The short version: we do not know who you are, and there is no account to attach anything to.
Popolo is not released yet and has no users. This policy describes the service being built. Two of the protections below are designed but not yet in place, and each is marked where it appears — we would rather say so here than let you assume otherwise.
Popolo has no accounts. We never ask for a phone number, an email address, a name or a username, and there is nothing to sign up for. When you open the app it generates a key on your iPhone. That key is your entire identity, it stays in the device's Secure Enclave, and it never leaves the phone.
Because there is no account, there is nothing for us to attach information to even if we wanted to.
Messages will be end-to-end encrypted using the Signal protocol. Our servers will receive encrypted data they have no key for, hold it until your device collects it, and delete it 24 hours after it arrives whether or not it was delivered.
Not in place yet. The encryption layer is not finished in the current development build. Nobody is using Popolo and no real message has ever passed through it, but we are not going to describe encryption as done while it is not. This page will change when it is.
The app is built to send every request through a relay operated by a different company, using Oblivious HTTP. The relay can see your IP address but cannot read your request; we can read the request but never see an address. Linking the two would take both companies acting together, and that is the point.
Not in place yet. No relay is contracted, so in the current development build requests reach our servers directly and the separation above does not exist. It is the reason the app is not released.
Our own service keeps no logs of IP addresses, message metadata, or who talks to whom. The reverse proxy in front of it currently does write an access log containing addresses; that is being moved to a dedicated instance with logging disabled before launch.
Your conversations are stored on your device, encrypted by iOS so they cannot be read while the phone is locked. They are excluded from iCloud and iTunes backups, so a "disappeared" message does not quietly survive in a backup. Deleting the app deletes everything, permanently and with no way to recover it.
Once, when you first install Popolo, the app asks Apple to confirm it is a genuine copy. This stops automated abuse without us needing accounts or IP tracking. Apple learns that Popolo is installed on your device. Nothing you do afterwards is connected to that check, because everything afterwards uses anonymous tokens that cannot be traced back to it.
There are none. No analytics service, no advertising network, no attribution or tracking SDK of any kind is included in the app. We do not show ads and we do not sell anything about you, because we do not have anything about you.
Popolo is rated 18+ and is not intended for children.
If we receive a lawful request we will respond to it, and what we can produce is limited by what exists: encrypted data less than 24 hours old, if any is in transit at that moment. We cannot produce message content, contact lists, IP addresses, or an account history, because none of those things exist.
If this policy changes in a way that affects what we hold, the app will tell you before the change takes effect rather than updating this page quietly.