Privacy Policy

Po. ("Po.", "we", "us") is built around a simple principle: we can't expose what we never collect. This policy explains what we do collect, why, and the control you keep over it. It covers the Po. mobile apps for iOS and Android and the website at https://poapp.social.

1. What we collect

Account data. A username and a password (stored hashed, never in plain text). If you sign in with Google, we receive your name, email address, and profile picture from Google. If you sign in with Apple, we receive the name and email address you choose to share. If you use Hide My Email, we receive a private relay address instead of your real one. An email address may also be attached to your account for recovery.

Profile data you choose to add. Display name, bio, location, gender, avatar, and cover photo. All of these are optional. Po. never requires your real name; how you show up is your choice.

Content and activity. Your posts, replies, photos, direct messages, likes, reposts, bookmarks, follows, and hashtags. Direct messages are private between you and the recipient, but they are not end-to-end encrypted; they are stored on our servers so we can deliver them, and access by our team is restricted to what running and moderating the service requires.

Device and usage data. We use Google Firebase for analytics, crash reporting, and push notifications. Firebase collects device information such as model, operating system, app version, crash logs, notification tokens, and usage events. This data helps us keep the app fast and stable.

Purchase data. If you subscribe to a paid plan, Apple or Google takes the payment. We never see or store your card number, and no payment details reach our servers. We use RevenueCat to check that a purchase is genuine and to know whether your subscription is active. RevenueCat receives an identifier for your account, your device platform and app version, your country, and the purchase record from the store: what you bought, when, the price, and whether it renewed, lapsed, or was refunded.

On the website: nothing. The Po. website is a static site with no analytics, no tracking pixels, and no cookies. You cannot buy anything on it.

2. How we use it

We use your data to run Po.: delivering your posts and messages, building your For You and Following feeds, surfacing Trending, sending the notifications you'd expect from a social app, keeping the service safe through moderation and acting on the reports you send, unlocking the features you have paid for, and fixing crashes and bugs. We do not use your data for advertising.

3. What we share, and what we never do

We do not sell your personal data, and we do not share it with advertisers. Data is shared only with the service providers that make Po. run (Google Firebase, RevenueCat for subscriptions, and our cloud hosting provider), with Apple and Google when you make a purchase, when the law validly requires it, or when it is necessary to protect our users from serious harm. Public content is public: anyone can see your posts, profile, and follower counts, and reposts of your content remain visible under the reposter's feed.

4. Where your data lives

Our servers are hosted on cloud infrastructure located outside Indonesia, including in Singapore, Firebase data is processed on Google's infrastructure abroad, and RevenueCat processes subscription data in the United States. Wherever your data is stored, we apply the safeguards required by Indonesia's Personal Data Protection Law (Law No. 27 of 2022), including encryption in transit and restricted access.

5. Your rights and control

Under the Personal Data Protection Law you can access and correct your data, ask for a copy of it, object to or restrict its processing, withdraw consent, and delete it. Some of this you can do yourself: edit your profile in the app, or deactivate your account from Settings. To have your account and data deleted, or for anything else, email support@poapp.social and the Po. team will respond as the law requires.

6. Retention and deletion

We keep your data for as long as your account exists. You can deactivate your account from Settings at any time, which hides your profile and content from other users while your data is retained. If you want your account permanently deleted, contact the Po. team at support@poapp.social. Once your deletion request is processed, your profile and content are removed from the app, and residual copies in backups and logs are purged within 30 days, except where the law requires us to keep specific records longer. Content that others have reposted or quoted may remain visible in their feeds.

Purchase records are one of those exceptions. Tax and accounting law requires us to keep a record of what was sold and when, so a subscription record survives the deletion of your account. We keep it for as long as the law requires and we do not use it for anything else.

Deleting your Po. account does not cancel a subscription. Cancel it at the App Store or Google Play, as described in our Refund Policy.

7. Children

Po. is for users aged 16 and over, and users under 18 need the consent of a parent or guardian, as set out in our Terms of Service. We do not knowingly collect data from children under 16; if you believe we have, contact us and we will delete it.

8. Security

Data moves between the app and our servers over encrypted connections, passwords are stored hashed, and access to production data is limited to the people who need it to operate the service. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the Personal Data Protection Law requires.

9. Changes to this policy

We may update this policy as the service evolves. The current version always lives at this page with its effective date at the top, and we will notify you in the app or on the website when changes are material.