Privacy Policy
Last updated: 26 October 2026 · Pre-launch version
Privacy, the way a house actually works.
No tiny print, no surprise sharing. Here is exactly who can open what, how your PIN is protected, what the sharing switches really do, and what we never do with your pages.
Who can open whose diary
Access isn't equal, and that's the point. A teen's diary is closed to the rest of the house unless the teen opens it; a parent's diary is closed until the parent says so.
A teen profile
Stays in its own diary.
- Can never switch into, or open, a parent's diary.
- Sees a parent's pages only if that parent deliberately shares something.
- Keeps its own plans, moods, journal and photos on its own account.
A parent profile
Can look, when sharing is on.
- Can switch into a teen's planner on a shared phone, or view a linked teen's shared items.
- Sees only what the teen's sharing switches allow — read-only in Parent peek.
- Own diary can be PIN-protected so nobody else on the device opens it.
Adults in the same house
Keep independent accounts.
- Being in a family plan doesn't merge diaries — each adult signs in as themselves.
- Adults in school can still hold their own account and their own privacy switches.
- Nothing moves between accounts without a deliberate share or invite.
The Heart Padlock PIN
The padlock is for shared phones: one device, several people, one diary that stays shut.
Four digits, chosen by you. We refuse obvious ones like 0000 or 1234.
5 wrong tries locks the padlock for 10 minutes, then you can try again.
The PIN is checked on PaperPop's servers, and we store a scrambled fingerprint of it — never the digits themselves.
Switching into a teen's profile is a shared-device switch inside one account. It is not a second login, and it never reveals the parent diary.
If a PIN is forgotten, it can't be read back — it is set again from the signed-in account, and the old one stops working the moment the new one is saved.
What "shared" actually means
Sharing is switched on one thing at a time, per profile, and switched back off just as easily. Nothing is shared "for you" in the background.
Shared calendar
School, exams, sport and chores that both sides need to see. Switched per teen profile.
Diary entries
Off by default. When it's off, the diary is private and stays private.
Photos and mood journal
Only appear in Parent peek when the matching share switch is on. Private things stay private.
Parent peek
A read-only list of each teen's shared plans, moods, journal and photos. Nothing can be edited from there.
A teen always sees exactly what is shared from their own profile, in their own planner. A parent sees the same list in Parent peek — read-only.
What we keep, and where
Plans and to-dos, mood check-ins, journal entries, diary photos and sticker placements live in your PaperPop account — not only on the phone you used.
Diary photos are kept in private storage that only your account can read. The public homepage never reads them.
The diary, calendar and sticker previews on the public pages are illustrations. They don't load anyone's real diary.
Sign in with the same email on another phone or computer and the same pages come back.
What each page keeps
Every signed-in page keeps only what it needs to show your pages back to you. Here is exactly what lives in each one.
My planner
Your task titles, dates, repeat rules and which days you ticked them off; habit names and each day you logged a habit; and where you dragged stickers on your week and month spreads.
Monthly mood calendar
The mood emoji you picked for each date, and the mood-trends picture calculated from those check-ins. No diary words, no photos — just the emojis and dates.
My diary
Only what you type or stick on a diary page: entries, sticker placements and washi. Nobody else can read it — not a teen, not a parent, not another profile — unless a share switch is deliberately turned on for that item.
Mood journal
Your day-by-day journal text and saved moods, kept in the same locked space as the diary. On Duo it sits behind the same Heart Padlock PIN as diary entries.
Photos
Diary photos you save are stored as private files only your account can read, with the captions you wrote. Removing the photo pages from the menu never deletes the photos you already saved.
Sticker book
Which packs your profile unlocked, and your saved sticker positions per profile. Stickers you place on a diary, planner or About Me page stay in your own account.
Family pages
Family profiles, shared calendar events and family messages, plus who is allowed to see what. Teen profiles only ever see their own space plus what has been shared with them.
About Me
The friendship-book fields you fill in: emoji avatar, name, nickname, birthday, star sign, favourites, vibes and your own answers — editable whenever you like.
The public homepage is an illustration: it never reads your planner, diary, mood calendar, journal, photos or sticker placements, and signing in is what connects your saved pages to you.
Information collected and why
- Account and About Me
- Your email, account identifier and sign-in information keep your account secure. Your chosen emoji, name, nickname, optional birthday, calculated star sign, favourites, vibes and answers are saved when you choose to add them. Avoid adding information you do not want in an exported image.
- Diary and planner
- We store diary and mood-journal text, dated mood emojis, task titles, dates, repeat rules, completion records, habits and logs, sticker positions and saved photo files/captions to display your pages and keep progress across sessions. These may reveal sensitive personal information; they are not public homepage content.
