Pop or Keep is a web app (installable as a PWA). This page covers every cookie, token, and cached item we store in your browser, whether you use Pop or Keep in a tab or installed on your home screen.
1. Cookies set by poporkeep.com
balloon_at: access token (httpOnly, Secure, SameSite=Lax). 15-minute TTL. Authentication.balloon_rt: refresh token (httpOnly, Secure, SameSite=Lax). 30-day TTL. Keeps you signed in.balloon_csrf: CSRF double-submit token. Session only. Security.ph_*(PostHog): visit counts, page funnel. 1-year TTL. Opt out via the banner.
Auth cookies are first-party only and never sent cross-site. We do not run third-party ad trackers.
2. Other local storage in your browser
localStorage: non-sensitive UI state (onboarding completed flag, last tab, draft message).- Service Worker Cache + HTTP cache: cached photos and app shell for fast loads and offline start.
- Browser
PushManagersubscription: endpoint + keys used to deliver match notifications. Only created if you opt in to push.
3. Third-party SDKs
- Sentry: collects crash reports. We scrub email and user id from stack traces before submission.
- PostHog: product analytics events (pop, keep, match, message, report). Anonymous id; no name or photo is sent.
- Web Push (VAPID → FCM / Apple Push): notification delivery; does not set trackers.
4. Your choices
- In the app, go to Me → Privacy to disable non-essential analytics.
- At the browser level, you can deny push notifications, camera access, and location access; Pop or Keep degrades gracefully.
- Clear site data in your browser (or uninstall the PWA) to reset consent state and remove cached images.
- We honor
DNT: 1andSec-GPC: 1by disabling PostHog for that visitor.
5. Contact
Questions: privacy@poporkeep.com.