Privacy policy

Effective date: 28 October 2026

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what your rights are. Pop! is operated from Malaysia and this policy is written in accordance with the Personal Data Protection Act 2010 (PDPA).

1. Information We Collect

Information you give us directly

•         Account information: your username, email address, and password (stored as a one-way hash).

•         Profile information: your display name, bio, social media handles, contact note, and any profile customization you choose (theme, colors, font).

•         Outfit information: piece names, shop links, and prices you add to your outfit.

•         Content you post: posts, comments, chat messages, and profile notes you write.

•         Communications: messages you send to our team.

Information collected automatically

•         Log data: your IP address, browser type, and the pages you visit, collected when you use the service. We use this for security (rate limiting, detecting abuse) and basic traffic analysis.

•         Session data: a session cookie that keeps you logged in. We do not use third-party tracking cookies or advertising trackers.

Information from third parties

•         Profile photos: if you link a social media account (Instagram, X, YouTube, GitHub, or Telegram), we fetch your public profile photo from that platform via unavatar.io, and may also look up a Gravatar photo using a hashed version of your email address. We do not store these photos — they are fetched on demand and displayed directly from the source.

2. How We Use Your Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

3. Public and Private Information

Public by default. Your username, display name, profile, outfit, posts, and comments are public and visible to all visitors (unless you or a moderator hides them, or your profile is set to inactive). Public content is indexed by search engines and included in our sitemap.

Private. Your email address is private unless you choose to show it on your profile. Saved posts are visible only to you. Your password is stored as a hash and is never accessible in plain text, even to us.

Following. Your list of followers and the accounts you follow are visible on your public profile page.

4. Cookies and Storage

We use one first-party session cookie to keep you logged in. We do not use advertising cookies, third-party analytics trackers, or fingerprinting. The service may store a small amount of data in your browser (localStorage) for preferences such as light or dark mode — this data never leaves your device.

5. Third-Party Services

We rely on a small number of third-party services to operate:

Links you post to third-party shops (Shopee, Zalora, Amazon, SHEIN, and others) are not covered by this policy. Visiting those sites is governed by their own terms and privacy policies.

6. Data Retention

•         Account data is kept for as long as your account is active, and for up to 90 days after deletion to allow for abuse investigations and appeals.

•         Posts and content you delete are removed from public view immediately. Residual copies in backups are removed within 30 days.

•         Notification records older than 90 days are deleted automatically.

•         Server logs (IP addresses, access records) are kept for up to 90 days.

•         Password reset and email confirmation tokens expire after 1 hour and 48 hours respectively, and are purged from the database after use.

7. Security

We protect your data using:

•         HTTPS (TLS) for all connections.

•         One-way password hashing (bcrypt).

•         CSRF tokens on all state-changing requests.

•         Rate limiting on login, sign-up, and password reset to prevent brute force attacks.

•         Bot protection (Cloudflare Turnstile) on sign-up and password reset.

No system is completely secure. If we become aware of a breach that is likely to affect your rights, we will notify affected members and the relevant authorities as required by law.

8. Children

Pop! is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

9. Your Rights

Under the PDPA and general principles of data protection, you have the right to:

•         Access the personal information we hold about you.

•         Correct inaccurate or incomplete information (most profile data is editable directly in Settings).

•         Delete your account and associated data by contacting us.

•         Withdraw consent for any processing based on consent, at any time.

•         Object to processing based on legitimate interests where your situation warrants it.

To exercise any of these rights, contact us using the details below. We will respond within a reasonable time and in any event within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered members of material changes by posting a notice on the site or by email. The date at the top of this page reflects the most recent update. Continued use of Pop! after a change takes effect constitutes acceptance of the revised policy.

11. Contact

For privacy enquiries, data requests, or to report a concern, please contact us.