data and image addresses), performance results from Google PageSpeed Insights, public mentions we look up on Hacker News and GitHub, and official social accounts linked from the site.
• What you create in popco: brand files, plans, conversations with the AI CMO, the instructions you give, and generated outputs such as scripts, FAQs and rewritten titles and descriptions.
• Connected services, only if you connect them: for Google Analytics and Google Search Console, OAuth tokens with read-only access and the aggregated weekly figures we read (organic-search sessions; search clicks and impressions); for Popcraft and PopKit, OAuth tokens (or the PopKit API key you provided earlier). Tokens and keys are encrypted with Google Cloud KMS.
• Payments: payments are processed by Stripe. We receive the plan, amount, currency, payment status and a customer reference. We never receive or store full card numbers.
• Usage and device information: server logs (IP address, browser type, pages requested, timestamps) and, while you have a brand open in the workbench, a presence signal (which brand and when). We use it to show collaborators who is online and to decide which brands receive automatic re-audits.
• Cookies and local storage: a sign-in session cookie, your language and theme preferences, and Firebase sign-in state. We do not use advertising or cross-site tracking cookies.

2. How we use information

• To provide the service: sign you in, crawl and audit websites, run analyses, generate plans and fixes, show dashboards and support collaboration.
• To re-audit automatically: brands that someone in the workspace opened in the last 30 days are re-audited about once a week.
• To operate billing and quotas, prevent fraud and abuse, and keep the service secure.
• To send service emails, such as invitations and account or billing notices.
• To improve popco, using aggregated or de-identified information.
• To comply with legal obligations.

We do not sell personal information, and we do not use it for targeted advertising.

3. AI processing

popco uses AI models to analyze websites and generate content. To do this we send the relevant material — website content, your brand file and instructions, audit results and, if connected, Google Analytics and Search Console figures — to Google Vertex AI (Gemini models, including Grounding with Google Search for AI-search visibility checks), which processes it on our behalf.

We do not use your content, or data we receive from Google APIs, to train AI models. AI output can be wrong; review it before you publish it or act on it.

4. Google user data

If you connect Google Analytics or Google Search Console, popco asks Google for read-only access (the analytics.readonly and webmasters.readonly scopes) to the property or site you choose, and reads aggregated weekly figures from it.

• We use this data only to show those figures in your workbench and to give your AI CMO context about your own site’s results.
• We share it only with the service providers needed to deliver those features (our hosting and Google Vertex AI). We do not sell it, use it for advertising, or use it to train AI models.
• People at popco do not read it, except with your permission, where needed for security, or to comply with the law.
• You can disconnect at any time in popco’s integrations, or revoke access at https://myaccount.google.com/permissions. When you disconnect in popco, we delete the stored tokens and the figures we fetched.

popco’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share information with

• Service providers that run popco for us: Google Cloud (hosting, database, storage, encryption keys, Firebase Authentication, Vertex AI and PageSpeed Insights), Stripe (payments) and Resend (email delivery).
• Popcraft and PopKit, products of our affiliated team, only when you connect them and only to generate media or schedule posts at your request.
• Other members of your workspace, and anyone you share a plan with through a share link.
• Authorities, when the law requires it or to protect rights, safety and security.
• A successor, if popco is involved in a merger, acquisition or sale of assets, subject to this policy.

6. Where information is processed

popco runs on Google Cloud in the United States (us-central1). AI processing uses Google Vertex AI. Gemini 3 models are called through Vertex AI’s global endpoint, so a request may be handled outside the United States. Other providers, such as Stripe and Resend, may process data in other countries. Where the law requires, we rely on appropriate safeguards for these transfers.

7. How long we keep information

We keep information for as long as your account or workspace exists. A workspace owner can delete the workspace, which deletes its brands, analyses, conversations and connected-service credentials. We keep records the law requires us to keep, such as payment and tax records, for as long as it requires, and server logs for a limited period.

8. Security

All traffic uses HTTPS, connected-service credentials are encrypted with Google Cloud KMS, and access to production systems is limited. No method of transmission or storage is completely secure.

9. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, the CCPA or China’s Personal Information Protection Law), you may have the right to access, correct, delete or export your personal information, to object to or restrict its processing, and to withdraw consent. Contact us at support@loxily.com to exercise these rights. You can also complain to your local data protection authority.

10. Children

popco is a business tool and is not intended for anyone under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy. We will change the effective date above and, for material changes, tell you on the site or by email before they take effect.

12. Contact

Loxily Network Limited · support@loxily.com