- Plans and membership
- Selected Solo, Duo or Family plan, billing period, price, trial dates, order status, payment reference and verification dates are used to show purchase history and determine access. Preview payments are test-only. PaperPop does not collect card numbers or card security codes in its checkout; a payment provider handles its own payment form under its privacy policy.
- Family and security
- Family profile identifiers, display names, avatars, themes, sharing settings, invitations, linked-account identifiers, shared messages and calendar events support authorised Family use. PINs are stored as salted hashes, with failed-attempt and lockout records; a short-lived server-side unlock is tied to the signed-in session.
- Interest forms and technical information
- Waitlists collect your submitted email; drop-interest forms collect your submitted name, email and chosen drop. They record interest, not orders. Necessary hosting and sign-in services process request and security information such as IP addresses, browser information and errors to run and protect the service. Optional visitor analytics are described below.
Duo and Family privacy
Family setup and Parent account pages require an active, verified Family membership. Trial, Solo and Duo choices do not grant those pages, and test checkout never enables them.
Duo private diary and mood-journal entries require a PIN. About Me and planner pages remain outside that diary lock; their availability does not merge accounts or automatically publish either page. Only About Me and planner content is eligible for deliberate Duo sharing, never private diary entries.
For Family use, sharing settings determine what a parent can see. Teen profiles must never open the parent's private diary. Shared-device switching is not separate-device authentication: protect the account password and lock the device when handing it to someone else.
Service providers, sharing and transfers
Lovable Cloud provides account, data and private-file services; hosting and sign-in providers you choose process information needed for their role. Paddle is the Merchant of Record and receives account and order information needed for sales, subscription management, payments, tax compliance and invoicing. It never receives your diary, mood journal or planner text. Providers may process information outside South Africa. Specific hosting locations, contractual safeguards and the legal responsible party still need to be confirmed before live commerce opens.
Information may be disclosed where legally required or necessary to address fraud, security incidents or legal claims. We do not sell your diary or contact details. Instagram links open an external service with its own privacy policy.
Export and Share create a copy of your selected content. Check names, birthdays, text and photos before sharing. Recipients and external services may keep copies even after you delete the original. Calendar exports are one-way files, not ongoing calendar access.
The planner no longer shows AI brain-dump input. If an AI planning tool becomes available, only text deliberately submitted to that tool should be processed by its provider; it must not automatically read your private diary.
Retention, your rights and contact
Saved content is kept to provide your account until you remove it or delete the account. Trial expiry does not itself delete saved pages. Necessary security, purchase and legal records may need to be retained separately; no fixed retention period or backup-erasure deadline has yet been confirmed.
You may request access, correction or deletion of your personal information, object to processing where applicable, and withdraw optional consent. Edit your pages directly, download available records in Settings, or use account deletion on About Me. Deleting the account cannot erase copies already downloaded or shared elsewhere.
For privacy requests, use the official @xoxopaperpop contact without sending passwords, PINs or private diary content. The legal seller identity, formal privacy contact and applicable business details remain unconfirmed; see Seller details. Where POPIA applies, you may also raise a complaint with South Africa's Information Regulator.
We update this policy as the service changes; the date above identifies this version. Read it alongside the Terms & Conditions.
Your copy, your exit
Take a copy
Settings has a one-click download of your plans, moods, journal words and photo captions.
Back it up
Back up now from Settings to keep a dated snapshot of what's in your account.
Delete it
Remove saved items or use Delete my account on About Me. Shared copies and legally required records may remain outside your active account.
Lock it
Set or change your Heart Padlock PIN at any time. Changing it takes effect immediately.
Cookies and analytics
Essential storage only remembers your privacy choice and keeps you signed in. Optional analytics would measure which public preview you opened and which button you pressed — never your age, and never what you wrote.
Your choice is saved on your device and can be changed at any time in the Privacy & cookies control in the footer. Do Not Track and Global Privacy Control take priority over an opt-in.
No visitor analytics service is connected to this website yet, so no analytics are sent at all right now. Diary entries, photos, planning descriptions, names, email addresses and invitation details are excluded from analytics permanently — even once a service is connected.
What we never do
- Sell or rent your diary, your photos or your contact details.
- Put diary content, photos or moods on a public page.
- Open a pack, a drop or a membership before it is really paid for.
- Post anything to Instagram or anywhere else without you doing the last tap.
- Let a teen profile reach a parent diary, with or without a PIN.
Under 18? Keep optional analytics off and ask a parent or guardian before sharing an email address. Sticker drops shown on this site are concepts with planned windows — they don't read anyone's diary and nothing unlocks before it is paid for.
PaperPop is made in South Africa 🇿🇦 · prices in ZAR · this page describes the app as it is built today